User login

SSL & TrustStore

Submitted by alexandre_garino on April 7, 2008 - 07:25. Forums :

Hi all,

I created a proxy service with ESB 1.6 from a web service available through https only.

If I consume the web service through the proxy the ESB outputs this exception:

2008-04-07 17:59:57,078 [10.130.30.202-xxxx] [I/O dispatcher 3] ERROR ClientHandler HTTP connection [xxx.xxx.xxx.xx/x.x.x.x:443]: General SSLEngine problem
javax.net.ssl.SSLHandshakeException: General SSLEngine problem
 at com.sun.net.ssl.internal.ssl.Handshaker.checkThrown(Unknown Source)
 at com.sun.net.ssl.internal.ssl.SSLEngineImpl.checkTaskThrown(Unknown Source)
 at com.sun.net.ssl.internal.ssl.SSLEngineImpl.writeAppRecord(Unknown Source)
 at com.sun.net.ssl.internal.ssl.SSLEngineImpl.wrap(Unknown Source)
 at javax.net.ssl.SSLEngine.wrap(Unknown Source)
 at org.apache.http.impl.nio.reactor.SSLIOSession.doHandshake(SSLIOSession.java:143)
 at org.apache.http.impl.nio.reactor.SSLIOSession.isAppInputReady(SSLIOSession.java:249)
 at org.apache.synapse.transport.nhttp.SSLClientIOEventDispatch.inputReady(SSLClientIOEventDispatch.java:116)
 at org.apache.http.impl.nio.reactor.BaseIOReactor.readable(BaseIOReactor.java:98)
 at org.apache.http.impl.nio.reactor.AbstractIOReactor.processEvent(AbstractIOReactor.java:195)
 at org.apache.http.impl.nio.reactor.AbstractIOReactor.processEvents(AbstractIOReactor.java:180)
 at org.apache.http.impl.nio.reactor.AbstractIOReactor.execute(AbstractIOReactor.java:142)
 at org.apache.http.impl.nio.reactor.BaseIOReactor.execute(BaseIOReactor.java:70)
 at org.apache.http.impl.nio.reactor.AbstractMultiworkerIOReactor$Worker.run(AbstractMultiworkerIOReactor.java:318)
 at java.lang.Thread.run(Unknown Source)
Caused by: javax.net.ssl.SSLHandshakeException: General SSLEngine problem
 at com.sun.net.ssl.internal.ssl.Alerts.getSSLException(Unknown Source)
 at com.sun.net.ssl.internal.ssl.SSLEngineImpl.fatal(Unknown Source)
 at com.sun.net.ssl.internal.ssl.Handshaker.fatalSE(Unknown Source)
 at com.sun.net.ssl.internal.ssl.Handshaker.fatalSE(Unknown Source)
 at com.sun.net.ssl.internal.ssl.ClientHandshaker.serverCertificate(Unknown Source)
 at com.sun.net.ssl.internal.ssl.ClientHandshaker.processMessage(Unknown Source)
 at com.sun.net.ssl.internal.ssl.Handshaker.processLoop(Unknown Source)
 at com.sun.net.ssl.internal.ssl.Handshaker$1.run(Unknown Source)
 at java.security.AccessController.doPrivileged(Native Method)
 at com.sun.net.ssl.internal.ssl.Handshaker$DelegatedTask.run(Unknown Source)
 at org.apache.http.impl.nio.reactor.SSLIOSession.doHandshake(SSLIOSession.java:166)
 ... 9 more
Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
 at sun.security.validator.PKIXValidator.doBuild(Unknown Source)
 at sun.security.validator.PKIXValidator.engineValidate(Unknown Source)
 at sun.security.validator.Validator.validate(Unknown Source)
 at com.sun.net.ssl.internal.ssl.X509TrustManagerImpl.checkServerTrusted(Unknown Source)
 at com.sun.net.ssl.internal.ssl.JsseX509TrustManager.checkServerTrusted(Unknown Source)
 ... 16 more
Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
 at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(Unknown Source)
 at java.security.cert.CertPathBuilder.build(Unknown Source)
 ... 21 more
2008-04-07 17:59:57,093 [10.130.30.202-xxxx] [I/O dispatcher 3] ERROR ClientHandler I/O error : General SSLEngine problem
javax.net.ssl.SSLHandshakeException: General SSLEngine problem
 at com.sun.net.ssl.internal.ssl.Handshaker.checkThrown(Unknown Source)
 at com.sun.net.ssl.internal.ssl.SSLEngineImpl.checkTaskThrown(Unknown Source)
 at com.sun.net.ssl.internal.ssl.SSLEngineImpl.writeAppRecord(Unknown Source)
 at com.sun.net.ssl.internal.ssl.SSLEngineImpl.wrap(Unknown Source)
 at javax.net.ssl.SSLEngine.wrap(Unknown Source)
 at org.apache.http.impl.nio.reactor.SSLIOSession.doHandshake(SSLIOSession.java:143)
 at org.apache.http.impl.nio.reactor.SSLIOSession.isAppInputReady(SSLIOSession.java:249)
 at org.apache.synapse.transport.nhttp.SSLClientIOEventDispatch.inputReady(SSLClientIOEventDispatch.java:116)
 at org.apache.http.impl.nio.reactor.BaseIOReactor.readable(BaseIOReactor.java:98)
 at org.apache.http.impl.nio.reactor.AbstractIOReactor.processEvent(AbstractIOReactor.java:195)
 at org.apache.http.impl.nio.reactor.AbstractIOReactor.processEvents(AbstractIOReactor.java:180)
 at org.apache.http.impl.nio.reactor.AbstractIOReactor.execute(AbstractIOReactor.java:142)
 at org.apache.http.impl.nio.reactor.BaseIOReactor.execute(BaseIOReactor.java:70)
 at org.apache.http.impl.nio.reactor.AbstractMultiworkerIOReactor$Worker.run(AbstractMultiworkerIOReactor.java:318)
 at java.lang.Thread.run(Unknown Source)
Caused by: javax.net.ssl.SSLHandshakeException: General SSLEngine problem
 at com.sun.net.ssl.internal.ssl.Alerts.getSSLException(Unknown Source)
 at com.sun.net.ssl.internal.ssl.SSLEngineImpl.fatal(Unknown Source)
 at com.sun.net.ssl.internal.ssl.Handshaker.fatalSE(Unknown Source)
 at com.sun.net.ssl.internal.ssl.Handshaker.fatalSE(Unknown Source)
 at com.sun.net.ssl.internal.ssl.ClientHandshaker.serverCertificate(Unknown Source)
 at com.sun.net.ssl.internal.ssl.ClientHandshaker.processMessage(Unknown Source)
 at com.sun.net.ssl.internal.ssl.Handshaker.processLoop(Unknown Source)
 at com.sun.net.ssl.internal.ssl.Handshaker$1.run(Unknown Source)
 at java.security.AccessController.doPrivileged(Native Method)
 at com.sun.net.ssl.internal.ssl.Handshaker$DelegatedTask.run(Unknown Source)
 at org.apache.http.impl.nio.reactor.SSLIOSession.doHandshake(SSLIOSession.java:166)
 ... 9 more
Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
 at sun.security.validator.PKIXValidator.doBuild(Unknown Source)
 at sun.security.validator.PKIXValidator.engineValidate(Unknown Source)
 at sun.security.validator.Validator.validate(Unknown Source)
 at com.sun.net.ssl.internal.ssl.X509TrustManagerImpl.checkServerTrusted(Unknown Source)
 at com.sun.net.ssl.internal.ssl.JsseX509TrustManager.checkServerTrusted(Unknown Source)
 ... 16 more
Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
 at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(Unknown Source)
 at java.security.cert.CertPathBuilder.build(Unknown Source)
 ... 21 more

I guess this exception occurs because the certification path can't be built.

All certifcates have been imported in the default cacert of both public and private jre. I implemented a simple client with HttpComponent 3.1 to be sure that there are no similiar messages if I retrieve the wsdl through https.

Maybe the cause of this issue is the same to this one: http://wso2.org/forum/thread/3377

Any help would be greatly appreciated,

Regards,
Alexandre

Bookmark/Search this post with:
  • Delicious
  • Digg
  • Reddit
  • Newsvine
  • Facebook
  • Google
  • Yahoo
  • Technorati
‹ WSDL Generation General SSL engine problem ›

Comment viewing options

Select your preferred way to display the comments and click "Save settings" to activate your changes.

According to this thread

Submitted by alexandre_garino on April 7, 2008 - 23:13.

According to this thread http://www.nabble.com/HTTPS-connection-td15613822.html I've replaced the truststore trust.jks located in webapp\WEB-INF\classes\conf by the cacert.

I've updated consequently axis2.xml and server.xml files changing the password of the truststore from password into changeit.

Now when I start the ESB I get those exceptions:2008-04-08 10:06:29,125 [10.130.30.202-xxxx] [WrapperSimpleAppMain] ERROR HttpCoreNIOSSLSender Error opening Key store : trust.jks
java.io.IOException: Keystore was tampered with, or password was incorrect
 at sun.security.provider.JavaKeyStore.engineLoad(Unknown Source)
 at java.security.KeyStore.load(Unknown Source)
 at org.apache.synapse.transport.nhttp.HttpCoreNIOSSLSender.getSSLContext(HttpCoreNIOSSLSender.java:107)
 at org.apache.synapse.transport.nhttp.HttpCoreNIOSender.init(HttpCoreNIOSender.java:95)
 at org.apache.axis2.context.ConfigurationContextFactory.initTransportSenders(ConfigurationContextFactory.java:270)
 at org.apache.axis2.context.ConfigurationContextFactory.init(ConfigurationContextFactory.java:201)
 at org.apache.axis2.context.ConfigurationContextFactory.createConfigurationContext(ConfigurationContextFactory.java:76)
 at org.apache.axis2.context.ConfigurationContextFactory.createConfigurationContextFromFileSystem(ConfigurationContextFactory.java:180)
 at org.apache.synapse.ServerManager.start(ServerManager.java:86)
 at org.wso2.esb.ServiceBusManager.startListeners(ServiceBusManager.java:147)
 at org.wso2.esb.transport.tomcat.StartUpServlet.init(StartUpServlet.java:81)
 at org.apache.catalina.core.StandardWrapper.loadServlet(StandardWrapper.java:1105)
 at org.apache.catalina.core.StandardWrapper.load(StandardWrapper.java:932)
 at org.apache.catalina.core.StandardContext.loadOnStartup(StandardContext.java:3915)
 at org.apache.catalina.core.StandardContext.start(StandardContext.java:4176)
 at org.apache.catalina.core.ContainerBase.start(ContainerBase.java:1012)
 at org.apache.catalina.core.StandardHost.start(StandardHost.java:718)
 at org.apache.catalina.core.ContainerBase.start(ContainerBase.java:1012)
 at org.apache.catalina.core.StandardEngine.start(StandardEngine.java:442)
 at org.apache.catalina.startup.Embedded.start(Embedded.java:821)
 at org.wso2.esb.transport.tomcat.TomcatServer.start(TomcatServer.java:120)
 at org.wso2.esb.ServiceBusManager.start(ServiceBusManager.java:118)
 at org.wso2.esb.ServiceBus.start(ServiceBus.java:135)
 at org.wso2.esb.ServiceBus.main(ServiceBus.java:69)
 at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
 at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
 at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
 at java.lang.reflect.Method.invoke(Unknown Source)
 at org.tanukisoftware.wrapper.WrapperSimpleApp.run(WrapperSimpleApp.java:240)
 at java.lang.Thread.run(Unknown Source)
2008-04-08 10:06:29,343 [10.130.30.202-xxxx] [WrapperSimpleAppMain] ERROR HttpCoreNIOSSLListener Error opening Key store : trust.jks
java.io.IOException: Keystore was tampered with, or password was incorrect
 at sun.security.provider.JavaKeyStore.engineLoad(Unknown Source)
 at java.security.KeyStore.load(Unknown Source)
 at org.apache.synapse.transport.nhttp.HttpCoreNIOSSLListener.getSSLContext(HttpCoreNIOSSLListener.java:127)
 at org.apache.synapse.transport.nhttp.HttpCoreNIOListener.init(HttpCoreNIOListener.java:189)
 at org.apache.axis2.engine.ListenerManager.addListener(ListenerManager.java:204)
 at org.apache.synapse.ServerManager.start(ServerManager.java:103)
 at org.wso2.esb.ServiceBusManager.startListeners(ServiceBusManager.java:147)
 at org.wso2.esb.transport.tomcat.StartUpServlet.init(StartUpServlet.java:81)
 at org.apache.catalina.core.StandardWrapper.loadServlet(StandardWrapper.java:1105)
 at org.apache.catalina.core.StandardWrapper.load(StandardWrapper.java:932)
 at org.apache.catalina.core.StandardContext.loadOnStartup(StandardContext.java:3915)
 at org.apache.catalina.core.StandardContext.start(StandardContext.java:4176)
 at org.apache.catalina.core.ContainerBase.start(ContainerBase.java:1012)
 at org.apache.catalina.core.StandardHost.start(StandardHost.java:718)
 at org.apache.catalina.core.ContainerBase.start(ContainerBase.java:1012)
 at org.apache.catalina.core.StandardEngine.start(StandardEngine.java:442)
 at org.apache.catalina.startup.Embedded.start(Embedded.java:821)
 at org.wso2.esb.transport.tomcat.TomcatServer.start(TomcatServer.java:120)
 at org.wso2.esb.ServiceBusManager.start(ServiceBusManager.java:118)
 at org.wso2.esb.ServiceBus.start(ServiceBus.java:135)
 at org.wso2.esb.ServiceBus.main(ServiceBus.java:69)
 at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
 at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source)
 at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source)
 at java.lang.reflect.Method.invoke(Unknown Source)
 at org.tanukisoftware.wrapper.WrapperSimpleApp.run(WrapperSimpleApp.java:240)
 at java.lang.Thread.run(Unknown Source)

Any suggestions?

Regards,
Alexandre

»

Alexandre The root cause of

Submitted by asankha on April 7, 2008 - 23:53.

Alexandre

The root cause of this issue is that we have mistakenly bundled a copy of the trust.jks and identity.jks into the "wso2-esb-core-1.6.jar" JAR file located under webapp/WEB-INF/lib

Can you please open this JAR using a Zip tool and remove these two files. Then when you setup your trust.jks (and identity.jks) file located at ./webapp/WEB-INF/classes/conf/trust.jks properly, you should be able to proceed without any problems

asankha

»

Asankha, I removed those

Submitted by alexandre_garino on April 8, 2008 - 23:13.

Asankha,

I removed those files from the specified JAR and now SSL engine works like a charm.

Regards,
Alexandre

»

I'd like to mention that I

Submitted by alexandre_garino on April 9, 2008 - 01:09.

I'd like to mention that I built the distribution package from the rev 15635 and those files are still there.

Regards,
Alexandre

»

Alexandre We will fix this

Submitted by asankha on April 11, 2008 - 06:15.

Alexandre

We will fix this ASAP (https://wso2.org/jira/browse/ESBJAVA-450)

asankha

»

Comment viewing options

Select your preferred way to display the comments and click "Save settings" to activate your changes.