Customer Knowledge Base
Customer Knowledge Base
Breadcrumbs

How to Resolve JACE 9000 Certificate Import Error

(unsupported object type: PrivateKeyInfo)

Scroll Sites Knowledge Base Header.png

Applies to: Tridium Niagara Framework / JACE 9000
Category: Security / Certificate Management / Troubleshooting
Target Audience: Field Engineers, System Integrators, Technical Support
Author: Forest Rock Technical Support
Estimated Time: 10-15 minutes (excluding certificate issuance time)

1. Problem Description

When importing a signed SSL/TLS certificate into a JACE 9000 controller (for example, to establish secure TLS/MQTT connections to a client broker), Niagara fails to import the file and throws a BouncyCastle crypto exception.

2. Symptoms

An error dialog appears during the import command containing the following stack trace:

java.io.IOException: unsupported object type: org.bouncycastle.asn1.pkcs.PrivateKeyInfo
at com.tridium.platcrypto.ui.BTrustCertsTable$TrustImportCommand.doInvoke(BTrustCertsTable.java:329)
at javax.baja.ui.Command.doInvoke(Command.java:313)
at javax.baja.ui.Command.invoke(Command.java:283)

3. Root Cause Analysis

  1. Importing Private Keys into the Trust Store:
    The error unsupported object type: org.bouncycastle.asn1.pkcs.PrivateKeyInfo occurs when a file containing a Private Key (or a combined .pem/.pfx containing both key and certs) is imported into the Trust Store (BTrustCertsTable).

    • Trust Store: Only accepts public CA certificates (Root CA and Intermediate CAs). It rejects private keys.

    • Key Store: Accepts Private Keys, Device Certificates, and combined Key+Certificate bundles.

  2. In-Memory Keystore Caching & Stale State:
    Niagara holds keystore data in memory across two UI access paths (Platform > Certificate Management and Station > Services > Platform Services > Certificate Management).

NOTE: Updating or replacing certificates without a daemon/station reboot can leave cached in-memory keys out of sync with physical storage, causing subsequent import failures.

  1. Legacy Certificate Bundles (CA Dependencies):
    Older Generation 1 (G1) CA root bundles provided by certain Certificate Authorities (e.g., legacy GoDaddy G1 bundles) are no longer supported in modern Niagara builds and can cause import rejections. G2-only certificate bundles should be used instead.

4. Solution & Correct Import Procedure

Step 1: Separate Certificate Files Correctly

Ensure your client-provided certificate files are structured as follows:

  • Root CA & Intermediate CA Certs: Standalone .cer / .pem public certificate files (no private keys).

  • Key Store Bundle: Create a combined .pem file combining the private key and signed certificate chain in the following exact order:

    -----BEGIN PRIVATE KEY-----
<Device Private Key>
-----END PRIVATE KEY-----
-----BEGIN CERTIFICATE-----
<Device Certificate>
-----END CERTIFICATE-----
-----BEGIN CERTIFICATE-----
<CA / Intermediate Certificate>
-----END CERTIFICATE-----

Step 2: Import Certificates into the Correct Niagara Stores

  1. Import CA Certificates into the Trust Store:

    • Go to Platform > Certificate Management (or Station > Services > Platform Services > Certificate Management).

    • Open the User Trust Store (or System Trust Store).

    • Click Import and select the CA Root/Intermediate certificate file.

  2. Import Device Key & Cert into the Key Store:

    • Open the User Key Store.

    • Click Import and select the combined .pem file (containing Private Key + Certificate).

Step 3: Reboot / Sync Keystores

  • Reboot the Station or Daemon so Niagara re-reads the updated key stores from storage and updates its in-memory cache.

Step 4: Troubleshooting Persistent Failures

  • If a JACE continues throwing import errors due to previously corrupted or cached key state, perform a factory reset / clean state on the JACE, then re-apply the CA certificate to the User Trust Store and the combined PEM file to the Key Store.