Добый день.
Пытаюсь зашифровать данные таким вот кодом по алиасу fns:
String certificateAlias = Optional.ofNullable(alias).orElseGet(() -> fnsAlias);

X509Certificate certificate = (X509Certificate) trustStore.getCertificate(certificateAlias);
if (certificate == null) {
throw new IllegalStateException(
"Certificate with alias '" + certificateAlias + "' was not found in the JKS!");
}

ByteArrayOutputStream envelopedByteArrayOutStream = new ByteArrayOutputStream();
EnvelopedSignature signature = new EnvelopedSignature();

signature.addKeyTransRecipient(certificate);

signature.open(envelopedByteArrayOutStream);
signature.update(data);

signature.close();

return envelopedByteArrayOutStream.toByteArray();

Получаю на одном окружении ошибку:
ru.CryptoPro.CAdES.exception.EnvelopedException: Opening of output context failed
at ru.CryptoPro.CAdES.EnvelopedSignature.open(Unknown Source) ~[CAdES.jar!/:na]
at ru.fns.crypto.service.EdoSignService.encryptAsByteArray(EdoSignService.java:361) ~[classes!/:na]
at ru.fns.crypto.controller.CryptoController.encryptEdo(CryptoController.java:310) ~[classes!/:na]
at sun.reflect.GeneratedMethodAccessor247.invoke(Unknown Source) ~[na:na]
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[na:1.8.0_222]
at java.lang.reflect.Method.invoke(Method.java:498) ~[na:1.8.0_222]
at org.springframework.web.method.support.InvocableHandlerMethod.doInvoke(InvocableHandlerMethod.java:209) ~[spring-web-5.0.10.RELEASE.jar!/:5.0.10.RELEASE]
at org.springframework.web.method.support.InvocableHandlerMethod.invokeForRequest(InvocableHandlerMethod.java:136) ~[spring-web-5.0.10.RELEASE.jar!/:5.0.10.RELEASE]
at org.springframework.web.servlet.mvc.method.annotation.ServletInvocableHandlerMethod.invokeAndHandle(ServletInvocableHandlerMethod.java:102) ~[spring-webmvc-5.0.10.RELEASE.jar!/:5.0.10.RELEASE]
at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.invokeHandlerMethod(RequestMappingHandlerAdapter.java:891) ~[spring-webmvc-5.0.10.RELEASE.jar!/:5.0.10.RELEASE]
at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.handleInternal(RequestMappingHandlerAdapter.java:797) ~[spring-webmvc-5.0.10.RELEASE.jar!/:5.0.10.RELEASE]
at org.springframework.web.servlet.mvc.method.AbstractHandlerMethodAdapter.handle(AbstractHandlerMethodAdapter.java:87) ~[spring-webmvc-5.0.10.RELEASE.jar!/:5.0.10.RELEASE]
at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:991) ~[spring-webmvc-5.0.10.RELEASE.jar!/:5.0.10.RELEASE]
at org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:925) ~[spring-webmvc-5.0.10.RELEASE.jar!/:5.0.10.RELEASE]
at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:974) ~[spring-webmvc-5.0.10.RELEASE.jar!/:5.0.10.RELEASE]
at org.springframework.web.servlet.FrameworkServlet.doPost(FrameworkServlet.java:877) ~[spring-webmvc-5.0.10.RELEASE.jar!/:5.0.10.RELEASE]
at javax.servlet.http.HttpServlet.service(HttpServlet.java:661) [tomcat-embed-core-8.5.34.jar!/:8.5.34]
at org.springframework.web.servlet.FrameworkServlet.service(FrameworkServlet.java:851) ~[spring-webmvc-5.0.10.RELEASE.jar!/:5.0.10.RELEASE]
at javax.servlet.http.HttpServlet.service(HttpServlet.java:742) [tomcat-embed-core-8.5.34.jar!/:8.5.34]
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:231) [tomcat-embed-core-8.5.34.jar!/:8.5.34]
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) [tomcat-embed-core-8.5.34.jar!/:8.5.34]
at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52) [tomcat-embed-websocket-8.5.34.jar!/:8.5.34]
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) [tomcat-embed-core-8.5.34.jar!/:8.5.34]
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) [tomcat-embed-core-8.5.34.jar!/:8.5.34]
at org.springframework.boot.actuate.web.trace.servlet.HttpTraceFilter.doFilterInternal(HttpTraceFilter.java:90) [spring-boot-actuator-2.0.6.RELEASE.jar!/:2.0.6.RELEASE]
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) [spring-web-5.0.10.RELEASE.jar!/:5.0.10.RELEASE]
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) [tomcat-embed-core-8.5.34.jar!/:8.5.34]
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) [tomcat-embed-core-8.5.34.jar!/:8.5.34]
at org.springframework.security.web.FilterChainProxy.doFilterInternal(FilterChainProxy.java:209) [spring-security-web-5.0.9.RELEASE.jar!/:5.0.9.RELEASE]
at org.springframework.security.web.FilterChainProxy.doFilter(FilterChainProxy.java:178) [spring-security-web-5.0.9.RELEASE.jar!/:5.0.9.RELEASE]
at org.springframework.web.filter.DelegatingFilterProxy.invokeDelegate(DelegatingFilterProxy.java:357) [spring-web-5.0.10.RELEASE.jar!/:5.0.10.RELEASE]
at org.springframework.web.filter.DelegatingFilterProxy.doFilter(DelegatingFilterProxy.java:270) [spring-web-5.0.10.RELEASE.jar!/:5.0.10.RELEASE]
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) [tomcat-embed-core-8.5.34.jar!/:8.5.34]
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) [tomcat-embed-core-8.5.34.jar!/:8.5.34]
at org.springframework.web.filter.RequestContextFilter.doFilterInternal(RequestContextFilter.java:99) [spring-web-5.0.10.RELEASE.jar!/:5.0.10.RELEASE]
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) [spring-web-5.0.10.RELEASE.jar!/:5.0.10.RELEASE]
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) [tomcat-embed-core-8.5.34.jar!/:8.5.34]
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) [tomcat-embed-core-8.5.34.jar!/:8.5.34]
at org.springframework.web.filter.HttpPutFormContentFilter.doFilterInternal(HttpPutFormContentFilter.java:109) [spring-web-5.0.10.RELEASE.jar!/:5.0.10.RELEASE]
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) [spring-web-5.0.10.RELEASE.jar!/:5.0.10.RELEASE]
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) [tomcat-embed-core-8.5.34.jar!/:8.5.34]
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) [tomcat-embed-core-8.5.34.jar!/:8.5.34]
at org.springframework.web.filter.HiddenHttpMethodFilter.doFilterInternal(HiddenHttpMethodFilter.java:93) [spring-web-5.0.10.RELEASE.jar!/:5.0.10.RELEASE]
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) [spring-web-5.0.10.RELEASE.jar!/:5.0.10.RELEASE]
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) [tomcat-embed-core-8.5.34.jar!/:8.5.34]
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) [tomcat-embed-core-8.5.34.jar!/:8.5.34]
at org.springframework.boot.actuate.metrics.web.servlet.WebMvcMetricsFilter.filterAndRecordMetrics(WebMvcMetricsFilter.java:155) [spring-boot-actuator-2.0.6.RELEASE.jar!/:2.0.6.RELEASE]
at org.springframework.boot.actuate.metrics.web.servlet.WebMvcMetricsFilter.filterAndRecordMetrics(WebMvcMetricsFilter.java:123) [spring-boot-actuator-2.0.6.RELEASE.jar!/:2.0.6.RELEASE]
at org.springframework.boot.actuate.metrics.web.servlet.WebMvcMetricsFilter.doFilterInternal(WebMvcMetricsFilter.java:108) [spring-boot-actuator-2.0.6.RELEASE.jar!/:2.0.6.RELEASE]
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) [spring-web-5.0.10.RELEASE.jar!/:5.0.10.RELEASE]
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) [tomcat-embed-core-8.5.34.jar!/:8.5.34]
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) [tomcat-embed-core-8.5.34.jar!/:8.5.34]
at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:200) [spring-web-5.0.10.RELEASE.jar!/:5.0.10.RELEASE]
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107) [spring-web-5.0.10.RELEASE.jar!/:5.0.10.RELEASE]
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193) [tomcat-embed-core-8.5.34.jar!/:8.5.34]
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166) [tomcat-embed-core-8.5.34.jar!/:8.5.34]
at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:198) [tomcat-embed-core-8.5.34.jar!/:8.5.34]
at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:96) [tomcat-embed-core-8.5.34.jar!/:8.5.34]
at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:493) [tomcat-embed-core-8.5.34.jar!/:8.5.34]
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:140) [tomcat-embed-core-8.5.34.jar!/:8.5.34]
at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:81) [tomcat-embed-core-8.5.34.jar!/:8.5.34]
at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:87) [tomcat-embed-core-8.5.34.jar!/:8.5.34]
at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:342) [tomcat-embed-core-8.5.34.jar!/:8.5.34]
at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:800) [tomcat-embed-core-8.5.34.jar!/:8.5.34]
at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:66) [tomcat-embed-core-8.5.34.jar!/:8.5.34]
at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:806) [tomcat-embed-core-8.5.34.jar!/:8.5.34]
at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1498) [tomcat-embed-core-8.5.34.jar!/:8.5.34]
at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49) [tomcat-embed-core-8.5.34.jar!/:8.5.34]
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149) [na:1.8.0_222]
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624) [na:1.8.0_222]
at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61) [tomcat-embed-core-8.5.34.jar!/:8.5.34]
at java.lang.Thread.run(Thread.java:748) [na:1.8.0_222]
Caused by: ru.CryptoPro.CAdES.exception.EnvelopedException: Invalid recipient
at ru.CryptoPro.CAdES.pc_1.pc_1.cl_2.generate(Unknown Source) ~[CAdES.jar!/:na]
at org.bouncycastle.cms.CMSEnvelopedDataStreamGenerator.doOpen(Unknown Source) ~[bcpkix-jdk15on-1.50.jar!/:1.50.0]
at org.bouncycastle.cms.CMSEnvelopedDataStreamGenerator.open(Unknown Source) ~[bcpkix-jdk15on-1.50.jar!/:1.50.0]
... 72 common frames omitted
Caused by: java.security.InvalidKeyException: null
at ru.CryptoPro.Crypto.Cipher.TransportCipher.engineWrap(Unknown Source) ~[JCryptoP.jar!/:na]
at javax.crypto.Cipher.wrap(Cipher.java:2497) ~[na:1.8.0_222]
... 75 common frames omitted
Caused by: java.lang.ClassCastException: sun.security.x509.X509Key cannot be cast to ru.CryptoPro.JCP.Key.GostPublicKey
... 77 common frames omitted

На других окружениях - все отлично шифрует. Брал один и тот же keystore(приложен). Не могли бы вы подсказать в чем может быть проблема?
keystore.txt (5kb) загружен 3 раз(а).

Отредактировано пользователем 22 октября 2019 г. 11:12:37(UTC)  | Причина: Не указана

Хранилище .jks. Password: justanotherpassword
Алгоритм подписи: ГОСТ Р 34.11-2012/34.10-2012 256 бит

fns.txt (3kb) загружен 2 раз(а). .crt

А может ли это зависеть от версии Java? Потому что локально это получилось воспроизвести, только переключив версию с 8-й на 11. Но при этом есть одинаковые окружения, где в одном такой ошибки нет, а в другом есть

была 1.8, переключили на jdk-11.0.2. версия jcp-2.0.40035

Но, интересно еще то, что на том окружении, где не работает шифрование приложенным ранее сертификатом, работает шифрование другими сертификатами. То есть именно с fns такое происходит. Вот с этим сертификатом все успешно проходит cert.txt (3kb) загружен 1 раз(а). (.cer)

Ниже конфиг

@Configuration
public class ApplicationConfig {

@PostConstruct
public void prepareCryptoProvider() throws IOException {
...
modifyCryptoProTrustStore();
...
}

private void modifyCryptoProTrustStore() {
Set cacertsTrustCertificates = AbstractCertificateChainBuilder.CACERTS_TRUST_CERTIFICATES;
Set cacertsIntermediateCertificates = AbstractCertificateChainBuilder.CACERTS_INTERMEDIATE_CERTIFICATES;

try (InputStream trustStoreInputStream = trustStoreResource.getInputStream()) {
KeyStore trustStore = KeyStore.getInstance(KeyStore.getDefaultType());
trustStore.load(trustStoreInputStream, trustStorePassword.toCharArray());

Enumeration<String> aliases = trustStore.aliases();
while (aliases.hasMoreElements()) {
String alias = aliases.nextElement();

final X509Certificate certificate = (X509Certificate) trustStore.getCertificate(alias);
if (AdESUtility.isSelfSignedForCaCerts(certificate)) {
cacertsTrustCertificates.add(certificate);
log.debug("Certificate below was added to Crypto.PRO trusted certificates:\n" + certificate);
} else if (!Platform.isIbm && !Platform.isAndroid) {
cacertsIntermediateCertificates.add(certificate);
log.debug("Certificate below was added to Crypto.PRO intermediate certificates:\n" + certificate);
} else if (AdESUtility.isGost(certificate)) {
cacertsIntermediateCertificates.add(certificate);
log.debug("Certificate below was added to Crypto.PRO intermediate certificates:\n" + certificate);
} else {
cacertsTrustCertificates.add(certificate);
log.debug("Certificate below was added to Crypto.PRO trusted certificates:\n" + certificate);
}
}

} catch (NoSuchAlgorithmException | KeyStoreException | CertificateException | IOException e) {
throw new RuntimeException(e);
}

if (Security.getProvider(RevCheck.PROVIDER_NAME) == null) {
Security.addProvider(new RevCheck());
}
if (Security.getProvider(JCP.PROVIDER_NAME) == null) {
Security.addProvider(new JCP());
}
if (Security.getProvider(CryptoProvider.PROVIDER_NAME) == null) {
Security.addProvider(new CryptoProvider());
}
}

Отредактировано пользователем 22 октября 2019 г. 10:51:58(UTC)  | Причина: Не указана