Broker SSL Setup issue

,
1

We’ve been following the 8-0-SP1_Administering_Broker.pdf guide to setup SSL.

We’ve managed to configure SSL for the Broker server without any issues so far.

Our next step according to the guide is to configure SSL for the Broker User Interface Component. This is where we are getting errors.

So for this we need to convert our PEM truststore to a JKS. We assumed this since the UI only allow us to provide a JKS truststore. The documentation says absoultely nothing about this, some where way up in the beginning it did mention that Brokern Admin component requires a JKS truststore (but we’re configuring Broker User Interface Component, is it the same?).

So we did so using openssl and the keystore tool. Here’s the output of the -list command that shows that the jks trust store is valid:


Keystore type: JKS
Keystore provider: SUN

Your keystore contains 1 entry

mykey, Jan 5, 2010, trustedCertEntry,
Certificate fingerprint (MD5): <deleted>

However in the “Change Identity Setting” screen in My webMethods, after we’ve filled in all the fields and click on the “Connect” button we get the following stack trace:


2010-01-05 09:52:27 EST (jsf:INFO)  [RID:1384] - Error: Cannot save the identity setting. Error: Failed to set the clien
t identity. Internal error.: com.webmethods.messaging.tools.api.core.MessagingToolException: Error: Failed to set the cl
ient identity. Internal error.
        at com.webmethods.messaging.tools.api.broker.pref.IdentityPreference.setIdentity(IdentityPreference.java:455)
        at com.webmethods.caf.msg.msgsettingchangeidentity.MsgSettingChangeIdentityDefaultviewView.connectAction(MsgSett
ingChangeIdentityDefaultviewView.java:297)
        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
        at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
        at java.lang.reflect.Method.invoke(Method.java:597)
        at com.sun.el.parser.AstValue.invoke(AstValue.java:187)
        at com.sun.el.MethodExpressionImpl.invoke(MethodExpressionImpl.java:297)
        at com.sun.faces.application.MethodBindingMethodExpressionAdapter.invoke(MethodBindingMethodExpressionAdapter.ja
va:88)
        at com.webmethods.caf.faces.application.CAFMethodBinding.invoke(CAFMethodBinding.java:67)
        at com.sun.faces.application.ActionListenerImpl.processAction(ActionListenerImpl.java:102)
        at javax.faces.component.UICommand.broadcast(UICommand.java:387)
        at com.webmethods.caf.faces.component.ViewRoot.broadcastEvents(ViewRoot.java:202)
        at com.webmethods.caf.faces.component.ViewRoot.processApplication(ViewRoot.java:116)
        at com.webmethods.caf.faces.portlet.PortletLifecycle$InvokeApplicationPhase.execute(PortletLifecycle.java:678)
        at com.webmethods.caf.faces.portlet.PortletLifecycle.phase(PortletLifecycle.java:250)
        at com.webmethods.caf.faces.portlet.PortletLifecycle.execute(PortletLifecycle.java:145)
        at com.webmethods.caf.faces.portlet.FacesPortlet.processAction(FacesPortlet.java:245)
        at com.webmethods.portal.framework.portletcontainer.impl.PortletApplicationHandler.process(PortletApplicationHan
dler.java:479)
        at com.webmethods.portal.framework.portletcontainer.servlet.PortletServlet.service(PortletServlet.java:58)
        at javax.servlet.http.HttpServlet.service(HttpServlet.java:820)
        at org.mortbay.jetty.servlet.ServletHolder.handle(ServletHolder.java:487)
        at org.mortbay.jetty.servlet.ServletHandler.handle(ServletHandler.java:362)
        at org.mortbay.jetty.security.SecurityHandler.handle(SecurityHandler.java:216)
        at org.mortbay.jetty.servlet.SessionHandler.handle(SessionHandler.java:181)
        at org.mortbay.jetty.handler.ContextHandler.handle(ContextHandler.java:726)
        at org.mortbay.jetty.webapp.WebAppContext.handle(WebAppContext.java:405)
        at org.mortbay.jetty.servlet.Dispatcher.forward(Dispatcher.java:285)
        at org.mortbay.jetty.servlet.Dispatcher.forward(Dispatcher.java:126)
        at com.webmethods.portal.framework.portletcontainer.PortletContainer.dispatch(PortletContainer.java:218)
        at com.webmethods.portal.framework.portletcontainer.PortletContainer.process(PortletContainer.java:129)
        at com.webmethods.portal.framework.portletcontainer.PortletContainer.processPortletAction(PortletContainer.java:
107)
        at com.webmethods.portal.framework.portlet.beans.rest.RestfulPCAHandler.handle(RestfulPCAHandler.java:194)
        at com.webmethods.portal.framework.dispatch.DispatchManager.handle(DispatchManager.java:442)
        at com.webmethods.portal.framework.dispatch.DispatchManager.handleDispatch(DispatchManager.java:372)
        at com.webmethods.portal.framework.impl.PortalServlet.service(PortalServlet.java:245)
        at javax.servlet.http.HttpServlet.service(HttpServlet.java:820)
        at org.mortbay.jetty.servlet.ServletHolder.handle(ServletHolder.java:487)
        at org.mortbay.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1093)
        at com.webmethods.portal.framework.impl.NTLMFilter.doFilter(NTLMFilter.java:50)
        at org.mortbay.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1084)
        at com.webmethods.caf.faces.servlet.GZIPFilter.doFilter(GZIPFilter.java:42)
        at org.mortbay.jetty.servlet.ServletHandler$CachedChain.doFilter(ServletHandler.java:1084)
        at org.mortbay.jetty.servlet.ServletHandler.handle(ServletHandler.java:360)
        at org.mortbay.jetty.security.SecurityHandler.handle(SecurityHandler.java:216)
        at org.mortbay.jetty.servlet.SessionHandler.handle(SessionHandler.java:181)
        at org.mortbay.jetty.handler.ContextHandler.handle(ContextHandler.java:726)
        at org.mortbay.jetty.webapp.WebAppContext.handle(WebAppContext.java:405)
        at org.mortbay.jetty.handler.ContextHandlerCollection.handle(ContextHandlerCollection.java:206)
        at org.mortbay.jetty.handler.HandlerCollection.handle(HandlerCollection.java:114)
        at org.mortbay.jetty.handler.HandlerWrapper.handle(HandlerWrapper.java:139)
        at org.mortbay.jetty.Server.handle(Server.java:324)
        at org.mortbay.jetty.HttpConnection.handleRequest(HttpConnection.java:505)
        at org.mortbay.jetty.HttpConnection$RequestHandler.content(HttpConnection.java:842)
        at org.mortbay.jetty.HttpParser.parseNext(HttpParser.java:648)
        at org.mortbay.jetty.HttpParser.parseAvailable(HttpParser.java:211)
        at org.mortbay.jetty.HttpConnection.handle(HttpConnection.java:380)
        at org.mortbay.io.nio.SelectChannelEndPoint.run(SelectChannelEndPoint.java:395)
        at org.mortbay.thread.BoundedThreadPool$PoolThread.run(BoundedThreadPool.java:450)
Security Error (114-9999): Internal error.

        at COM.activesw.api.client.BrokerConnection.createSSLContext(BrokerConnection.java:261)
        at COM.activesw.api.client.BrokerConnection.testSSLContext(BrokerConnection.java:706)
..

Any help? (truncated the stacktrace to fit message length limit)

2

Well, we figured it out. First off, the broker library has some poor exception handling. The stacktrace is showing a generic error and swallowing up the real issue (bad, bad enterprise programming practice!)

The problem stems from the fact that we used a self signed cert, i.e. our cert request was signed using the same key. Apparently this is not supported! This should really be documented.

So what we did was, since we do not wish to pay an actual CA to sign this cert, considering that we are using this in an internal network, we used openssl to setup our own private CA and signed the broker cert using this private CA’s key and cert.

Here’s a good tutorial on how to create your own CA and sign certs:
[url]http://www.freebsdmadeeasy.com/tutorials/web-server/apache-ssl-certs.php[/url]

After that just convert the keystore to pkcs12 and the truststore to der and jks. Remember to add both the CA cert and broker cert into the truststore.

Hope this helps others out there. Well on to using this setup on the client side…

1 Like