Fixing Java CA Certificates on openSUSE

Recently switched back to openSUSE after a brief stint with Ubuntu. I guess you need to try other things out to know how good you have it, eh?  Anyway, I'm playing with Leiningen and Quil, but for some reason or other, I could not get Leiningen to self-install, because of an exception:

java.security.KeyStoreException: problem accessing trust storejava.io.IOException: Invalid keystore format

It turns out that the java keystore is somehow corrupt on OpenJDK / openSUSE 12.3. Not sure who's at fault, but here's how to fix it.

  1. Become root:
    $ su -
    Password:
    #
  2. Verify the certificates file:
    # file $(readlink /usr/lib64/jvm/java-1.7.0-openjdk/jre/lib/security/cacerts)
    /var/lib/ca-certificates/java-cacerts: data
  3. Oops, file should identify this as a Java KeyStore. Must be corrupt. Replace it:
    # rm /var/lib/ca-certificates/java-cacerts
    # /usr/sbin/update-ca-certificates
    creating /var/lib/ca-certificates/java-cacerts ...
    144 added, 0 removed.
    creating /var/lib/ca-certificates/gcj-cacerts ...
    imporing AffirmTrust_Premium_ECC.pem failed: java.security.spec.InvalidKeySpecException
    imporing COMODO_ECC_Certification_Authority.pem failed: java.security.spec.InvalidKeySpecException
    imporing GeoTrust_Primary_Certification_Authority_G2.pem failed: java.security.spec.InvalidKeySpecException
    imporing VeriSign_Class_3_Public_Primary_Certification_Authority_G4.pem failed: java.security.spec.InvalidKeySpecException
    imporing thawte_Primary_Root_CA_G2.pem failed: java.security.spec.InvalidKeySpecException
    2 added, 0 removed.
  4. Hmm, something's up with gcj-cacerts (not just all those "imporing"s, seems the PEM files are corrupted too?)... Anyway, re-verify the java-cacerts:
    # file /var/lib/ca-certificates/java-cacerts
    /var/lib/ca-certificates/java-cacerts: Java KeyStore
  5. Good to go (sort-of?)