Error when using encrypted passwords with broker configurations

[Manasha11]

Description

When using the following configurations for enabling this:

[broker.transport.amqp.ssl_connection.keystore]
location = "repository/resources/security/wso2carbon.jks"
password = "wso2carbon"
cert_type = "SunX509"

[broker.transport.amqp.ssl_connection.truststore]
location = "repository/resources/security/client-truststore.jks"
password = "wso2carbon"
cert_type = "SunX509"

After encrypting the trust_store_password and key_store_password values, we observed the below error after restarting the servers:

ERROR - MinaNetworkHandler Exception caught by Mina but without protocol engine to handle it
java.io.IOException: Keystore was tampered with, or password was incorrect
	at sun.security.provider.JavaKeyStore.engineLoad(JavaKeyStore.java:795) ~[?:?]
	at sun.security.util.KeyStoreDelegator.engineLoad(KeyStoreDelegator.java:222) ~[?:?]
	at java.security.KeyStore.load(KeyStore.java:1479) ~[?:?]
	at org.wso2.andes.transport.network.security.ssl.SSLUtil.getInitializedKeyStore(SSLUtil.java:178) ~[andes_3.3.24.4.jar:?]
	at org.wso2.andes.ssl.SSLContextFactory.buildServerContext(SSLContextFactory.java:165) ~[andes_3.3.24.4.jar:?]
	at org.wso2.andes.transport.network.mina.MinaNetworkHandler.sessionCreated(MinaNetworkHandler.java:111) ~[andes_3.3.24.4.jar:?]
	at org.wso2.org.apache.mina.common.support.AbstractIoFilterChain$TailFilter.sessionCreated(AbstractIoFilterChain.java:527) ~[andes_3.3.24.4.jar:?]
	at org.wso2.org.apache.mina.common.support.AbstractIoFilterChain.callNextSessionCreated(AbstractIoFilterChain.java:233) ~[andes_3.3.24.4.jar:?]
	at org.wso2.org.apache.mina.common.support.AbstractIoFilterChain.access$600(AbstractIoFilterChain.java:51) ~[andes_3.3.24.4.jar:?]
	at org.wso2.org.apache.mina.common.support.AbstractIoFilterChain$EntryImpl$1.sessionCreated(AbstractIoFilterChain.java:621) ~[andes_3.3.24.4.jar:?]
	at org.wso2.org.apache.mina.filter.executor.ExecutorFilter.sessionCreated(ExecutorFilter.java:186) ~[andes_3.3.24.4.jar:?]
	at org.wso2.org.apache.mina.common.support.AbstractIoFilterChain.callNextSessionCreated(AbstractIoFilterChain.java:233) ~[andes_3.3.24.4.jar:?]
	at org.wso2.org.apache.mina.common.support.AbstractIoFilterChain.access$600(AbstractIoFilterChain.java:51) ~[andes_3.3.24.4.jar:?]
	at org.wso2.org.apache.mina.common.support.AbstractIoFilterChain$EntryImpl$1.sessionCreated(AbstractIoFilterChain.java:621) ~[andes_3.3.24.4.jar:?]
	at org.wso2.org.apache.mina.common.support.AbstractIoFilterChain$HeadFilter.sessionCreated(AbstractIoFilterChain.java:474) ~[andes_3.3.24.4.jar:?]
	at org.wso2.org.apache.mina.common.support.AbstractIoFilterChain.callNextSessionCreated(AbstractIoFilterChain.java:233) ~[andes_3.3.24.4.jar:?]
	at org.wso2.org.apache.mina.common.support.AbstractIoFilterChain.fireSessionCreated(AbstractIoFilterChain.java:228) ~[andes_3.3.24.4.jar:?]
	at org.wso2.org.apache.mina.common.support.IoServiceListenerSupport.fireSessionCreated(IoServiceListenerSupport.java:187) ~[andes_3.3.24.4.jar:?]
	at org.wso2.org.apache.mina.transport.socket.nio.SocketIoProcessor.doAddNew(SocketIoProcessor.java:152) ~[andes_3.3.24.4.jar:?]
	at org.wso2.org.apache.mina.transport.socket.nio.SocketIoProcessor.access$200(SocketIoProcessor.java:45) ~[andes_3.3.24.4.jar:?]
	at org.wso2.org.apache.mina.transport.socket.nio.SocketIoProcessor$Worker.run(SocketIoProcessor.java:481) ~[andes_3.3.24.4.jar:?]
	at org.wso2.org.apache.mina.util.NamePreservingRunnable.run(NamePreservingRunnable.java:51) ~[andes_3.3.24.4.jar:?]
	at java.lang.Thread.run(Thread.java:829) [?:?]
Caused by: java.security.UnrecoverableKeyException: Password verification failed
	at sun.security.provider.JavaKeyStore.engineLoad(JavaKeyStore.java:793) ~[?:?]
	... 22 more

Steps to Reproduce

• Create an APIM distributed setup.
• Add below configurations to enable TLS over TCP.
• Encrypt the keystore and truststore passwords using cipher tool.
• Reference the encrypted values as follows in the CP broker configurations:

[broker.transport.amqp.ssl_connection.keystore]
location = "repository/resources/security/wso2carbon.jks"
password = "$secret{keystore_password}"
cert_type = "SunX509"

[broker.transport.amqp.ssl_connection.truststore]
location = "repository/resources/security/client-truststore.jks"
password = "$secret{truststore_password}"
cert_type = "SunX509"

• Restart the server

Affected Component

APIM

Version

4.2.0

Environment Details (with versions)

No response

Relevant Log Output

No response

Related Issues

No response

Suggested Labels

No response