代码之家  ›  专栏  ›  技术社区  ›  Yuriy Bondaruk

用于出站连接的SSL配置在websphere liberty 17.0.0.2中不起作用

  •  2
  • Yuriy Bondaruk  · 技术社区  · 9 年前


    下面是我的server.xml

    <?xml version="1.0" encoding="UTF-8"?>
    <server description="Default server">
        <featureManager>
            <feature>appSecurity-2.0</feature>
            <feature>transportSecurity-1.0</feature>
            <feature>jaxrs-2.0</feature>
            <feature>json-1.0</feature>
            <feature>javaMail-1.5</feature>
            <!--<feature>ssl-1.0</feature>-->
        </featureManager>
    
        <sslDefault sslRef="saasSSLConfig" outboundSSLRef="outboundSSLConfig" />
    
        <ssl id="saasSSLConfig" keyStoreRef="saasKeyStore" trustStoreRef="saasTrustStore" clientAuthentication="true" sslProtocol="TLSv1" />
        <keyStore id="saasKeyStore" location="/opt/ibm/wlp/output/defaultServer/resources/security/sbs_endpoint_keystore.jks" password="pwd" />
        <keyStore id="saasTrustStore" location="/opt/ibm/wlp/output/defaultServer/resources/security/serverTruststore.jks" password="pwd" />
    
        <ssl id="outboundSSLConfig" keyStoreRef="defaultKeyStore" trustStoreRef="defaultTrustStore" />
    
        <basicRegistry id="basic" realm="BasicRealm">
            <!-- <user name="yourUserName" password="" />  -->
        </basicRegistry>
    
        <httpEndpoint id="defaultHttpEndpoint" host="*" httpPort="9080" httpsPort="9443" />
        <applicationManager autoExpand="true"/>
    </server>
    

    服务器版本:

    WebSphere Application Server 17.0.0.2 (1.0.17.cl170220170523-1818) on IBM J9 VM, version pxa6480sr4fp7-20170627_02 (SR4 FP7) (en_US)
    

    错误:

    [ERROR] CWPKI0022E: SSL HANDSHAKE FAILURE:  A signer with SubjectDN CN=*.api.ibm.com, O=International Business Machines, L=Armonk, ST=New York, C=US was sent from the target host.  The signer might need to be added to local trust store /opt/ibm/wlp/output/defaultServer/resources/security/serverTruststore.jks, located in SSL configuration alias saasSSLConfig.  The extended error message from the SSL handshake exception is: PKIX path building failed: java.security.cert.CertPathBuilderException: PKIXCertPathBuilderImpl could not build a valid CertPath.;
    SSLHandshakeException invoking https://dev.api.ibm.com/scx/test/sbs/customer/222222222: java.security.cert.CertificateException: PKIXCertPathBuilderImpl could not build a valid CertPath.
    
    2 回复  |  直到 7 年前
        1
  •  1
  •   Alaine    9 年前

    <ssl id="outboundSSLConfig" keyStoreRef="cacertKeyStore" />
    <keyStore id="cacertKeyStore" location=<fill in path to your jdk cacerts file> password="changeit" />
    

    我假设这个配置不需要密钥,所以我将其简化为outboundSSLConfig上的keyStoreRef。它将使用keyStoreRef指向的内容来表示密钥和信任。

        2
  •  0
  •   Alaine    9 年前

    在您的配置中,我没有看到defaultKeyStore和defaultTrustStore的keyStore元素。如果缺少,则会导致outboundSSLConfig成为无效的SSL配置。你能把它们加起来,看看效果如何吗。