A certificate that Websphere does not trust

Question

I have a web application that calls an SSL protected SOAP web service. (https://zzzzzzzzzzzz/xxxxx ).

The server sends two certificates (Root and Leaf), so I import two certificates using the property: com.ibm.websphere.ssl.retrieveLeafCert .

To enable ssl checking in websphere, I just add certificates to websphere:

SSL certificate and key management → key stores and certificate → NodeDefaultTrustStore → Subscriber certificates → Extract from port:

• host: hostname
• port: 443
• nickname: nickname

The problem is that webshphere does not trust the certificate and gives me this stack,

 used by: javax.net.ssl.SSLHandshakeException: SSLHandshakeException invoking `https://------------------------------` : com.ibm.jsse2.util.j: PKIX path building failed: java.security.cert.CertPathBuilderException: PKIXCertPathBuilderImpl could not build a valid CertPath.; internal cause is: java.security.cert.CertPathValidatorException: T`he certificate issued by CN=-------------------------------------------------------------------- is not trusted`; internal cause is: java.security.cert.CertPathValidatorException: Certificate chaining error at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method) ~[na:1.6.0] at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:56) ~[na:1.6.0] at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:39) ~[na:1.6.0] at java.lang.reflect.Constructor.newInstance(Constructor.java:527) ~[na:1.6.0] at org.apache.cxf.transport.http.HTTPConduit$WrappedOutputStream.mapException(HTTPConduit.java:1338) ~[cxf-rt-transports-http-2.7.4.jar:2.7.4] at org.apache.cxf.transport.http.HTTPConduit$WrappedOutputStream.close(HTTPConduit.java:1322) ~[cxf-rt-transports-http-2.7.4.jar:2.7.4] at org.apache.cxf.transport.AbstractConduit.close(AbstractConduit.java:56) ~[cxf-api-2.7.4.jar:2.7.4] at org.apache.cxf.transport.http.HTTPConduit.close(HTTPConduit.java:622) ~[cxf-rt-transports-http-2.7.4.jar:2.7.4] at org.apache.cxf.interceptor.MessageSenderInterceptor$MessageSenderEndingInterceptor.handleMessage(MessageSenderInterceptor.java:62) ~[cxf-api-2.7.4.jar:2.7.4] at org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(PhaseInterceptorChain.java:271) ~[cxf-api-2.7.4.jar:2.7.4] at org.apache.cxf.endpoint.ClientImpl.doInvoke(ClientImpl.java:530) ~[cxf-api-2.7.4.jar:2.7.4] at org.apache.cxf.endpoint.ClientImpl.invoke(ClientImpl.java:463) ~[cxf-api-2.7.4.jar:2.7.4] at org.apache.cxf.endpoint.ClientImpl.invoke(ClientImpl.java:366) ~[cxf-api-2.7.4.jar:2.7.4] at org.apache.cxf.endpoint.ClientImpl.invoke(ClientImpl.java:319) ~[cxf-api-2.7.4.jar:2.7.4] at org.apache.cxf.endpoint.ClientImpl.invokeWrapped(ClientImpl.java:354) ~[cxf-api-2.7.4.jar:2.7.4] at org.apache.cxf.jaxws.DispatchImpl.invoke(DispatchImpl.java:385) ~[cxf-rt-frontend-jaxws-2.7.4.jar:2.7.4] ... 100 common frames omitted `Caused by: javax.net.ssl.SSLHandshakeException`: com.ibm.jsse2.util.j: PKIX path building failed: java.security.cert.CertPathBuilderException: PKIXCertPathBuilderImpl could not build a valid CertPath.; internal cause is: java.security.cert.CertPathValidatorException: `The certificate issued by CN=--------------------------------------------------------- is not trusted`; internal cause is: java.security.cert.CertPathValidatorException: Certificate chaining error at com.ibm.jsse2.oa(o.java:8) ~[na:6.0 build_20130515] at com.ibm.jsse2.SSLSocketImpl.a(SSLSocketImpl.java:549) ~[na:6.0 build_20130515] at com.ibm.jsse2.kb.a(kb.java:355) ~[na:6.0 build_20130515] at com.ibm.jsse2.kb.a(kb.java:130) ~[na:6.0 build_20130515] at com.ibm.jsse2.lb.a(lb.java:135) ~[na:6.0 build_20130515] at com.ibm.jsse2.lb.a(lb.java:368) ~[na:6.0 build_20130515] at com.ibm.jsse2.kb.s(kb.java:442) ~[na:6.0 build_20130515] at com.ibm.jsse2.kb.a(kb.java:136) ~[na:6.0 build_20130515] at com.ibm.jsse2.SSLSocketImpl.a(SSLSocketImpl.java:495) ~[na:6.0 build_20130515] at com.ibm.jsse2.SSLSocketImpl.h(SSLSocketImpl.java:223) ~[na:6.0 build_20130515] at com.ibm.jsse2.SSLSocketImpl.a(SSLSocketImpl.java:724) ~[na:6.0 build_20130515] at com.ibm.jsse2.SSLSocketImpl.startHandshake(SSLSocketImpl.java:81) ~[na:6.0 build_20130515] at com.ibm.net.ssl.www2.protocol.https.c.afterConnect(c.java:8) ~[na:6.0 build_20130515] at com.ibm.net.ssl.www2.protocol.https.d.connect(d.java:20) ~[na:6.0 build_20130515] at sun.net.www.protocol.http.HttpURLConnection.getOutputStream(HttpURLConnection.java:1043) ~[na:1.6.0] at com.ibm.net.ssl.www2.protocol.https.b.getOutputStream(b.java:85) ~[na:6.0 build_20130515] at org.apache.cxf.transport.http.URLConnectionHTTPConduit$URLConnectionWrappedOutputStream.setupWrappedStream(URLConnectionHTTPConduit.java:168) ~[cxf-rt-transports-http-2.7.4.jar:2.7.4] at org.apache.cxf.transport.http.HTTPConduit$WrappedOutputStream.handleHeadersTrustCaching(HTTPConduit.java:1282) ~[cxf-rt-transports-http-2.7.4.jar:2.7.4] at org.apache.cxf.transport.http.HTTPConduit$WrappedOutputStream.onFirstWrite(HTTPConduit.java:1233) ~[cxf-rt-transports-http-2.7.4.jar:2.7.4] at org.apache.cxf.transport.http.URLConnectionHTTPConduit$URLConnectionWrappedOutputStream.onFirstWrite(URLConnectionHTTPConduit.java:195) ~[cxf-rt-transports-http-2.7.4.jar:2.7.4] at org.apache.cxf.io.AbstractWrappedOutputStream.write(AbstractWrappedOutputStream.java:47) ~[cxf-api-2.7.4.jar:2.7.4] at org.apache.cxf.io.AbstractThresholdOutputStream.write(AbstractThresholdOutputStream.java:69) ~[cxf-api-2.7.4.jar:2.7.4] at org.apache.cxf.transport.http.HTTPConduit$WrappedOutputStream.close(HTTPConduit.java:1295) ~[cxf-rt-transports-http-2.7.4.jar:2.7.4] ... 110 common frames omitted `Caused by: com.ibm.jsse2.util.j: PKIX path building failed:` java.security.cert.CertPathBuilderException: PKIXCertPathBuilderImpl could not build a valid CertPath.; internal cause is: java.security.cert.CertPathValidatorException: T`he certificate issued by CN=-------------------------------------------- is not trusted`; internal cause is: java.security.cert.CertPathValidatorException: Certificate chaining error at com.ibm.jsse2.util.hb(h.java:39) ~[na:6.0 build_20130515] at com.ibm.jsse2.util.hb(h.java:21) ~[na:6.0 build_20130515] at com.ibm.jsse2.util.ga(g.java:1) ~[na:6.0 build_20130515] at com.ibm.jsse2.pc.a(pc.java:36) ~[na:6.0 build_20130515] at com.ibm.jsse2.pc.checkServerTrusted(pc.java:19) ~[na:6.0 build_20130515] at com.ibm.jsse2.pc.b(pc.java:51) ~[na:6.0 build_20130515] at com.ibm.jsse2.lb.a(lb.java:65) ~[na:6.0 build_20130515] ... 128 common frames omitted Caused by: java.security.cert.CertPathBuilderException: PKIXCertPathBuilderImpl could not build a valid CertPath. at com.ibm.security.cert.PKIXCertPathBuilderImpl.engineBuild(PKIXCertPathBuilderImpl.java:411) ~[na:na] at java.security.cert.CertPathBuilder.build(CertPathBuilder.java:258) ~[na:na] at com.ibm.jsse2.util.hb(h.java:107) ~[na:6.0 build_20130515] ... 134 common frames omitted Caused by: java.security.cert.CertPathValidatorException: The certificate issued by CN=------------------------------------------------------- at com.ibm.security.cert.BasicChecker.<init>(BasicChecker.java:111) ~[na:na] at com.ibm.security.cert.PKIXCertPathValidatorImpl.engineValidate(PKIXCertPathValidatorImpl.java:178) ~[na:na] at com.ibm.security.cert.PKIXCertPathBuilderImpl.myValidator(PKIXCertPathBuilderImpl.java:737) ~[na:na] at com.ibm.security.cert.PKIXCertPathBuilderImpl.buildCertPath(PKIXCertPathBuilderImpl.java:649) ~[na:na] at com.ibm.security.cert.PKIXCertPathBuilderImpl.buildCertPath(PKIXCertPathBuilderImpl.java:595) ~[na:na] at com.ibm.security.cert.PKIXCertPathBuilderImpl.engineBuild(PKIXCertPathBuilderImpl.java:357) ~[na:na] ... 136 common frames omitted Caused by: java.security.cert.CertPathValidatorException: Certificate chaining error at com.ibm.security.cert.CertPathUtil.findIssuer(CertPathUtil.java:298) ~[na:na] at com.ibm.security.cert.BasicChecker.<init>(BasicChecker.java:108) ~[na:na] ... 141 common frames omitted 

The same code is checked in my local environement with a simple use of Installcert.java and runs my tests with -Djavax.net.ssl.trustStore = jssecacerts (jssecacerts is the file created by InstallCert.java).

Answer 1

I am testing the millionth configuration of websphere.

The only procedure that works is the procedure described in this link:

http://blog.xebia.com/2012/10/01/mutual-ssl-authentication-using-websphere-application-server-and-cxf/

By defining cxf intercpter:

 <cxf:bus> <cxf:outInterceptors> <bean class="---------------------.WebsphereSslOutInterceptor" /> </cxf:outInterceptors> </cxf:bus> 

See below for more details:

https://github.com/vlussenburg/websphere-cxf-extensions#websphere-cxf-extensions

Thanks so much for helping the guys.

Answer 2

Thanks for all of the above. Possibility of solving the java.security.cert.CertPathValidatorException problem: certificate chain error with the following configuration.

• The following javax properties have been found to return null in WebSphere.
  • javax.net.ssl.trustStore,
  • javax.net.ssl.trustStorePassword
  • javax.net.ssl.trustStoreType

For more information see this link,

java path to trustStore - set property not working?

2. Configured properties as shown below in WebSphere

   Select Servers> Application Servers> server_name> Process Definition> Java Virtual Machine> User Properties> Create.

a) javax.net.ssl.trustStore = jre_install_dir \ lib \ security \ cacerts

Example: C: \ Program Files \ WebSphere \ AppServer \ java \ jre \ lib \ security \ cacerts

b) javax.net.ssl.trustStorePassword = changeit (default)

c) javax.net.ssl.trustStoreType = jks

For more information see this link,

http://publib.boulder.ibm.com/infocenter/tivihelp/v2r1/index.jsp?topic=%2Fcom.ibm.isim.doc_6.0%2Finstalling%2Ftsk%2Ftsk_ic_ins_first_security_truststore.htm

After the configuration was able to see in the logs that certificates are added to the trust store.

Thanks Uday Nilajkar

Answer 3

You must add the entire certificate chain to your configuration. Typically, a certificate has at least the root certificate of the Authorization Center or combines similar certificates.

WAS requires a signed certificate by default.

Answer 4

The problem is that the certificate path builder (part of the Java Certification path API) cannot create a certificate chain during SSL connection establishment. During the handshake, the peer SSL node sends a certificate (identity card) to the client so that the client can trust this particular certificate, the trust chain must be built on the client side, which happens when you get an error. The problem is that the trust chain cannot be created because you lack the signer certificate and / or the root certificate in your trusted store (power of attorney).

Please note that PKIX Trust Manager performs a “scope of trust” check, which means that you do not need a complete chain of certificates on the client side to fulfill a trust relationship with an SSL partner, you only need signers / intermediate certificates in your trusted store. In fact, if you have to put the sheet certificate in a trusted store, this should also make everything work, as it means that you have explicit trust in this particular certificate, and you do not need to check the certificate chain.

Answer 5

Maybe you should take a look at the next technote .

If you are at a certain level of the fix pack, you can set the value of com.ibm.websphere.ssl.retrieveLeafCert to true and get the certificate sheet when retrieving from Port.

Answer 6

The following are the steps to import a certificate in the JVM to invoke HTTPS WS:

A) Obtain a certificate for import

• Each browser displays certificates differently, but they are usually very similar. The browser URL bar usually has a zone that you can click to display the SSL certificate information. For example, you can see the lock in the status bar, and clicking on the lock opens the certificate information. After the certificate information is open, click "Certificate Information". Typically, each of the signed certificates (trusted roots) will be exported. Export certificates in "Base-64 encoded X.509 (.CER)" format. The exported file in this format will be an ASCII text file that has the lines "BEGIN CERTIFICATE" and "END CERTIFICATE" at the top and bottom. After you export the certificates that have signed the SSL certificate of the remote server, you can import them into the JVM.

B) Import certificate

• Run the ikeyman utility. The utility (ikeyman.bat or ikeyman.sh) is located in WAS_HOME \ bin.
• From the Key Database File menu, select Open.
• In the key database type, select JKS.
• In the File Name box, type cacerts.
• In the Location field, enter WAS_HOME \ java \ jre \ lib \ security.
• In the "Password Request" window, enter the password for the keystore in the "Password" and "Password Confirm" windows. The default password is changeit. Click OK.
• Add the certificate that you created for the LDAP server to this certificate store.
• In the main window, in the key database content area, select "Signature Witnesses" from the list. Click Add.
• In the Certificate file name field, search for and locate the server certificate file that was created for the LDAP server, which is located in the Der binary data. Verify that the appropriate directory appears in the Location field. Click OK.
• At the command prompt, enter a shortcut for this certificate. For example, enter LDAPCA. Click OK.