After updating the certificates for RSA Identity Governance & Lifecycle, WildFly reports error: JBAS015299: The KeyStore /home/oracle/keystore/aveksa.keystore does not contain any keys.
Originally Published: 2018-11-14
Last Modified: 2026-05-13
Article Number
Applies To
RSA Product/Service Type: Appliance
RSA Version/Condition: 7.0.0 and above
Issue
On examination, the following error is found in the WildFly log file: server.log.
2018-11-12 12:13:01,200 ERROR [org.jboss.msc.service.fail] (MSC service thread 1-1) MSC000001: Failed to start service jboss.server.controller.management.security_realm.AveksaRealm.key-manager: org.jboss.msc.service.StartException in service jboss.server.controller.management.security_realm.AveksaRealm.key-manager:
JBAS015299: The KeyStore /home/oracle/keystore/aveksa.keystore does not contain any keys.
When the /home/oracle/keystore/aveksa.keystore file is examined, the following results are returned.
# keytool -list -alias server -keystore aveksa.keystore Enter keystore password: server, Nov 7, 2018, trustedCertEntry, ...NOTE: The recommended password for the aveksa.keystore is: Av3k5a15num83r0n3
Cause
This is why WildFly reports that the file does not contain any keys.
This can occur if the "server" alias is replaced by a certificate.
Certificates are of Entry type: trustedCertEntry
Resolution
Work through all the steps from article https://community.rsa.com/s/article/Replacing-the-server-certificate-used-for-the-RSA-Identity-Governance-Lifecycle-appliance-web-administration-interface
This is because the Private Key entry in the aveksa.keystore is missing and needs to be re-generated.
Step 2 from article 30130 is as follows.
keytool -genkeypair -keysize 2048 -alias server -keyalg RSA -keystore my.keystore -dname "CN=rsa-img.rsa.com" -ext san=dns:rsa-img.rsa.com,dns:rsa-img
This creates a new keystore file, with the "server" alias that is of Entry type: PrivateKeyEntry
Notes
Related Articles
Are there any setbacks for having active members in disabled roles in IMG/Aveksa? Number of Views java.security.NoSuchAlgorithmException: SHA-256 MessageDigest not available Number of Views Are there any illegal characters that must not be included in role names? Number of Views Are there any Macintosh capable browsers supported? Number of Views After upgrade of the RSA Identity Governance and Lifecycle 7.0.1 IBM Tivoli Identity Manager (ITIM) agent to 7.0.1, the ag… Number of Views
Trending Articles
How to manipulate imported RSA SecurID Software Token(s) on an iPhone or iPad device Troubleshooting AFX Connector issues in RSA Identity Governance & Lifecycle Authentication Manager Security Console and Operations Console Inaccessible After Certificate Update How to Forward RSA Authentication Manager 8.4 or Later Logs to Multiple Syslog Servers Using rsyslog RSA Authentication Manager 8.9 Patches and Hotfixes Readme
Don't see what you're looking for?
