升级至JDK7u191后JBoss启动触发SecurityVault异常求助

将JDK版本从JDK7u171切换至JDK7u191后，启动JBoss EAP 6.3.3.GA时出现启动失败，核心报错为Invalid secret key format，完整报错日志如下：

05:05:51,804 ERROR [org.jboss.as.controller.management-operation] (Controller Boot Thread) JBAS014612: Operation ("add") failed - address: ([("core-service" => "vault")]): java.lang.RuntimeException: JBAS015804: Error initializing vault --  org.jboss.as.server.services.security.VaultReaderException: JBAS013313: Vault Reader Exception:
    at org.jboss.as.server.services.security.VaultAddHandler.performRuntime(VaultAddHandler.java:89) [jboss-as-server-7.4.3.Final-redhat-2-bz-1195283.jar:7.4.3.Final-redhat-3]
    at org.jboss.as.controller.AbstractAddStepHandler$1.execute(AbstractAddStepHandler.java:75) [jboss-as-controller-7.4.3.Final-redhat-2.jar:7.4.3.Final-redhat-2]
    at org.jboss.as.controller.AbstractOperationContext.executeStep(AbstractOperationContext.java:611) [jboss-as-controller-7.4.3.Final-redhat-2.jar:7.4.3.Final-redhat-2]
    at org.jboss.as.controller.AbstractOperationContext.doCompleteStep(AbstractOperationContext.java:489) [jboss-as-controller-7.4.3.Final-redhat-2.jar:7.4.3.Final-redhat-2]
    at org.jboss.as.controller.AbstractOperationContext.completeStepInternal(AbstractOperationContext.java:290) [jboss-as-controller-7.4.3.Final-redhat-2.jar:7.4.3.Final-redhat-2]
    at org.jboss.as.controller.AbstractOperationContext.executeOperation(AbstractOperationContext.java:285) [jboss-as-controller-7.4.3.Final-redhat-2.jar:7.4.3.Final-redhat-2]
    at org.jboss.as.controller.OperationContextImpl.executeOperation(OperationContextImpl.java:1132) [jboss-as-controller-7.4.3.Final-redhat-2.jar:7.4.3.Final-redhat-2]
    at org.jboss.as.controller.ModelControllerImpl.boot(ModelControllerImpl.java:322) [jboss-as-controller-7.4.3.Final-redhat-2.jar:7.4.3.Final-redhat-2]
    at org.jboss.as.controller.AbstractControllerService.boot(AbstractControllerService.java:292) [jboss-as-controller-7.4.3.Final-redhat-2.jar:7.4.3.Final-redhat-2]
    at org.jboss.as.server.ServerService.boot(ServerService.java:346) [jboss-as-server-7.4.3.Final-redhat-2-bz-1195283.jar:7.4.3.Final-redhat-3]
    at org.jboss.as.server.ServerService.boot(ServerService.java:321) [jboss-as-server-7.4.3.Final-redhat-2-bz-1195283.jar:7.4.3.Final-redhat-3]
    at org.jboss.as.controller.AbstractControllerService$1.run(AbstractControllerService.java:254) [jboss-as-controller-7.4.3.Final-redhat-2.jar:7.4.3.Final-redhat-2]
    at java.lang.Thread.run(Thread.java:745) [rt.jar:1.7.0_191]
Caused by: org.jboss.as.server.services.security.VaultReaderException: JBAS013313: Vault Reader Exception:
    at org.jboss.as.security.vault.RuntimeVaultReader.createVault(RuntimeVaultReader.java:95) [jboss-as-security-7.4.3.Final-redhat-2.jar:7.4.3.Final-redhat-2]
    at org.jboss.as.server.services.security.VaultAddHandler.performRuntime(VaultAddHandler.java:87) [jboss-as-server-7.4.3.Final-redhat-2-bz-1195283.jar:7.4.3.Final-redhat-3]
    ... 12 more
Caused by: org.jboss.security.vault.SecurityVaultException: java.lang.RuntimeException: PBOX000140: Unable to get keystore (/instances/abc-test1/configuration/vault/vault.keystore)
    at org.picketbox.plugins.vault.PicketBoxSecurityVault.init(PicketBoxSecurityVault.java:210) [picketbox-4.0.19.SP10-redhat-1.jar:4.0.19.SP10-redhat-1]
    at org.jboss.as.security.vault.RuntimeVaultReader.createVault(RuntimeVaultReader.java:93) [jboss-as-security-7.4.3.Final-redhat-2.jar:7.4.3.Final-redhat-2]
    ... 13 more
Caused by: java.lang.RuntimeException: PBOX000140: Unable to get keystore (/instances/abc-test1/configuration/vault/vault.keystore)
    at org.picketbox.plugins.vault.PicketBoxSecurityVault.getKeyStore(PicketBoxSecurityVault.java:678) [picketbox-4.0.19.SP10-redhat-1.jar:4.0.19.SP10-redhat-1]
    at org.picketbox.plugins.vault.PicketBoxSecurityVault.init(PicketBoxSecurityVault.java:205) [picketbox-4.0.19.SP10-redhat-1.jar:4.0.19.SP10-redhat-1]
    ... 14 more
Caused by: java.io.IOException: Invalid secret key format
    at com.sun.crypto.provider.JceKeyStore.engineLoad(JceKeyStore.java:861) [sunjce_provider.jar:1.7.0_191]
    at java.security.KeyStore.load(KeyStore.java:1357) [rt.jar:1.7.0_191]
    at org.picketbox.util.KeyStoreUtil.getKeyStore(KeyStoreUtil.java:201) [picketbox-4.0.19.SP10-redhat-1.jar:4.0.19.SP10-redhat-1]
    at org.picketbox.util.KeyStoreUtil.getKeyStore(KeyStoreUtil.java:151) [picketbox-4.0.19.SP10-redhat-1.jar:4.0.19.SP10-redhat-1]
    at org.picketbox.plugins.vault.PicketBoxSecurityVault.getKeyStore(PicketBoxSecurityVault.java:675) [picketbox-4.0.19.SP10-redhat-1.jar:4.0.19.SP10-redhat-1]
    ... 15 more

05:05:51,825 FATAL [org.jboss.as.server] (Controller Boot Thread) JBAS015957: Server boot has failed in an unrecoverable manner; exiting. See previous messages for details.
05:05:51,867 INFO  [org.jboss.as] (MSC service thread 1-2) JBAS015950: JBoss EAP 6.3.3.GA (AS 7.4.3.Final-redhat-2) stopped in 11ms

环境信息 #

• JBoss EAP 6.3.3.GA (AS 7.4.3.Final-redhat-2)
• Java版本：1.7.0_191，Java HotSpot(TM) 64-Bit Server VM (build 24.191-b08, mixed mode)

根因分析 #

JDK 7u191对加密算法的兼容性做了调整，原JDK7u171生成的vault keystore使用的加密格式在新版本JDK中不再兼容，导致加载密钥库时抛出Invalid secret key format异常。

解决步骤 #

1. 重新生成JBoss Vault密钥库 #

使用JDK7u191的keytool工具重新生成vault所需的密钥库：

# 进入JBoss bin目录
cd /path/to/jboss-eap-6.3/bin
# Linux/macOS执行
./vault.sh
# Windows系统执行
vault.bat

按照向导完成配置：

• 指定密钥库路径（可覆盖原路径，操作前需备份原vault.keystore文件）
• 保持密钥库密码、salt值、迭代次数与原配置一致，或同步修改JBoss配置文件中的对应参数
• 重新存储原vault中的所有敏感信息（如数据库密码、API密钥等）

2. 验证密钥库有效性 #

使用JDK7u191的keytool检查新生成的密钥库：

keytool -list -keystore /instances/abc-test1/configuration/vault/vault.keystore

输入密码后能正常列出密钥库内容即为配置有效。

3. 同步JBoss配置文件 #

确保standalone.xml或domain.xml中的vault配置参数与新生成的信息完全匹配：

<core-service name="vault" module="org.jboss.as.security">
    <vault-option name="KEYSTORE_URL" value="/instances/abc-test1/configuration/vault/vault.keystore"/>
    <vault-option name="KEYSTORE_PASSWORD" value="MASK-XXXXXX"/>
    <vault-option name="KEYSTORE_ALIAS" value="vault"/>
    <vault-option name="SALT" value="XXXXXX"/>
    <vault-option name="ITERATION_COUNT" value="XXXX"/>
    <vault-option name="ENC_FILE_DIR" value="/instances/abc-test1/configuration/vault/"/>
</core-service>

4. 临时兼容方案（不推荐长期使用） #

若无法立即重新生成vault，可在JBoss启动参数中添加兼容配置：

# 在JBOSS_OPTS中追加以下参数
-Dcom.sun.crypto.provider.VerifyCertificateChain=false -Djava.security.egd=file:/dev/./urandom

注意：该方案仅作为临时过渡，长期需使用重新生成的密钥库以保证系统安全性。

内容的提问来源于stack exchange，提问作者Krishna