OWS somehow creates an empty trusted.clientcerts

[AlBundy33]

I assume this happens due to parallel executions of some jnlps and/or javaws -Xclearcache
Unfortunately I have no idea when this happens but the result is

root@qc_1:/home/scp_devel/.config/icedtea-web/security# ls -lh
insgesamt 4,0K
-rw-r--r-- 1 scp_devel users 1,7K  2. Dez 08:32 trusted.certs
-rw------- 1 scp_devel users    0  2. Dez 04:15 trusted.clientcerts

After deleteing the empty file all works as expected.

Maybe someone has an idea when this happens or could at least handle an empty trusted.clientcerts like a non-existing trusted.clientcerts and create a new one.

[janakmulani]

I will have a look.

[andrej-w]

Get sporadically the same error but with trusted.cacerts. Probably on users who launch a JNLP with OWS for first time. I think it's also related to nearly parallel execution of JNLP.
The log looks also weird in some parts (I replaced the username)
[ITW-CORE][2026-02-02 15:45:22.887 MEZ][DEBUG][net.sourceforge.jnlp.runtime.JNLPRuntime] Started Security Thread
[ITW-CORE][2026-02-02 15:45:22.887 MEZ][DEBUG][net.adoptopenjdk.icedteaweb.client.parts.dialogs.security.Sec[ITW-CORE][2026-02-02 15:45:23.098 MEZ][DEBUG][**net.sourcefor[ITW-CORE][**2026-02-02 15:45:23.098 MEZ][DEBUG][net.sourceforge.jnlp.security.KeyStores] Keystore file C:\Users\USERNAME.config\icedtea-web\security\trusted.clientcerts does not exists.
[ITW-CORE][2026-02-02 15:45:23.113 MEZ][DEBUG][net.sourceforge.jnlp.security.KeystorePasswordAttempter] unlockKeyStore: For file Unknown, found successful pass = false
[ITW-CORE][2026-02-02 15:45:23.128 MEZ][DEBUG][net.sourceforge.jnlp.security.KeyStores] Trying to create keystore file C:\Users[ITW-CORE][2026-02-02 15:45:23.143 MEZ][DEBUG][**net.sourcefor[ITW-**CORE][2026-02-02 15:45:23.128 MEZ][ERROR][net.sourceforge.jnlp.security.KeyStores]
failed to get keystore USER CLIENT_CERTS -> C:\Users\USERNAME.config\icedtea-web\security\trusted.clientcerts
java.io.IOException: Cannot create file {} C:\Users\USERNAME.config\icedtea-web\security\trusted.clientcerts.temp
at net.sourceforge.jnlp.util.Re[ITW-CORE][2026-02-02 15:45:23.143 MEZ][DEBUG][net.sourceforge.jnlp.security.KeyStores] Saved to keystore file C:\Users\USERNAME.config\icedtea-web\security\trusted.clientcerts

[andrej-w]

I use this powershell script to reproduce

while ($true) {
    Stop-Process -Name 'Java*' -Force
    Start-Sleep -Seconds 5
    Remove-Item $env:HOMEPATH\Logs\OpenWebStart\* -ErrorAction 'SilentlyContinue'
    Remove-Item $env:USERPROFILE\.cache -Recurse -ErrorAction 'SilentlyContinue'
    Remove-Item $env:USERPROFILE\.config -Recurse -ErrorAction 'SilentlyContinue'
    & C:\temp\test1.jnlp
    & C:\temp\test2.jnlp
    Start-Sleep -Seconds 10
    $FalseLog = Get-ChildItem H:\Logs\OpenWeb* -File
    if (($Null -ne $FalseLog) -and (Test-Path -Path $FalseLog)) {
        Write-Error -Message ('Found false log in {0}' -f $Log.FullName) -ErrorAction 'Stop'
    }
    $Logs = Get-ChildItem H:\Logs\OpenWebStart\*stage1.log -File
    foreach ($Log in $Logs) {
        $Content = Get-Content $Log | Select-String 'error'
        if ($null -ne $Content) {
            Write-Error -Message ('Found error in {0}' -f $Log.FullName) -ErrorAction 'Stop'
        }
    }
}

[janakmulani]

When OWS is run for the first time it creates C:\Users\USERNAME.config\icedtea-web and C:\Users\USERNAME.cache\icedtea-web directories and files under them. So, when OWS has never been executed before on a machine and two Jnlps are started simultaneously with OWS, race conditions can occur when the two OWS processes would simultaneously try to create/access common files in the above mentioned directories and also try to download and cache the JVM specified in those Jnlp. I tried the above mentioned script and could reproduce the error mentioned by @AlBundy33. Need to see if we can prevent the race condition at all the places. Btw, The password for the truststore is the default "changeit"

[andrej-w]

I try to get around it with pre copying .cache and .config for all users with default data

[janakmulani]

However the powershell script looks like a stress test for OWS. Can you please explain the need to start jnlps simultaneously?

[andrej-w]

The normal usecase is having users autolaunch jnlp from browser after login in specific web application. After login, 2 JNLP Files are downloaded and autopen using the browser function. So OWS gets triggered. We have a terminalserver environment with roaming profiles. The profiles are dynamic and can be deleted. If 5000 Users launch OWS for the first time. It's probable that some will fail.

[AlBundy33]

Imo there is no direct need to start one jnlp multiple times but it happens. :-)

E.g. if users klick 1000x on the jnlp or open it manualy even if autostarted.

Endusers are really creative. :-)