javax.servlet.ServletException: Servlet execution threw an

Hi All,

First time posting, I'm hoping I'm in the right section. The above overflow appears to be caused by something having to do with certs or security. The basic app (its an online file storage, web accessible) continues to function after this, but uploads break and are unusable. We use tomcat/Apache, and our Apache ssl certs are valid. Below is the stack trace (at least a portion), I've done a few google searches, but I'm boondoggled. Any advice would really be appreciated - Chris

root cause

java.lang.StackOverflowError

java.lang.ClassLoader.findBootstrapClass(Native

Method)

java.lang.ClassLoader.findBootstrapClass0

(ClassLoader.java:723)

java.lang.ClassLoader.loadClass(ClassLoader.java:294)

java.lang.ClassLoader.loadClass(ClassLoader.java:292)

sun.misc.Launcher$AppClassLoader.loadClass

(Launcher.java:265)

java.lang.ClassLoader.loadClass(ClassLoader.java:255)

org.apache.catalina.loader.WebappClassLoader.loadClas

s(WebappClassLoader.java:1255)

org.apache.catalina.loader.WebappClassLoader.loadClas

s(WebappClassLoader.java:1189)

java.security.Security.doGetImpl(Security.java:1122)

java.security.Security.doGetImpl(Security.java:1083)

java.security.Security.getImpl(Security.java:1044)

java.security.KeyFactory.getInstance

(KeyFactory.java:108)

sun.security.x509.X509Key.buildX509Key

(X509Key.java:200)

sun.security.x509.X509Key.parse(X509Key.java:150)

sun.security.x509.CertificateX509Key.<init>

(CertificateX509Key.java:58)

sun.security.x509.X509CertInfo.parse

(X509CertInfo.java:692)

sun.security.x509.X509CertInfo.<init>

(X509CertInfo.java:155)

sun.security.x509.X509CertImpl.parse

(X509CertImpl.java:1630)

sun.security.x509.X509CertImpl.<init>

(X509CertImpl.java:286)

sun.security.provider.X509Factory.engineGenerateCerti

ficate(X509Factory.java:94)

java.security.cert.CertificateFactory.generateCertifi

cate(CertificateFactory.java:389)

sun.security.pkcs.PKCS7.parseSignedData

(PKCS7.java:267)

sun.security.pkcs.PKCS7.parse(PKCS7.java:141)

sun.security.pkcs.PKCS7.parse(PKCS7.java:110)

sun.security.pkcs.PKCS7.<init>(PKCS7.java:92)

sun.security.util.SignatureFileVerifier.<init>

(SignatureFileVerifier.java:64)

java.util.jar.JarVerifier.processEntry

(JarVerifier.java:261)

java.util.jar.JarVerifier.update

(JarVerifier.java:194)

java.util.jar.JarFile.initializeVerifier

(JarFile.java:251)

java.util.jar.JarFile.getInputStream

(JarFile.java:313)

org.apache.catalina.loader.WebappClassLoader.findReso

urceInternal(WebappClassLoader.java:1791)

org.apache.catalina.loader.WebappClassLoader.findClas

sInternal(WebappClassLoader.java:1575)

org.apache.catalina.loader.WebappClassLoader.findClas

s(WebappClassLoader.java:860)

org.apache.catalina.loader.WebappClassLoader.loadClas

s(WebappClassLoader.java:1307)

org.apache.catalina.loader.WebappClassLoader.loadClas

s(WebappClassLoader.java:1189)

java.security.Security.doGetImpl(Security.java:1122)

java.security.Security.doGetImpl(Security.java:1083)

java.security.Security.getImpl(Security.java:1044)

java.security.KeyFactory.getInstance

(KeyFactory.java:108)

sun.security.x509.X509Key.buildX509Key

(X509Key.java:200)

sun.security.x509.X509Key.parse(X509Key.java:150)

sun.security.x509.CertificateX509Key.<init>

(CertificateX509Key.java:58)

sun.security.x509.X509CertInfo.parse

(X509CertInfo.java:692)

sun.security.x509.X509CertInfo.<init>

(X509CertInfo.java:155)

sun.security.x509.X509CertImpl.parse

(X509CertImpl.java:1630)

sun.security.x509.X509CertImpl.<init>

(X509CertImpl.java:286)

sun.security.provider.X509Factory.engineGenerateCerti

ficate(X509Factory.java:94)

java.security.cert.CertificateFactory.generateCertifi

cate(CertificateFactory.java:389)

sun.security.pkcs.PKCS7.parseSignedData

(PKCS7.java:267)

sun.security.pkcs.PKCS7.parse(PKCS7.java:141)

sun.security.pkcs.PKCS7.parse(PKCS7.java:110)

sun.security.pkcs.PKCS7.<init>(PKCS7.java:92)

sun.security.util.SignatureFileVerifier.<init>

(SignatureFileVerifier.java:64)

java.util.jar.JarVerifier.processEntry

(JarVerifier.java:261)

java.util.jar.JarVerifier.update

(JarVerifier.java:194)

java.util.jar.JarFile.initializeVerifier

(JarFile.java:251)

java.util.jar.JarFile.getInputStream

(JarFile.java:313)

org.apache.catalina.loader.WebappClassLoader.findReso

urceInternal(WebappClassLoader.java:1791)

org.apache.catalina.loader.WebappClassLoader.findClas

sInternal(WebappClassLoader.java:1575)

org.apache.catalina.loader.WebappClassLoader.findClas

s(WebappClassLoader.java:860)

org.apache.catalina.loader.WebappClassLoader.loadClas

s(WebappClassLoader.java:1307)

org.apache.catalina.loader.WebappClassLoader.loadClas

s(WebappClassLoader.java:1189)

java.security.Security.doGetImpl(Security.java:1122)

java.security.Security.doGetImpl(Security.java:1083)

java.security.Security.getImpl(Security.java:1044)

java.security.KeyFactory.getInstance

(KeyFactory.java:108)

sun.security.x509.X509Key.buildX50

message truncated

[5734 byte] By [Christopher99a] at [2007-10-2 3:33:30]
# 1

It is most likely caused while there is somewhere in the code which tries to insert a security provider in first position. search for Security.insertProviderAt and replace them with Security.addProvider if that is ok to your security provider.

See

http://java.sun.com/products/jce/jce122_knownbugs.html

for the details.

If your provider HAS TO BE DEPLOYED AS THE FIRST ONE, try hacks like this one:

http://taxido.blogspot.com/2004/05/set-java-security-provider-in-first.html

babakNa at 2007-7-15 22:46:03 > top of Java-index,Security,Signed Applets...
# 2

Thanks BabakN, we got the following from our vendor, so we're trying to follow up and figure out where the heck the errant jar file is, I'll let you know when we figure it out, thanks for your response, it was right on!

The exception implies that jars are being placed in the webapp loader that

should be higher (common loader or even in the jvm ext loader). The webapp

loader is special because it violates the standard classloader delegation

model

and always asks itself for things before its parent (this behavior is

specified

and required). It looks like the ssl provider has been placed in this

loader. This is a bad idea because in order to look through the signed jars

in

the loader, the ssl provider has to be loaded, but it can't be loaded

without

looking through the signed jars in the loader, but this can't be done until

the

ssl provider is loaded... Stack Overflow.

- Chris

Christopher99a at 2007-7-15 22:46:03 > top of Java-index,Security,Signed Applets...