SSL certificate unknown exception while calling identity server web services from wso2 Enterprise Integrator

2
votes

I am getting

javax.net.ssl.SSLException: Received fatal alert: certificate_unknown

while calling identity server endpoint from enterprise integrator, although we have generated the SSL certificate and it is imported in the truststore.jks but still getting this error.

While testing the connection it says Successfully connected to identity server but while calling the endpoint it gives SSL exception on the console.

Message = Going to send Request to IS.,MessageCode = null,ErrorMessage = null,ErrorDetail = null,ErrorException = null {org.apache.synapse.mediators.builtin.LogMediator} TID: [-1] [] [2017-11-07 07:14:54,841] ERROR {org.apache.synapse.transport.passthru.TargetHandler} - I/O error: Received fatal alert: certificate_unknown {org.apache.synapse.transport.passthru.TargetHandler} javax.net.ssl.SSLException: Received fatal alert: certificate_unknown at sun.security.ssl.Alerts.getSSLException(Alerts.java:208)

3
sslwso2ssl-certificatewso2iswso2ei
Looks like something was wrong with cert import. This should work if you imported it properly. If you post the steps you followed, I can verify. - Bee
Hi, I extracted the .crt file from mozilla and its the default certificate of identity server but i am unable to call its admin services localhost:9444/services/… Imported it in the Enterprise Integrator using following command keytool -import -trustcacerts -alias identityserver -file /home/appliance/ggmd-is.crt -keystore /opt/wso2/dev/ei/wso2ei-6.1.1/repository/resources/security/client-truststore.jks - sehar
Are you using default keystore? Did you restart the server after adding this? - Bee
yes I am using default keystore and have restarted the server after importing it. p.s I have did same thing with wso2esb and it works there but not with wso2ei (Enterprise integrator) - sehar
That's very strange. Can you take client-truststore.jks from ESB and replace the one in EI? Then restart and try again. - Bee

3 Answers

0
votes

Try setting the truststore manually. Open wso2ei-6.1.1/bin/integrator.sh and add javax.net.ssl.trustStore like this.

    -Dorg.wso2.ignoreHostnameVerification=true \
    -Djavax.net.ssl.trustStore="$CARBON_HOME/repository/resources/security/client-truststore.jks"
    org.wso2.carbon.bootstrap.Bootstrap $*
    status=$?
done
0
votes

I hope you found the issue. I faced the same problem some days ago, so I'm writing the solution for the record. To solve this you need to import each product certificate in the truststore of the other.

  1. Go to WSO2 EI and extract the certificate from wso2carbon.jks
  2. Add the certificate to the client-truststore.jks file in the WSO2 IS
  3. Go to WSO2 IS and extract the certificate from wso2carbon.jks
  4. Add the certificate to the client-truststore.jks file in the WSO2 EI
0
votes

We faced the same problem, when WSO2 IS version was prior to v5.4.0, but instead of extracting the certificate from wso2carbon.jks as Gabriel said, we extracted the certificates from the browser, opening the carbon console on both WSO2 EI and WSO2 IS. For some reason, the localhost certificate returned in the browser is different than the one stored in the wso2carbon.jks for WSO2 EI (tested on version 6.1.0 and 6.1.1). One reason could be that it's returning the localhost certificate from the JVM's keystore. That's why it's better to get it from the browser.

  1. Open in browser https://localhost:9443/carbon of WOS2 IS. (Firefox: Click on locker in the address bar -> Connection -> details -> More Information -> Security tab -> view Certificate -> Details tab -> Export... -> save as X.509 Certificate (PEM); Chrome: click on Not Secure warning in address bar -> Certificate -> Details tab -> Copy to File ... -> Next -> Select the format -> Base-64 encoded X.509 (.CER) -> Next ...)
  2. Import the certificate into {WSO2_IS_HOME}/repository/resources/security/client-truststore.jks. Eventually use KeyStore Explorer tool for easier way.
  3. Open in browser https://localhost:9444/carbon of WOS2 IS (we have offset 1 for WSO2 IS) and do the same as at point 1.
  4. Import the certificate into {WSO2_EI_HOME}/repository/resources/security/client-truststore.jks.