Just starting from yesterday we faced this “invalid key or spec in GCM mode” error message in our production Lucee webservers (5 nos identical Lucee webservers) out of the blue.
We have never encountered this error before and has been unable to track down the cause; no changes/update was done to our production servers for several days prior. We run an application login page Lucee server which passes the encrypted user login credentials to main Lucee webservers.
This error message appear in the main Lucee webservers during users login stage to our application. After reboot main Lucee webservers, error disappear. But error sometimes repeat several hours later, and error occurrence has no fixed pattern (some webservers error repeat, other webservers no error repeat after reboot).
Upgrading to Lucee 5.3.9.166 does not resolve this issue. Unable yet to upgrade to 5.3.10.97 due to some unresolved compatibility.
Much appreciated if anyone is able to guide me on where to start troubleshooting on this “invalid key or spec in GCM mode” error message.
Could you please post the complete stack trace (better as text than image)? To me this looks like some SSL connection error. What is what this code block does? Some sort of SSL connection to some service?
Apologies, will post full stack trace on next time error occur (its unpredictable and intermittent). End-users did not copy the full stack trace when they reported the errors, and server reboots were done quickly on urgent basis.
The role of above block of code was to receive the encrypted end-users login credentials data from login page from a login server and query for validation. Before this block of code there is a decryption block of codes. There is no SSL service connection function here; just a direct data query to database.
Below the stack trace from Lucee application log and yes, there is SSL connection.
Our “login server” is basically a small AWS EC2 instance that display an application user login form. When user submit their application login credentials, the form posts to another EC2 instance for login credentials validation. This is 2nd Lucee server where the GCM error appear and code as was screenshot earlier above:
“ERROR”,“https-jsse-nio-8443-exec-16”,“01/31/2023”,“17:28:44”,“”,"invalid key or spec in GCM mode;lucee.runtime.exp.NativeException: invalid key or spec in GCM mode
at java.base/sun.security.ssl.SSLCipher$T13GcmWriteCipherGenerator$GcmWriteCipher.encrypt(SSLCipher.java:2049)
at java.base/sun.security.ssl.OutputRecord.t13Encrypt(OutputRecord.java:504)
at java.base/sun.security.ssl.OutputRecord.encrypt(OutputRecord.java:467)
at java.base/sun.security.ssl.SSLSocketOutputRecord.deliver(SSLSocketOutputRecord.java:341)
at java.base/sun.security.ssl.SSLSocketImpl$AppOutputStream.write(SSLSocketImpl.java:1304)
at java.base/java.io.BufferedOutputStream.flushBuffer(BufferedOutputStream.java:81)
at java.base/java.io.BufferedOutputStream.write(BufferedOutputStream.java:95)
at org.postgresql.core.PGStream.sendChar(PGStream.java:324)
at org.postgresql.core.v3.QueryExecutorImpl.sendBind(QueryExecutorImpl.java:1636)
at org.postgresql.core.v3.QueryExecutorImpl.sendOneQuery(QueryExecutorImpl.java:1910)
at org.postgresql.core.v3.QueryExecutorImpl.sendQuery(QueryExecutorImpl.java:1433)
at org.postgresql.core.v3.QueryExecutorImpl.execute(QueryExecutorImpl.java:315)
at org.postgresql.jdbc.PgStatement.executeInternal(PgStatement.java:481)
at org.postgresql.jdbc.PgStatement.execute(PgStatement.java:401)
at org.postgresql.jdbc.PgPreparedStatement.executeWithFlags(PgPreparedStatement.java:164)
at org.postgresql.jdbc.PgPreparedStatement.execute(PgPreparedStatement.java:153)
at lucee.runtime.type.util.QueryUtil.execute(QueryUtil.java:328)
at lucee.runtime.type.QueryImpl.execute(QueryImpl.java:296)
at lucee.runtime.type.QueryImpl.(QueryImpl.java:235)
at lucee.runtime.tag.Query.executeDatasoure(Query.java:1134)
at lucee.runtime.tag.Query._doEndTag(Query.java:699)
at lucee.runtime.tag.Query.doEndTag(Query.java:565)
at v50foldersetadmin.v50stringg3new.v50master.contentadmin.inc_glob3cache_settings_cfm$cf.call(/v50foldersetadmin/v50stringg3new/v50master/contentadmin/inc_glob3cache_settings.cfm:17)
at lucee.runtime.PageContextImpl._doInclude(PageContextImpl.java:1043)
at lucee.runtime.PageContextImpl._doInclude(PageContextImpl.java:935)
at lucee.runtime.PageContextImpl.doInclude(PageContextImpl.java:916)
at v50foldersetadmin.v50stringg3new.v50master.contentadmin.inc_cache_invoke_template_cfm$cf.call(/v50foldersetadmin/v50stringg3new/v50master/contentadmin/inc_cache_invoke_template.cfm:11)
at lucee.runtime.PageContextImpl._doInclude(PageContextImpl.java:1043)
at lucee.runtime.PageContextImpl._doInclude(PageContextImpl.java:935)
at lucee.runtime.PageContextImpl.doInclude(PageContextImpl.java:916)
at v50foldersetadmin.v50stringg3new.v50master.contentadmin.sym_meta_lang_a_cfm$cf.call(/v50foldersetadmin/v50stringg3new/v50master/contentadmin/sym_meta_lang_a.cfm:414)
at lucee.runtime.PageContextImpl._doInclude(PageContextImpl.java:1043)
at lucee.runtime.PageContextImpl._doInclude(PageContextImpl.java:935)
at lucee.runtime.PageContextImpl.doInclude(PageContextImpl.java:916)
at v50foldersetadmin.v50stringg3new.v50master.contentadmin.application_cfc$cf.udfCall(/v50foldersetadmin/v50stringg3new/v50master/contentadmin/application.cfc:289)
at lucee.runtime.type.UDFImpl.implementation(UDFImpl.java:112)
at lucee.runtime.type.UDFImpl._call(UDFImpl.java:350)
at lucee.runtime.type.UDFImpl.call(UDFImpl.java:223)
at lucee.runtime.ComponentImpl._call(ComponentImpl.java:697)
at lucee.runtime.ComponentImpl._call(ComponentImpl.java:585)
at lucee.runtime.ComponentImpl.call(ComponentImpl.java:1932)
at lucee.runtime.listener.ModernAppListener.call(ModernAppListener.java:444)
at lucee.runtime.listener.ModernAppListener.onError(ModernAppListener.java:432)
at lucee.runtime.listener.MixedAppListener.onError(MixedAppListener.java:138)
at lucee.runtime.PageContextImpl.execute(PageContextImpl.java:2503)
at lucee.runtime.PageContextImpl._execute(PageContextImpl.java:2465)
at lucee.runtime.PageContextImpl.executeCFML(PageContextImpl.java:2436)
at lucee.runtime.engine.Request.exe(Request.java:45)
at lucee.runtime.engine.CFMLEngineImpl._service(CFMLEngineImpl.java:1198)
at lucee.runtime.engine.CFMLEngineImpl.serviceCFML(CFMLEngineImpl.java:1144)
at lucee.loader.engine.CFMLEngineWrapper.serviceCFML(CFMLEngineWrapper.java:97)
at lucee.loader.servlet.CFMLServlet.service(CFMLServlet.java:51)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:764)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:231)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:197)
at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:97)
at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:543)
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:135)
at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:92)
at org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:698)
at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:78)
at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:367)
at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:639)
at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:65)
at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:882)
at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1647)
at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)
at org.apache.tomcat.util.threads.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1191)
at org.apache.tomcat.util.threads.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:659)
at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
at java.base/java.lang.Thread.run(Thread.java:829)
Caused by: java.lang.RuntimeException: invalid key or spec in GCM mode
… 75 more
Caused by: java.security.InvalidAlgorithmParameterException: Cannot reuse iv for GCM encryption
at java.base/com.sun.crypto.provider.CipherCore.init(CipherCore.java:582)
at java.base/com.sun.crypto.provider.AESCipher.engineInit(AESCipher.java:346)
at java.base/javax.crypto.Cipher.init(Cipher.java:1431)
at java.base/sun.security.ssl.SSLCipher$T13GcmWriteCipherGenerator$GcmWriteCipher.encrypt(SSLCipher.java:2045)
… 74 more
Not sure, but random guessing (and that is what my experience says) is that the servers you are SSL connecting to (or at least one of them) have been updated in their/its SSL configuration and the underlying Java is not capable of handling these.
