<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
I use the rotate script daily and it was working without error.<br>
<a class="moz-txt-link-freetext" href="https://wiki.shibboleth.net/confluence/display/IDP30/SecretKeyManagement">https://wiki.shibboleth.net/confluence/display/IDP30/SecretKeyManagement</a><br>
<br>
I restored both Sealer.jks and Sealer.kver and verified the version
of secret key.<br>
However, I can't start Tomcat because of password of Sealer.jks<br>
<br>
Is it possible to recreate the keystore from <span class="st">scratch
? <br>
Can it be caused client side error ?<br>
</span>
<pre class="moz-signature" cols="72">Cordialement
Marc SAHIN
Administrateur Systèmes
Pôle Système - DSI - Université Lumière Lyon 2
04 78 77 26 66
</pre>
<div class="moz-cite-prefix">On 29/06/2017 14:58, Cantor, Scott
wrote:<br>
</div>
<blockquote type="cite"
cite="mid:47EA37D4-1B00-4322-996B-D45A18059D96@osu.edu">
<pre wrap="">(Or if you did reset the version file, those are just inevitable errors from clients holding data encrypted under an older key that are coming back now with data it can't decrypt.)
-- Scott
On 6/29/17, 8:55 AM, "Cantor, Scott" <a class="moz-txt-link-rfc2396E" href="mailto:cantor.2@osu.edu"><cantor.2@osu.edu></a> wrote:
On 6/29/17, 8:52 AM, "users on behalf of Marc SAHIN" <a class="moz-txt-link-rfc2396E" href="mailto:users-bounces@shibboleth.netonbehalfofmarc.sahin@univ-lyon2.fr"><users-bounces@shibboleth.net on behalf of marc.sahin@univ-lyon2.fr></a> wrote:
</pre>
<blockquote type="cite">
<pre wrap="">Strangely, I can list the content of Selaer.jks keystore without password
and can not list the SecretKeys with password defined in idp.properties(idp.sealer.storePassword).
</pre>
</blockquote>
<pre wrap="">
Then something tampered with the file. The IdP doesn't write to it, only the seckeygen utility or manually using keytool with it would do that.
</pre>
<blockquote type="cite">
<pre wrap="">When I restore the Sealer files, it looks for another secret key like belows :
</pre>
</blockquote>
<pre wrap="">
Then you didn't reset the version file. You have to clear the key version file next to it if you need to completely revert it, or you need to make sure the version in the file matches the end of the alias name that's in the store.
-- Scott
</pre>
</blockquote>
<br>
</body>
</html>