Bouncycastle cannot load when I redeploy application

Question

I follow this instruction to add bouncycastle: http://www.bouncycastle.org/wiki/display/JA1/Provider+Installation but I have still one problem. Sometimes when I redeploy my application this provider isnt found so then my application throw exception. This problem occurs just one per 100 redeploy (maybe less). When I restart my server - weblogic then it start working again. I will be very grateful for any advice why this problem occurs

EDIT:

I am using both method in link above because when I use just one of them then it doesnt work I add to java.security this provder and then in my class I registered this provder:

static {
    Security.addProvider(new BouncyCastleProvider());
}

Answer 1

You probably got a NoClassDefFoundError. This is a known issue with JSSE implementations.

Here is the scenario:

• Your container loads bouncy castle classes in an application specific ClassLoader
• The provider instance you create depends on that classes and so on that ClassLoader
• Then the provider is registered into JRE API thanks to static fields in top level JVM ClassLoader
• When redeploying, the container discards the application ClassLoader to create a new one
• As the algorithm is already known, the second provider insertion fails silently
• When using the algorithm the provider instance is simply unusable because the ClassLoader has been discarded
• Then the only option is to restart the container to get the situation fixed.

As there is no standard listener for the undeploy event, it is not possible to trigger the JSSE provider removal at time.

The recommended way to avoid that trouble is to have bouncy castle classes in your JVM ClassPath or in your container ClassPath. You have to remove it from your application. Now you need to register BC provider with an alternate option to the static initializer. WebLogic provides ways to trigger code at server startup (I have used server startup class), this code will be responsible to register JSSE providers for the whole server/JVM lifetime.

An alternate option is to add the following line in JRE java.security file with bouncy castle jar in jre/lib/ext but I do not like that way because it may be lost when updating: security.provider.7=org.bouncycastle.jce.provider.BouncyCastleProvider

So then the application simply expects implementations are there, it may be a good idea to add tests for algorithm availability to report any troubles to operators and users.