Installing Partner's Key+Certificate (PFX) in weblogic for outbound https connection

0
votes

We had a requirement to Integration with external partner from SOA over HTTPS. For this partner had provided us their Key Pair (in form of pfx file). When we imported the pfx file in SOAP UI and tried to connect with partner URL, it works absolutely fine.

But when we are importing the partner's key and certificate in weblogic (we are using identity and trust jks), we get below error:

Error:

summary=oracle.fabric.common.FabricInvocationException: Unable to invoke endpoint URI "https://www7.aeat.es/wlpl/SSII-FACT/ws/fe/SiiFactFEV1SOAP" successfully due to: javax.xml.soap.SOAPException: javax.xml.soap.SOAPException: Message send failed: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target ,detail=Unable to invoke endpoint URI "https://www7.aeat.es/wlpl/SSII-FACT/ws/fe/SiiFactFEV1SOAP" successfully due to: javax.xml.soap.SOAPException: javax.xml.soap.SOAPException: Message send failed: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

,code=null}

We've followed below steps to import partner's key and certificate in weblogic:

Steps followed to import partner key and certificate:

  1. Partner has provided us pfx file which contains private key and certificate.

    1. Export key from PFX provided by Partner:

    openssl pkcs12 -in LuisEmail.pfx -nocerts -out LuisEmail.key –nodes

    1. Export certificate from PFX provided by LUIS: openssl pkcs12 -in LuisEmail.pfx -nokeys -out LuisEmail.cer –nodes
    2. Copy LuisEmail.cer to windows and create root.cer and inter.cer by manually exporting.
    3. Create chain by combining all 3 certs in order: intermediate-root-server and save it as .pem file.
    4. Bring the pem file to linux machine.
    5. Set environment to execute java util.importPrivateKey utility . /apps/oracle/product/fmw/wlserver_10.3/server/bin/setWLSEnv.sh
    6. Convert private key file into rsa private key file: openssl rsa -in LuisEmail.key -out LuisEmail_RSA.key
    7. Import pem/key in identity store: java utils.ImportPrivateKey -keystore netappidentity_STA.jks -storepass -storetype JKS -keypass -alias staPrivateKey -certfile LuisEmailChain.pem -keyfile LuisEmail_RSA.key -keyfilepass
    8. Import Root CER file in trust store: keytool -import -v -noprompt -trustcacerts -alias starootcert -file LuisEmailRoot.cer -keystore netapptrust_STA.jks -storepass
    9. Restarted Servers

Any pointer on what we are missing here would appreciated! Please not that when we examine the pfx file using keytool explorer, we see only private key and server(domain) certificate. There are no intermediate and root certs.

Also anyone know why Partner's would give us Key Pair and if it will be a 1-way ssl or 2-way ssl. We were under impression that only public certificates are exchanged for ssl communication.

Thanks.

1
sslweblogicsoapfxjks

1 Answers

0
votes

We were able to figure out the issue here. Since our partner was a government tax agency (I suppose they did not want to trust our CA), they provided us a key pair (having private key). We were supposed to use it as our own key.

We imported the private key in our identity store and certificate exported from their URL in trust store and connectivity worked fine.

Thanks