Grouper Users - Open Discussion List

[Todd Finney <>]

I don't know if this counts as a workaround, but adding the certificate 
information to hibernate.connection.url in grouper.hibernate.properties 
allows me to connect to the database.

hibernate.connection.url = 
jdbc:mysql://ids-mdb-t00.andrew.cmu.edu:3316/ids_generic?useSSL=true&CharSet=utf8&useUnicode=true&characterEncoding=utf8&trustServerCertificate=true&verifyServerCertificate=false&ssl-cert=/opt/grouper/dbbackups/etc/certs/client-cert-test.pem&ssl-key=/opt/grouper/dbbackups/etc/certs/client-key-test.pem

After correcting this, I was able to run gsh.sh without error.  That 
presented me with an LDAP error, related to the certificate for connecting to 
LDAP.  In the process of looking into that, I found that our working gsh.sh 
from other machines had been modified to include paths to the mysterious key 
and trust files that were in my conf directory but not referenced from 
anywhere obvious:

#       ${JAVA} -Xms$MEM_START -Xmx$MEM_MAX -Dgrouper.home="$GROUPER_HOME/" 
$GSH_JVMARGS -classpath "${GROUPER_CP}" $GSH $*
        ${JAVA} -Xms$MEM_START -Xmx$MEM_MAX 
-Djavax.net.ssl.keyStore=$GROUPER_HOME/conf/grouper.jks 
-Djavax.net.ssl.keyStorePassword=[...] 
-Djavax.net.ssl.trustStore=$GROUPER_HOME/conf/grouper.ts 
-Djavax.net.ssl.trustStorePassword=[...] -Dgrouper.home="$GROUPER_HOME/" 
$GSH_JVMARGS -classpath " ${GROUPER_CP}" $GSH $*

Good times.
Todd







-----Original Message-----
From: 

 
[mailto:]
 On Behalf Of Todd Finney
Sent: Monday, February 26, 2018 3:11 PM
To: grouper-users 
<>
Subject: RE: [grouper-users] RE: configuring grouper connection to MySQL

Thank you!

I don't see anything in the output from strace indicating that a likely file 
is being accessed.  I checked this against our working test system, and also 
did not see it accessing any likely file there.  

Thanks,
Todd


-----Original Message-----
From: Waldbieser, Carl 
[mailto:]
 
Sent: Friday, February 23, 2018 3:02 PM
To: Todd Finney 
<>
Cc: Carey M. Black 
<>;
 grouper-users 
<>
Subject: Re: [grouper-users] RE: configuring grouper connection to MySQL

Todd,

You might try running gsh with `strace`.
If you do something like:

  [root]# strace -e trace=file /path/to/gsh 2>&1 | grep -e cacerts

That might give you a good idea of what files that the process is looking for 
with names like "cacerts", and whether it successfully was able to read the 
file or not.

Thanks,
Carl Waldbieser
ITS Identity Management
Lafayette College

----- Original Message -----
From: "Todd Finney" 
<>
To: "Carey M. Black" 
<>,
 "grouper-users" 
<>
Sent: Friday, February 23, 2018 1:55:44 PM
Subject: [grouper-users] RE: configuring grouper connection to MySQL

(Replying back to the list, in case this discussion is useful to future 
searchers.)

The machine in question is a new RHEL7.4 box.  

JAVA_HOME is set to /usr/java/default/, which is a symlink to jdk8.  I have 
no idea how to confirm whether or not it's pointing to /etc/pki/java/cacerts. 
 To be honest, I have no idea where that certificate is actually *supposed* 
to go, and have tried stuffing it into all kinds of places for the past 
couple of weeks.

Thanks,
Todd






-----Original Message-----
From: Black, Carey M. 
[mailto:]
 
Sent: Friday, February 23, 2018 9:47 AM
To: Todd Finney 
<>
Subject: RE: configuring grouper connection to MySQL

Todd,

Not sure if any of these is a "clue brick"... but some WAGs...

Which JDBC implementation are you using?
        What comes with the Grouper package?
        An upgraded Mysql driver?



https://stackoverflow.com/questions/6784463/error-trustanchors-parameter-must-be-non-empty
        " This bizarre message means that the truststore you specified was 
not found, or couldn't be opened due to access permissions for example. "

Maybe you have java home set wrong for the user running gsh?

So...
        Does (please confirm):
                "Using JAVA: /usr/java/default/bin/java"
                        Point at
                "-destkeystore /etc/pki/java/cacerts "  
                ?


The only other thing that catches my eye... is the " 
jdbc:mysql://ids-mdb-t00.andrew.cmu.edu:3316/ids_generic?useSSL=true&CharSet=utf8&useUnicode=true&characterEncoding=utf8"
 looks funny to my eye. 
        Did you really name the DB "ids_generic" ?
        If it helps here are the parameters that I am setting with my mysql 
config: 
                "autoReconnect=true&
                CharSet=utf8&
                useUnicode=true&
                characterEncoding=utf8&
                sessionVariables=wait_timeout=1209600"



HTH.

-- 
Carey Matthew 



-----Original Message-----
From: 

 
[mailto:]
 On Behalf Of Todd Finney
Sent: Thursday, February 22, 2018 3:42 PM
To: 

Subject: [grouper-users] configuring grouper connection to MySQL

I'm attempting a sandbox installation of 2.3.0, and I'm having a heck of a 
time getting grouper to connect to our database.   The database is server 
version 5.7.20-log.

What I've done:

1. grouper.hibernate.properties contains a hibernate.connection.url, 
hibernate.connection.username, and hibernate.connection.password that have 
all been confirmed to work from the command line mysql client on the machine 
upon which I'm working.

2. As our database requires a certificate for connection, I have converted 
our certificate/key pair into a pkcs12 file using the following command:
      
      #  openssl pkcs12 -export -in 
/opt/grouper/dbbackups/etc/certs/client-cert-test.pem -inkey 
/opt/grouper/dbbackups/etc/certs/client-key-test.pem -out 
/opt/grouper/dbbackups/etc/certs/client-pkcs12-test.p12

    Then, I imported it into the system's keystore using the following 
command:

      # keytool -importkeystore -srckeystore 
/opt/grouper/dbbackups/etc/certs/client-pkcs12-test.p12 -destkeystore 
/etc/pki/java/cacerts -deststoretype pkcs12 -v

      These completed without error.

3. When I attempt to run the command 
/opt/grouper-2.3.0/grouper.apiBinary-2.3.0/bin/gsh.sh, I get the mess that 
I've pasted below.

I have no intelligent question, and can only request a clue brick, please.

Thanks,
Todd


# /opt/grouper-2.3.0/grouper.apiBinary-2.3.0/bin/gsh.sh
Using GROUPER_HOME: /opt/grouper-2.3.0/grouper.apiBinary-2.3.0/
Using GROUPER_CONF: /opt/grouper-2.3.0/grouper.apiBinary-2.3.0//conf
Using JAVA: /usr/java/default/bin/java
using MEMORY: 64m-750m
Grouper starting up: version: 2.3.0, build date: 2016/04/16 05:37:21, env: 
<no label configured> grouper.properties read from: 
/opt/grouper-2.3.0/grouper.apiBinary-2.3.0/conf/grouper.properties
Grouper current directory is: /opt
log4j.properties read from:   
/opt/grouper-2.3.0/grouper.apiBinary-2.3.0/conf/log4j.properties
Grouper is logging to file:   
/opt/grouper-2.3.0/grouper.apiBinary-2.3.0/logs/grouper_error.log, at min 
level WARN for package: edu.internet2.middleware.grouper, based on 
log4j.properties
grouper.hibernate.properties: 
/opt/grouper-2.3.0/grouper.apiBinary-2.3.0/conf/grouper.hibernate.properties
grouper.hibernate.properties: 
tfinney@jdbc:mysql://ids-mdb-t00.andrew.cmu.edu:3316/ids_generic?useSSL=true&CharSet=utf8&useUnicode=true&characterEncoding=utf8
sources.xml read from:        
/opt/grouper-2.3.0/grouper.apiBinary-2.3.0/conf/sources.xml
sources.xml groupersource id: g:gsa
sources.xml ldap source id:   ldap: /ldap.properties
sources.xml ldap source id:   ldapdeleted: /ldap.properties
sources.xml groupersource id: grouperEntities
sources.xml jdbc source id:   jdbc: GrouperJdbcConnectionProvider
Grouper error: Error connecting to the database with credentials from 
grouper.hibernate.properties, url: 
jdbc:mysql://ids-mdb-t00.andrew.cmu.edu:3316/ids_generic?useSSL=true&CharSet=utf8&useUnicode=true&characterEncoding=utf8,
 driver: com.mysql.jdbc.Driver, user: tfinney, 
com.mysql.jdbc.exceptions.jdbc4.CommunicationsException: Communications link 
failure

The last packet successfully received from the server was 184 milliseconds 
ago.  The last packet sent successfully to the server was 181 milliseconds 
ago.
        at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native 
Method)
        at 
sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62)
        at 
sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
        at java.lang.reflect.Constructor.newInstance(Constructor.java:423)
        at com.mysql.jdbc.Util.handleNewInstance(Util.java:404)
        at 
com.mysql.jdbc.SQLError.createCommunicationsException(SQLError.java:981)
        at 
com.mysql.jdbc.ExportControlled.transformSocketToSSLSocket(ExportControlled.java:164)
        at com.mysql.jdbc.MysqlIO.negotiateSSLConnection(MysqlIO.java:4801)
        at 
com.mysql.jdbc.MysqlIO.proceedHandshakeWithPluggableAuthentication(MysqlIO.java:1643)
        at com.mysql.jdbc.MysqlIO.doHandshake(MysqlIO.java:1215)
        at com.mysql.jdbc.ConnectionImpl.coreConnect(ConnectionImpl.java:2255)
        at 
com.mysql.jdbc.ConnectionImpl.connectOneTryOnly(ConnectionImpl.java:2286)
        at com.mysql.jdbc.ConnectionImpl.createNewIO(ConnectionImpl.java:2085)
        at com.mysql.jdbc.ConnectionImpl.<init>(ConnectionImpl.java:795)
        at com.mysql.jdbc.JDBC4Connection.<init>(JDBC4Connection.java:44)
        at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native 
Method)
        at 
sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62)
        at 
sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
        at java.lang.reflect.Constructor.newInstance(Constructor.java:423)
        at com.mysql.jdbc.Util.handleNewInstance(Util.java:404)
        at com.mysql.jdbc.ConnectionImpl.getInstance(ConnectionImpl.java:400)
        at 
com.mysql.jdbc.NonRegisteringDriver.connect(NonRegisteringDriver.java:327)
        at java.sql.DriverManager.getConnection(DriverManager.java:664)
        at java.sql.DriverManager.getConnection(DriverManager.java:247)
        at 
edu.internet2.middleware.grouper.misc.GrouperCheckConfig.checkDatabase(GrouperCheckConfig.java:807)
        at 
edu.internet2.middleware.grouper.misc.GrouperCheckConfig.checkGrouperDb(GrouperCheckConfig.java:695)
        at 
edu.internet2.middleware.grouper.misc.GrouperStartup.startup(GrouperStartup.java:246)
        at 
edu.internet2.middleware.grouper.app.gsh.GrouperShell.main(GrouperShell.java:151)
        at 
edu.internet2.middleware.grouper.app.gsh.GrouperShellWrapper.main(GrouperShellWrapper.java:31)
Caused by: javax.net.ssl.SSLException: java.lang.RuntimeException: Unexpected 
error: java.security.InvalidAlgorithmParameterException: the trustAnchors 
parameter must be non-empty
        at sun.security.ssl.Alerts.getSSLException(Alerts.java:208)
        at sun.security.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1964)
        at sun.security.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1921)
        at 
sun.security.ssl.SSLSocketImpl.handleException(SSLSocketImpl.java:1904)
        at 
sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1420)
        at 
sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1397)
        at 
com.mysql.jdbc.ExportControlled.transformSocketToSSLSocket(ExportControlled.java:149)
        ... 22 more
Caused by: java.lang.RuntimeException: Unexpected error: 
java.security.InvalidAlgorithmParameterException: the trustAnchors parameter 
must be non-empty
        at sun.security.validator.PKIXValidator.<init>(PKIXValidator.java:91)
        at sun.security.validator.Validator.getInstance(Validator.java:179)
        at 
sun.security.ssl.X509TrustManagerImpl.getValidator(X509TrustManagerImpl.java:312)
        at 
sun.security.ssl.X509TrustManagerImpl.checkTrustedInit(X509TrustManagerImpl.java:171)
        at 
sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:184)
        at 
sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:124)
        at 
sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1596)
        at 
sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:216)
        at sun.security.ssl.Handshaker.processLoop(Handshaker.java:1052)
        at sun.security.ssl.Handshaker.process_record(Handshaker.java:987)
        at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1072)
        at 
sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1385)
        at 
sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1413)
        ... 24 more
Caused by: java.security.InvalidAlgorithmParameterException: the trustAnchors 
parameter must be non-empty
        at 
java.security.cert.PKIXParameters.setTrustAnchors(PKIXParameters.java:200)
        at java.security.cert.PKIXParameters.<init>(PKIXParameters.java:120)
        at 
java.security.cert.PKIXBuilderParameters.<init>(PKIXBuilderParameters.java:104)
        at sun.security.validator.PKIXValidator.<init>(PKIXValidator.java:89)
        ... 36 more

Couldnt startup grouper: Problems with db: DB: user: tfinney, url: 
jdbc:mysql://ids-mdb-t00.andrew.cmu.edu:3316/ids_generic?useSSL=true&CharSet=utf8&useUnicode=true&characterEncoding=utf8,
 driver: com.mysql.jdbc.Driver
java.lang.RuntimeException: Problems with db: DB: user: tfinney, url: 
jdbc:mysql://ids-mdb-t00.andrew.cmu.edu:3316/ids_generic?useSSL=true&CharSet=utf8&useUnicode=true&characterEncoding=utf8,
 driver: com.mysql.jdbc.Driver
        at 
edu.internet2.middleware.grouper.app.loader.db.GrouperLoaderDb.connection(GrouperLoaderDb.java:57)
        at 
edu.internet2.middleware.grouper.ddl.GrouperDdlUtils.bootstrapHelper(GrouperDdlUtils.java:436)
        at 
edu.internet2.middleware.grouper.ddl.GrouperDdlUtils.bootstrap(GrouperDdlUtils.java:340)
        at 
edu.internet2.middleware.grouper.misc.GrouperStartup.startup(GrouperStartup.java:251)
        at 
edu.internet2.middleware.grouper.app.gsh.GrouperShell.main(GrouperShell.java:151)
        at 
edu.internet2.middleware.grouper.app.gsh.GrouperShellWrapper.main(GrouperShellWrapper.java:31)
Caused by: com.mysql.jdbc.exceptions.jdbc4.CommunicationsException: 
Communications link failure

The last packet successfully received from the server was 13 milliseconds 
ago.  The last packet sent successfully to the server was 13 milliseconds ago.
        at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native 
Method)
        at 
sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62)
        at 
sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
        at java.lang.reflect.Constructor.newInstance(Constructor.java:423)
        at com.mysql.jdbc.Util.handleNewInstance(Util.java:404)
        at 
com.mysql.jdbc.SQLError.createCommunicationsException(SQLError.java:981)
        at 
com.mysql.jdbc.ExportControlled.transformSocketToSSLSocket(ExportControlled.java:164)
        at com.mysql.jdbc.MysqlIO.negotiateSSLConnection(MysqlIO.java:4801)
        at 
com.mysql.jdbc.MysqlIO.proceedHandshakeWithPluggableAuthentication(MysqlIO.java:1643)
        at com.mysql.jdbc.MysqlIO.doHandshake(MysqlIO.java:1215)
        at com.mysql.jdbc.ConnectionImpl.coreConnect(ConnectionImpl.java:2255)
        at 
com.mysql.jdbc.ConnectionImpl.connectOneTryOnly(ConnectionImpl.java:2286)
        at com.mysql.jdbc.ConnectionImpl.createNewIO(ConnectionImpl.java:2085)
        at com.mysql.jdbc.ConnectionImpl.<init>(ConnectionImpl.java:795)
        at com.mysql.jdbc.JDBC4Connection.<init>(JDBC4Connection.java:44)
        at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native 
Method)
        at 
sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62)
        at 
sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
        at java.lang.reflect.Constructor.newInstance(Constructor.java:423)
        at com.mysql.jdbc.Util.handleNewInstance(Util.java:404)
        at com.mysql.jdbc.ConnectionImpl.getInstance(ConnectionImpl.java:400)
        at 
com.mysql.jdbc.NonRegisteringDriver.connect(NonRegisteringDriver.java:327)
        at java.sql.DriverManager.getConnection(DriverManager.java:664)
        at java.sql.DriverManager.getConnection(DriverManager.java:247)
        at 
edu.internet2.middleware.grouper.app.loader.db.GrouperLoaderDb.connection(GrouperLoaderDb.java:54)
        ... 5 more
Caused by: javax.net.ssl.SSLException: java.lang.RuntimeException: Unexpected 
error: java.security.InvalidAlgorithmParameterException: the trustAnchors 
parameter must be non-empty
        at sun.security.ssl.Alerts.getSSLException(Alerts.java:208)
        at sun.security.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1964)
        at sun.security.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1921)
        at 
sun.security.ssl.SSLSocketImpl.handleException(SSLSocketImpl.java:1904)
        at 
sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1420)
        at 
sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1397)
        at 
com.mysql.jdbc.ExportControlled.transformSocketToSSLSocket(ExportControlled.java:149)
        ... 23 more
Caused by: java.lang.RuntimeException: Unexpected error: 
java.security.InvalidAlgorithmParameterException: the trustAnchors parameter 
must be non-empty
        at sun.security.validator.PKIXValidator.<init>(PKIXValidator.java:91)
        at sun.security.validator.Validator.getInstance(Validator.java:179)
        at 
sun.security.ssl.X509TrustManagerImpl.getValidator(X509TrustManagerImpl.java:312)
        at 
sun.security.ssl.X509TrustManagerImpl.checkTrustedInit(X509TrustManagerImpl.java:171)
        at 
sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:184)
        at 
sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:124)
        at 
sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1596)
        at 
sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:216)
        at sun.security.ssl.Handshaker.processLoop(Handshaker.java:1052)
        at sun.security.ssl.Handshaker.process_record(Handshaker.java:987)
        at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1072)
        at 
sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1385)
        at 
sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1413)
        ... 25 more
Caused by: java.security.InvalidAlgorithmParameterException: the trustAnchors 
parameter must be non-empty
        at 
java.security.cert.PKIXParameters.setTrustAnchors(PKIXParameters.java:200)
        at java.security.cert.PKIXParameters.<init>(PKIXParameters.java:120)
        at 
java.security.cert.PKIXBuilderParameters.<init>(PKIXBuilderParameters.java:104)
        at sun.security.validator.PKIXValidator.<init>(PKIXValidator.java:89)
        ... 37 more
Exception in thread "main" java.lang.RuntimeException: Problems with db: DB: 
user: tfinney, url: 
jdbc:mysql://ids-mdb-t00.andrew.cmu.edu:3316/ids_generic?useSSL=true&CharSet=utf8&useUnicode=true&characterEncoding=utf8,
 driver: com.mysql.jdbc.Driver
        at 
edu.internet2.middleware.grouper.app.loader.db.GrouperLoaderDb.connection(GrouperLoaderDb.java:57)
        at 
edu.internet2.middleware.grouper.ddl.GrouperDdlUtils.bootstrapHelper(GrouperDdlUtils.java:436)
        at 
edu.internet2.middleware.grouper.ddl.GrouperDdlUtils.bootstrap(GrouperDdlUtils.java:340)
        at 
edu.internet2.middleware.grouper.misc.GrouperStartup.startup(GrouperStartup.java:251)
        at 
edu.internet2.middleware.grouper.app.gsh.GrouperShell.main(GrouperShell.java:151)
        at 
edu.internet2.middleware.grouper.app.gsh.GrouperShellWrapper.main(GrouperShellWrapper.java:31)
Caused by: com.mysql.jdbc.exceptions.jdbc4.CommunicationsException: 
Communications link failure

The last packet successfully received from the server was 13 milliseconds 
ago.  The last packet sent successfully to the server was 13 milliseconds ago.
        at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native 
Method)
        at 
sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62)
        at 
sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
        at java.lang.reflect.Constructor.newInstance(Constructor.java:423)
        at com.mysql.jdbc.Util.handleNewInstance(Util.java:404)
        at 
com.mysql.jdbc.SQLError.createCommunicationsException(SQLError.java:981)
        at 
com.mysql.jdbc.ExportControlled.transformSocketToSSLSocket(ExportControlled.java:164)
        at com.mysql.jdbc.MysqlIO.negotiateSSLConnection(MysqlIO.java:4801)
        at 
com.mysql.jdbc.MysqlIO.proceedHandshakeWithPluggableAuthentication(MysqlIO.java:1643)
        at com.mysql.jdbc.MysqlIO.doHandshake(MysqlIO.java:1215)
        at com.mysql.jdbc.ConnectionImpl.coreConnect(ConnectionImpl.java:2255)
        at 
com.mysql.jdbc.ConnectionImpl.connectOneTryOnly(ConnectionImpl.java:2286)
        at com.mysql.jdbc.ConnectionImpl.createNewIO(ConnectionImpl.java:2085)
        at com.mysql.jdbc.ConnectionImpl.<init>(ConnectionImpl.java:795)
        at com.mysql.jdbc.JDBC4Connection.<init>(JDBC4Connection.java:44)
        at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native 
Method)
        at 
sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:62)
        at 
sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
        at java.lang.reflect.Constructor.newInstance(Constructor.java:423)
        at com.mysql.jdbc.Util.handleNewInstance(Util.java:404)
        at com.mysql.jdbc.ConnectionImpl.getInstance(ConnectionImpl.java:400)
        at 
com.mysql.jdbc.NonRegisteringDriver.connect(NonRegisteringDriver.java:327)
        at java.sql.DriverManager.getConnection(DriverManager.java:664)
        at java.sql.DriverManager.getConnection(DriverManager.java:247)
        at 
edu.internet2.middleware.grouper.app.loader.db.GrouperLoaderDb.connection(GrouperLoaderDb.java:54)
        ... 5 more
Caused by: javax.net.ssl.SSLException: java.lang.RuntimeException: Unexpected 
error: java.security.InvalidAlgorithmParameterException: the trustAnchors 
parameter must be non-empty
        at sun.security.ssl.Alerts.getSSLException(Alerts.java:208)
        at sun.security.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1964)
        at sun.security.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1921)
        at 
sun.security.ssl.SSLSocketImpl.handleException(SSLSocketImpl.java:1904)
        at 
sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1420)
        at 
sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1397)
        at 
com.mysql.jdbc.ExportControlled.transformSocketToSSLSocket(ExportControlled.java:149)
        ... 23 more
Caused by: java.lang.RuntimeException: Unexpected error: 
java.security.InvalidAlgorithmParameterException: the trustAnchors parameter 
must be non-empty
        at sun.security.validator.PKIXValidator.<init>(PKIXValidator.java:91)
        at sun.security.validator.Validator.getInstance(Validator.java:179)
        at 
sun.security.ssl.X509TrustManagerImpl.getValidator(X509TrustManagerImpl.java:312)
        at 
sun.security.ssl.X509TrustManagerImpl.checkTrustedInit(X509TrustManagerImpl.java:171)
        at 
sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:184)
        at 
sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:124)
        at 
sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1596)
        at 
sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:216)
        at sun.security.ssl.Handshaker.processLoop(Handshaker.java:1052)
        at sun.security.ssl.Handshaker.process_record(Handshaker.java:987)
        at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1072)
        at 
sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1385)
        at 
sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1413)
        ... 25 more
Caused by: java.security.InvalidAlgorithmParameterException: the trustAnchors 
parameter must be non-empty
        at 
java.security.cert.PKIXParameters.setTrustAnchors(PKIXParameters.java:200)
        at java.security.cert.PKIXParameters.<init>(PKIXParameters.java:120)
        at 
java.security.cert.PKIXBuilderParameters.<init>(PKIXBuilderParameters.java:104)
        at sun.security.validator.PKIXValidator.<init>(PKIXValidator.java:89)
        ... 37 more