Java Web LDAPS配置报错：trustAnchors参数不能为空

问题 #

基于LDAP的Java Web应用在实现LDAPS功能、添加自签名SSL证书时遇到报错：javax.net.ssl.SSLException: Unexpected error: java.security.InvalidAlgorithmParameterException: the trustAnchors parameter must be non-empty。已执行keytool生成并导入证书，将密钥库放在src/main/resources目录，配置了Spring YAML并通过代码设置系统属性，甚至把证书导入Java cacerts并指定信任库路径和密码，错误依旧存在，需要解决方法。

已执行的keytool命令 #

keytool -genkeypair -keyalg RSA -keysize 2048 -alias localhost -keystore keystore.jks -storepass your_password -validity 365 -keypass your_password -dname "CN=localhost"
keytool -export -alias localhost -keystore keystore.jks -file localhost.crt -storepass your_password
keytool -import -trustcacerts -alias localhost -file localhost.crt -keystore keystorename.jks -storepass your_password

Spring应用yml配置 #

ldap:
  urls: ldaps://localhost:10636
  base: uid=admin,ou=system
  username: uid=admin
  password: your_password
  base-environment:
    javax.net.ssl.trust-store: classpath:keystorename.jks
    javax.net.ssl.trust-store-password: changeit
    javax.net.ssl.trust-store-type: JKS
    javax.net.ssl.trust-store-provider: SUN
    javax.net.ssl.trust-store-alias: localhost

代码中设置的系统属性 #

String Keystore = "[redacted]";
System.setProperty("javax.net.ssl.trustStore", Keystore);
System.setProperty("javax.net.ssl.trustStoreType", "JKS");
System.setProperty("javax.net.ssl.trustStorePassword", "changeit");
System.setProperty("javax.net.debug", "ssl,handshake");

异常栈信息 #

org.springframework.ldap.CommunicationException: simple bind failed: localhost:10636; nested exception is javax.naming.CommunicationException: simple bind failed: localhost:10636 [Root exception is javax.net.ssl.SSLException: Unexpected error: java.security.InvalidAlgorithmParameterException: the trustAnchors parameter must be non-empty]
    at org.springframework.ldap.support.LdapUtils.convertLdapException(LdapUtils.java:108)
    at org.springframework.ldap.core.support.AbstractContextSource.createContext(AbstractContextSource.java:355)
    ...
Caused by: java.security.InvalidAlgorithmParameterException: the trustAnchors parameter must be non-empty
    at java.base/java.security.cert.PKIXParameters.setTrustAnchors(PKIXParameters.java:200)
    ...

解决方法 #

1. 确认信任库路径正确性 #

代码中[redacted]的路径如果是相对路径，容易导致JVM找不到文件。建议通过Spring资源加载获取绝对路径：

Resource resource = new ClassPathResource("keystorename.jks");
String trustStorePath = resource.getFile().getAbsolutePath();
System.setProperty("javax.net.ssl.trustStore", trustStorePath);

注意：打包成JAR后getResourceFile()会失效，此时需将信任库复制到本地文件系统，或用自定义TrustManager加载证书。

2. 验证信任库有效性 #

用keytool检查信任库是否包含目标证书：

keytool -list -v -keystore keystorename.jks -storepass your_password

确认输出中存在localhost别名的证书，且状态为trustedCertEntry。

3. 消除配置冲突 #

Spring LDAP的base-environment配置和代码中的系统属性可能冲突，二选一即可：

• 要么删除代码里的System.setProperty相关代码，完全依赖YAML配置；
• 要么移除YAML中base-environment下的SSL配置，确保系统属性生效。

4. 适配JVM信任库类型 #

Java 9+默认信任库类型为PKCS12而非JKS，可尝试转换信任库格式：

keytool -import -trustcacerts -alias localhost -file localhost.crt -keystore keystorename.p12 -storetype PKCS12 -storepass your_password

同时更新配置中的信任库路径和类型为PKCS12。

5. 自定义TrustManager加载证书 #

如果上述方法无效，直接在代码中自定义信任管理器绕开系统信任库问题：

// 加载证书文件
InputStream certInputStream = getClass().getResourceAsStream("/localhost.crt");
CertificateFactory cf = CertificateFactory.getInstance("X.509");
X509Certificate cert = (X509Certificate) cf.generateCertificate(certInputStream);

// 创建信任管理器
TrustManagerFactory tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
KeyStore ks = KeyStore.getInstance(KeyStore.getDefaultType());
ks.load(null);
ks.setCertificateEntry("localhost", cert);
tmf.init(ks);

// 创建SSL上下文
SSLContext sslContext = SSLContext.getInstance("TLS");
sslContext.init(null, tmf.getTrustManagers(), new SecureRandom());

// 配置Spring LDAP使用自定义SSL上下文
DefaultSpringSecurityContextSource contextSource = new DefaultSpringSecurityContextSource("ldaps://localhost:10636");
contextSource.setAuthenticationSource(() -> new DefaultTlsDirContextAuthenticationStrategy() {
    @Override
    protected SSLContext createSslContext() throws NamingException {
        return sslContext;
    }
});

内容的提问来源于stack exchange，提问作者Yasaswini