TLS1.2 Protocol enable for IBM WebSphere with SSL Handshake Debug

 

TLS1.2 enable for IBM WebSphere with SSL Handshake Debug

>> Add below arguments on JVM java_options on NodeAgent, servers, Dmgr JVM's

-Dhttps.protocols=TLSv1.2

-Dcom.ibm.ssl.protocol=TLSv1.2

-Dcom.ibm.jsse2.overrideDefaultTLS=true

-Djdk.tls.client.protocols=TLSv1.2

-Djdk.tls.server.protocols=TLSv1.2

-Djavax.net.debug=ssl,handshake,data,trustmanager

JVM arguments, To ADD cacerts as Truststore & SSL debug

>> Add below arguments on JVM java_options on NodeAgent, servers, Dmgr JVM's

-Djavax.net.ssl.trustStore=$JAVA_HOME/java/8.0/jre/lib/security/cacerts 

-Djavax.net.ssl.trustStorePassword=changeit 

-Djavax.net.ssl.trustStoreType=jks 

-Dhttps.protocols=TLSv1.2

-Dcom.ibm.ssl.protocol=TLSv1.2

-Dcom.ibm.jsse2.overrideDefaultTLS=true

-Djdk.tls.client.protocols=TLSv1.2

-Djdk.tls.server.protocols=TLSv1.2

-Djavax.net.debug=ssl,handshake,data,trustmanager

IMPORT Certificate on cacerts file:

Command:

$JAVA_HOME/bin/keytool -import -trustcacerts -file certificate.cer -alias www.certificate.com -keystore $JAVA_HOME/java/8.0/jre/lib/security/cacerts

For LDAP SSL Handshake identificatation issue  "CWWIM4520E The 'javax.naming.CommunicationException: myldap.ibm.com:636"

>> Add below arguments on JVM java_options on NodeAgent, servers, Dmgr JVM's

-Dcom.sun.jndi.ldap.object.disableEndpointIdentification=true

Thanks :-)

sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

We are getting below exception “sun.security.provider.certpath.SunCertPathBuilderException” error on JBoss instance.

Error log:

*********************************************************************************
sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:387)
at sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:292)
at sun.security.validator.Validator.validate(Validator.java:260)
at sun.security.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:324)
at sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:229)
at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:124)
at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1351)
at sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:156)
at sun.security.ssl.Handshaker.processLoop(Handshaker.java:925)
at sun.security.ssl.Handshaker.process_record(Handshaker.java:860)
at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1043)
at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1343)
at sun.security.ssl.SSLSocketImpl.writeRecord(SSLSocketImpl.java:728)

Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
at sun.security.provider.certpath.SunCertPathBuilder.build(SunCertPathBuilder.java:145)
at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:131)
at java.security.cert.CertPathBuilder.build(CertPathBuilder.java:280)
at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:382)
*********************************************************************************

OBSERVATION:

While java makes a connection to another application services over HTTPS connections, to make this connection successful another party certificate should be imported to the installed JAVA keystore ( $JAVA_HOME/jre/lib/security/cacerts ) file which is known as truststore.

OR 

We can create a keystore and import the trusted certificates and provide its location to standalone.conf.bat or standalone .conf file.

SOLUTION:

Method 1: Import the signed or trust store certificate to JDK   ( $JAVA_HOME/jre/lib/security/cacerts ) file.

Command:
keytool   -import  -trustcacerts   -alias "alias_name"  -file   certificate.cer   -keystore cacerts

OR

keytool   -import    -alias  server      -file  server.cer    -keystore  cacerts

METHOD 2:  Create a new keystore and import certificates and provide the location to application server standalone.conf.bat  OR standalone.conf file.  and provide the password of keystore file.


Step 1: command to create new trsutstore (.jks) file.

Command :  
keytool   -import  -trustcacerts   -alias "alias_name"  -file   certificate.cer   -keystore truststorecert.jks

OR


keytool   -import    -alias  server      -file  server.cer    -keystore  truststorecert.jks


Step 2: Make configuration changes on JBoss (standalone.conf.bat).


set "JAVA_OPTS=%JAVA_OPTS%  -Djavax.net.ssl.trustStore=D:/path/truststorecert.jks                      -Djavax.net.ssl.trustStoreType=jks    -Djavax.net.ssl.trustStorePassword=123password"

Step 3: Restart the application server to reflect the changes.


Thanks :-)