SSL, custom identity keystore, ArrayStoreException - Weblogic
This is a discussion on SSL, custom identity keystore, ArrayStoreException - Weblogic ; hi,
i use Weblogic 8.1 SP4, SUN JDK 1.4.2_05 (which comes with the Weblogic ins=
tallaion) on Windows XP SP2 (x86). i configured SSL via the console to use =
a custom identity key store.
this is the server element ...
-
SSL, custom identity keystore, ArrayStoreException
hi,
i use Weblogic 8.1 SP4, SUN JDK 1.4.2_05 (which comes with the Weblogic ins=
tallaion) on Windows XP SP2 (x86). i configured SSL via the console to use =
a custom identity key store.
this is the server element from the config.xml:
<Server COMEnabled=3D"true" ConsoleInputEnabled=3D"false"
CustomIdentityKeyStoreFileName=3D"C:\bea\weblogic81\server\lib\Demo=
IdentityPkcs11KeyStore.p11"
CustomIdentityKeyStorePassPhraseEncrypted=3D"{3DES}YxTgMAXByeE=3D"
CustomIdentityKeyStoreType=3D"PKCS11KeyStore"
CustomTrustKeyStoreFileName=3D"C:\bea\weblogic81\server\lib\DemoTru=
st.jks"
CustomTrustKeyStorePassPhraseEncrypted=3D"{3DES}2crOaiJFjTCPF+2RXDh=
9dEDRgsTrQrVwYaoLKpATcnQ=3D"
CustomTrustKeyStoreType=3D"JKS" DomainLogFilter=3D""
ExpectedToRun=3D"false" IgnoreSessionsDuringShutdown=3D"true"
JavaCompiler=3D"javac" KeyStores=3D"CustomIdentityAndCustomTrust"
ListenAddress=3D"" ListenPort=3D"7001" Name=3D"examplesServer"
ServerVersion=3D"8.1.4.0" SocketReaderTimeoutMaxMillis=3D"10" Stdou=
tDebugEnabled=3D"true">
<SSL Enabled=3D"true" IdentityAndTrustLocations=3D"KeyStores"
ListenPort=3D"7002" Name=3D"examplesServer"
ServerPrivateKeyAlias=3D"CN=3Dtestcomputer1,OU=3DInsitute for A=
pplied Information Processing and Communications,O=3DGRAZ UNIVERSITY OF TEC=
HNOLOGY,C=3DAT" ServerPrivateKeyPassPhraseEncrypted=3D"{3DES}YxTgMAXByeE=3D=
"/>
</Server>
as you can see, i use a different key store type. it is a PKCS#11 key store=
which can integrate any crypto hardware which supports PKCS#11. i installe=
d the PKCS#11 JCE provider in the java.security file of the JRE. the lines =
in this file look like this now:
security.provider.1=3Dsun.security.provider.Sun
security.provider.2=3Diaik.pkcs.pkcs11.provider.IAIKPkcs11
security.provider.3=3Dcom.sun.net.ssl.internal.ssl.Provider
security.provider.4=3Dcom.sun.rsajca.Provider
security.provider.5=3Dcom.sun.crypto.provider.SunJCE
security.provider.6=3Dsun.security.jgss.SunProvider
security.provider.7=3Diaik.security.provider.IAIK
moreover, i places all necessary files in the jre/lib/ext directory. the se=
rver seems to load the key store successfully. however, the SSL implementat=
ion inside the Weblogic server (Certicom as i can see) causes an java.lang.=
ArrayStoreException which seems to prevent SSL from working. it also causes=
a java.lang.IllegalStateException before, because it naively assumes that =
it can encode all private keys (which cannot work for hardware protected pr=
ivate keys); at least it seems to recover from this IllegalStateException.
the actual problem seems to happen when the SSL/TLS implementation tries to=
add the certificate chain to the SSL context. it looks as if this context =
class only accepts certificates of a special class. the certificate chain o=
f my key store is of type iaik.x509.X509Certificate[], where iaik.x509.X509=
Certificate is the certificate implementation of one of the installed provi=
ders and extends java.security.cert.X509Certificate. is there any known res=
triction for the certificate chain?
here is the log output with debug.ssl enabled:
C:\bea\weblogic81\samples\domains\examples>echo off
<12.07.2005 14:43 Uhr CEST> <Info> <WebLogicServer> <BEA-000377> <Starting =
WebLo
gic Server with Java HotSpot(TM) Client VM Version 1.4.2_05-b04 from Sun Mi=
crosy
stems Inc.>
<12.07.2005 14:44 Uhr CEST> <Debug> <TLS> <000000> <Enabled muxing IO for S=
SL in
server>
<12.07.2005 14:44 Uhr CEST> <Info> <Configuration Management> <BEA-150016> =
<This
server is being started as the administration server.>
<12.07.2005 14:44 Uhr CEST> <Info> <Management> <BEA-141107> <Version: WebL=
ogic
Server 8.1 SP4 Mon Nov 29 16:21:29 PST 2004 471647
WebLogic XMLX Module 8.1 SP4 Mon Nov 29 16:21:29 PST 2004 471647 >
<12.07.2005 14:44 Uhr CEST> <Notice> <Management> <BEA-140005> <Loading dom=
ain c
onfiguration from configuration repository at C:\bea\weblogic81\samples\dom=
ains\
examples\.\config.xml.>
<12.07.2005 14:44 Uhr CEST> <Notice> <Log Management> <BEA-170019> <The ser=
ver l
og file C:\bea\weblogic81\samples\domains\examples\examplesServer\examplesS=
erver
..log is opened. All server side log events will be written to this file.>
<12.07.2005 14:44 Uhr CEST> <Debug> <TLS> <000000> <SSLManager(server=3Dexa=
mplesSe
rver, realm=3Dmyrealm)>
<12.07.2005 14:44 Uhr CEST> <Notice> <Security> <BEA-090082> <Security init=
ializ
ing using security realm myrealm.>
<12.07.2005 14:44 Uhr CEST> <Notice> <WebLogicServer> <BEA-000327> <Startin=
g Web
Logic Admin Server "examplesServer" for domain "examples">
<12.07.2005 14:44 Uhr CEST> <Debug> <RJVM> <BEA-000571> <Network Configurat=
ion D
etail for Channel "examplesServer"
Channel Weight 50
Accept Backlog 50
Login Timeout 5000ms
Max Message Size 10000000
Message Timeout 60s
Idle Timeout 65s
Tunneling Timeout 40s
Tunneling Ping 45s>
<12.07.2005 14:45 Uhr CEST> <Warning> <EJB> <BEA-011057> <The table 'ejbAcc=
ounts
' was created by the user. The container does not drop or alter user create=
d tab
les. The container would verify the table in this case.>
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
After the server has booted, your browser should
automatically launch and point to the WebLogic Server
Index running on this server. If your browser
fails to launch, point your browser to the URL
"http://testcomputer1:7001/examplesWebApp/index.jsp"
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
<12.07.2005 14:45 Uhr CEST> <Debug> <TLS> <000000> <SSL/Domestic license fo=
und>
<12.07.2005 14:45 Uhr CEST> <Debug> <TLS> <000000> <Certicom SSL license fo=
und>
<12.07.2005 14:45 Uhr CEST> <Debug> <TLS> <000000> <SSL Session TTL :90000>
<12.07.2005 14:45 Uhr CEST> <Debug> <TLS> <000000> <SSLListenThread.getSSLM=
anage
r()>
<12.07.2005 14:45 Uhr CEST> <Debug> <TLS> <000000> <SSLManager: getting ser=
ver p
rivate key>
<12.07.2005 14:45 Uhr CEST> <Notice> <Security> <BEA-090170> <Loading the p=
rivat
e key stored under the alias CN=3Dtestcomputer1,OU=3DInsitute for Applied I=
nformatio
n Processing and Communications,O=3DGRAZ UNIVERSITY OF TECHNOLOGY,C=3DAT fr=
om the PK
CS11KeyStore keystore file C:\bea\weblogic81\server\lib\DemoIdentityPkcs11K=
eySto
re.p11.>
<12.07.2005 14:45 Uhr CEST> <Debug> <TLS> <000000> <SSLManager.getServerCer=
tific
ate()>
<12.07.2005 14:45 Uhr CEST> <Notice> <Security> <BEA-090171> <Loading the i=
denti
ty certificate stored under the alias CN=3Dtestcomputer1,OU=3DInsitute for =
Applied I
nformation Processing and Communications,O=3DGRAZ UNIVERSITY OF TECHNOLOGY,=
C=3DAT fr
om the PKCS11KeyStore keystore file C:\bea\weblogic81\server\lib\DemoIdenti=
tyPkc
s11KeyStore.p11.>
java.lang.IllegalStateException: Could not read BER data.(AlgorithmID.findA=
lgID:
encoding should not be null.)
at com.certicom.tls.provider.spec.JSAFE_RSAPrivateKey.<init>(Unknow=
n Sou
rce)
at com.certicom.tls.provider.cipher.JSAFE_RSA.init(Unknown Source)
at com.certicom.tls.interfaceimpl.CertificateSupport.CheckIfKeyMatc=
h(Unk
nown Source)
at com.bea.sslplus.CerticomSSLContext.doKeysMatch(Unknown Source)
at weblogic.security.utils.SSLContextWrapper.doKeysMatch(SSLContext=
Wrapp
er.java:93)
at weblogic.t3.srvr.SSLListenThread.checkIdentity(SSLListenThread.j=
ava:3
23)
at weblogic.t3.srvr.SSLListenThread.initSSLContext(SSLListenThread.=
java:
169)
at weblogic.t3.srvr.SSLListenThread.<init>(SSLListenThread.java:140=
)
at weblogic.t3.srvr.SSLListenThread.<init>(SSLListenThread.java:126=
)
at weblogic.t3.srvr.T3Srvr.initializeListenThreads(T3Srvr.java:1637=
)
at weblogic.t3.srvr.T3Srvr.resume(T3Srvr.java:1009)
at weblogic.t3.srvr.T3Srvr.run(T3Srvr.java:361)
at weblogic.Server.main(Server.java:32)
<12.07.2005 14:45 Uhr CEST> <Debug> <TLS> <000000> <Key match check failed =
with
exception, may not have access to private key data to perform this check>
<12.07.2005 14:45 Uhr CEST> <Warning> <Security> <BEA-090552> <The public a=
nd pr
ivate key could not be checked for consistency.>
<12.07.2005 14:45 Uhr CEST> <Notice> <Security> <BEA-090169> <Loading trust=
ed ce
rtificates from the JKS keystore file C:\bea\weblogic81\server\lib\DemoTrus=
t.jks
..>
<12.07.2005 14:45 Uhr CEST> <Debug> <TLS> <000000> <SSLManager: loaded 5 tr=
usted
CAs from C:\bea\weblogic81\server\lib\DemoTrust.jks>
<12.07.2005 14:45 Uhr CEST> <Debug> <TLS> <000000> <Trusted CA: [
[
Version: V3
Subject: CN=3DCACERT, OU=3DFOR TESTING ONLY, O=3DMyOrganization, L=3DMyTo=
wn, ST=3DMyStat
e, C=3DUS
Signature Algorithm: MD5withRSA, OID =3D 1.2.840.113549.1.1.4
Key: RSA public key (512 bits):
public exponent: 10001
modulus: b6585ed2a4a969a0c85f3a5300f3a53ab340d15b232fa264bfb2c89b74265b0c8f=
87a62
c26c4a25d981a031ffdaecfba92b6ebde4fa9c63a13efcb281cffab71
Validity: [From: Thu Mar 21 21:12:27 CET 2002,
To: Tue Mar 22 21:12:27 CET 2022]
Issuer: CN=3DCACERT, OU=3DFOR TESTING ONLY, O=3DMyOrganization, L=3DMyTow=
n, ST=3DMyState
, C=3DUS
SerialNumber: [ 33f10648 fcde0deb 4199921f d64537f4]
Certificate Extensions: 1
[1]: ObjectId: 2.5.29.15 Criticality=3Dtrue
KeyUsage [
Key_CertSign
]
]
Algorithm: [MD5withRSA]
Signature:
0000: 9D 26 4C 29 C8 91 C3 A7 06 C3 24 6F AE B4 F8 82 .&L)......$o....
0010: 80 4D AA CB 7C 79 46 84 81 C4 66 95 F4 1E D8 C4 .M...yF...f.....
0020: E9 B7 D9 7C E2 23 33 A4 B7 21 E0 AA 54 2B 4A FF .....#3..!..T+J.
0030: CB 21 20 88 81 21 DB AC 90 54 D8 7D 79 63 23 3C .! ..!...T..yc#<
]>
<12.07.2005 14:45 Uhr CEST> <Debug> <TLS> <000000> <Trusted CA: [
[
Version: V3
Subject: EMAILADDRESS=3Dsupport@bea.com, CN=3DDemo Certificate Authority =
Constrain
ts, OU=3DSecurity, O=3DBEA WebLogic, L=3DSan Francisco, ST=3DCalifornia, C=
=3DUS
Signature Algorithm: MD5withRSA, OID =3D 1.2.840.113549.1.1.4
Key: RSA public key (512 bits):
public exponent: 10001
modulus: b808cf5d02f2c7dd6868676acd44f72b3dd4d0dcd42d6929c796a0ffef1812a15b=
ba33e
c7b5900545509c0c33f59aabff362118a864eebdfb97b6995b4dc1bc9
Validity: [From: Fri Nov 01 21:02:22 CET 2002,
To: Mon Oct 16 22:02:22 CEST 2006]
Issuer: EMAILADDRESS=3Dsupport@bea.com, CN=3DDemo Certificate Authority C=
onstraint
s, OU=3DSecurity, O=3DBEA WebLogic, L=3DSan Francisco, ST=3DCalifornia, C=
=3DUS
SerialNumber: [ 00]
Certificate Extensions: 1
[1]: ObjectId: 2.5.29.19 Criticality=3Dtrue
BasicConstraints:[
CA:true
PathLen:1
]
]
Algorithm: [MD5withRSA]
Signature:
0000: 83 57 9E 88 D3 32 26 A9 37 6A 04 B4 31 3B 40 08 .W...2&.7j..1;@.
0010: 24 C1 1E 04 6D 77 64 86 14 98 1B 70 36 17 08 29 $...mwd....p6..)
0020: C5 CC 63 40 7C 24 3D 06 1B 60 5F D0 23 18 A1 F9 ..c@.$=3D..`_.#...
0030: C5 B1 1E 6B 43 1E 4D 09 54 2C 65 B8 06 8C F6 4E ...kC.M.T,e....N
]>
<12.07.2005 14:45 Uhr CEST> <Debug> <TLS> <000000> <Trusted CA: [
[
Version: V3
Subject: EMAILADDRESS=3Dsecurity@bea.com, CN=3DDemo Certificate Authority=
Constrai
nts, OU=3DSecurity, O=3DBEA WebLogic, L=3DSan Francisco, ST=3DCalifornia, C=
=3DUS
Signature Algorithm: MD5withRSA, OID =3D 1.2.840.113549.1.1.4
Key: RSA public key (1024 bits):
public exponent: 10001
modulus: df29c3f25e497cba1be20e9df7874db48d047a9e90365f5b6e59acc27ae3218cf5=
0558e
34633556a5f5f46cfbc8ef9bce6421695eacacc830982236c8f9d16957ccd5faa2bb338204a=
c5b5e
69a95d1a604f517bd28234d9ce465b0b8e6461b95c60f6b24512d8c7323ad262bd880c585c7=
703e0
22dd267961159ca34e6d21587
Validity: [From: Fri Nov 01 21:02:11 CET 2002,
To: Mon Oct 16 22:02:11 CEST 2006]
Issuer: EMAILADDRESS=3Dsecurity@bea.com, CN=3DDemo Certificate Authority =
Constrain
ts, OU=3DSecurity, O=3DBEA WebLogic, L=3DSan Francisco, ST=3DCalifornia, C=
=3DUS
SerialNumber: [ 00]
Certificate Extensions: 1
[1]: ObjectId: 2.5.29.19 Criticality=3Dtrue
BasicConstraints:[
CA:true
PathLen:1
]
]
Algorithm: [MD5withRSA]
Signature:
0000: 52 FB 4A 2A 5B 11 B2 A9 B6 4E D3 6F 33 7F DB 50 R.J*[....N.o3..P
0010: 4F 64 4A A2 37 EE C3 2C 2B 0E 81 96 F7 A5 27 E4 OdJ.7..,+.....'.
0020: 8A A9 16 70 47 22 EE 5A B6 58 89 A3 73 94 A6 21 ...pG".Z.X..s..!
0030: F5 F0 A9 30 2C DF 03 54 FF F7 B7 72 B7 3B 79 17 ...0,..T...r.;y.
0040: 74 8B 8B 6E A0 0B D2 2E 71 C8 19 40 86 BE E0 13 t..n....q..@....
0050: 97 95 84 8C 9E 32 0E C4 4C 13 CB C8 63 B6 04 5D .....2..L...c..]
0060: 77 63 6E 0B 96 C3 BE 31 7F 63 5B B7 F1 32 B6 8F wcn....1.c[..2..
0070: 37 AD 3C 41 E2 57 91 9C 34 13 47 06 C2 BC 36 01 7.<A.W..4.G...6.
]>
<12.07.2005 14:45 Uhr CEST> <Debug> <TLS> <000000> <Trusted CA: [
[
Version: V3
Subject: CN=3DIAIK Karl's Test PCA, OU=3DKarl, OU=3DIAIK, O=3DTU Graz, C=
=3DAT
Signature Algorithm: SHA1withRSA, OID =3D 1.2.840.113549.1.1.5
Key: RSA public key (2048 bits):
public exponent: 10001
modulus: d252f24878d0879f0211910592df3808a9d0463631ee70b6e27bcda237a952c550=
496b3
863bc06e3f760fbf12541f91334608f8016de55797360b82e71dfd6969c6839b6b8bd7602b6=
2e18b
36ddde62dcac15599dd7ed60f4bac5bd53cf0192ff2c699604494395a778630119b6e8cf19f=
5d434
cafe3e381f2f5d7d1544295469a0c0850480d00bfe6d758dc5c5d281f0e5c987c868381593a=
fba03
4c516b217b05219be483e8d81808ebc09d34a2964e125dd1edc669a2b9292422cb35f2722eb=
339c3
d175ed1748aad7cf6fd681f62938bc928c075d0906ee3208edd842027d3ab6a906e5ead0952=
e9186
22b7d258681c28e7ff57c520329dce9e28c67439d
Validity: [From: Thu Jan 20 16:18:14 CET 2005,
To: Fri Jan 01 12:00:00 CET 2010]
Issuer: CN=3DIAIK Karl's Test PCA, OU=3DKarl, OU=3DIAIK, O=3DTU Graz, C=
=3DAT
SerialNumber: [ 01]
Certificate Extensions: 5
[1]: ObjectId: 2.5.29.14 Criticality=3Dfalse
SubjectKeyIdentifier [
KeyIdentifier [
0000: C9 D6 FB 68 59 6E C0 0C 84 C2 CB 32 9C 7D 0E 6F ...hYn.....2...o
0010: 40 5C 4D 7B @\M.
]
]
[2]: ObjectId: 2.5.29.35 Criticality=3Dfalse
AuthorityKeyIdentifier [
KeyIdentifier [
0000: C9 D6 FB 68 59 6E C0 0C 84 C2 CB 32 9C 7D 0E 6F ...hYn.....2...o
0010: 40 5C 4D 7B @\M.
]
]
[3]: ObjectId: 2.5.29.32 Criticality=3Dfalse
CertificatePolicies [
[CertificatePolicyId: [1.3.6.1.4.1.2706.1.2.123.1.1]
[PolicyQualifierInfo: [
qualifierID: 1.3.6.1.5.5.7.2.2
qualifier: 0000: 30 47 1A 45 54 68 69 73 20 63 65 72 74 69 66 69 0G.ET=
his c
ertifi
0010: 63 61 74 65 20 6F 6E 6C 79 20 6D 61 79 20 62 65 cate only may be
0020: 20 75 73 65 64 20 66 6F 72 20 64 65 6D 6F 6E 73 used for demons
0030: 74 72 61 74 69 6F 6E 20 61 6E 64 20 74 65 73 74 tration and test
0040: 20 70 75 72 70 6F 73 65 73 purposes
]] ]
]
[4]: ObjectId: 2.5.29.15 Criticality=3Dtrue
KeyUsage [
Key_CertSign
Crl_Sign
]
[5]: ObjectId: 2.5.29.19 Criticality=3Dtrue
BasicConstraints:[
CA:true
PathLen:2147483647
]
]
Algorithm: [SHA1withRSA]
Signature:
0000: A6 46 A7 40 92 7B F0 79 0B 13 25 3B 1F A8 3B 0C .F.@...y..%;..;.
0010: 9F CE 0D C1 E7 97 DC D0 2A 88 24 F6 49 93 03 66 ........*.$.I..f
0020: 5B 23 47 66 80 A0 55 CF 38 E8 E0 3A 4E 75 CE 1D [#Gf..U.8..:Nu..
0030: A8 C1 65 06 FE 6E 41 E7 EB 6B 9D 5A 5C E8 87 11 ..e..nA..k.Z\...
0040: 90 B0 7A EA EC 91 00 50 31 88 5E 71 4F C6 84 D6 ..z....P1.^qO...
0050: D5 0F C7 FA A1 AE 1A FD 02 36 42 BE B3 DC 8A F5 .........6B.....
0060: 59 A2 05 49 95 4A 9C DF 4C AF 0A C7 84 02 D8 45 Y..I.J..L......E
0070: 55 9E E7 DD DA 9F A2 60 C5 D1 7E FC ED B7 5F AC U......`......_.
0080: A6 B0 86 66 5B 1F 3D 80 93 B4 87 A3 A3 74 DB C5 ...f[.=3D......t..
0090: EA 0E 56 03 D8 B4 32 87 80 B1 F4 B6 2D DA 04 44 ..V...2.....-..D
00A0: FB D7 C7 05 57 97 66 7D E7 41 FC F5 C7 EE 0C DD ....W.f..A......
00B0: A6 23 64 07 F3 74 2A 4C 83 B4 85 CF 69 70 AE FB .#d..t*L....ip..
00C0: 27 C2 D5 15 10 76 36 71 B3 F4 41 16 5E 7D 1C 78 '....v6q..A.^..x
00D0: 9B AD 1C E8 46 76 28 74 D7 84 CD E0 85 1B FE F5 ....Fv(t........
00E0: 55 03 D5 27 E9 E3 B2 A2 94 20 CD 56 C6 DC 87 72 U..'..... .V...r
00F0: 8D 40 AF CF D9 81 8C 39 A3 BA 59 AB EA D1 4C F9 .@.....9..Y...L.
]>
<12.07.2005 14:45 Uhr CEST> <Debug> <TLS> <000000> <Trusted CA: [
[
Version: V3
Subject: CN=3DCertGenCAB, OU=3DFOR TESTING ONLY, O=3DMyOrganization, L=3D=
MyTown, ST=3DMy
State, C=3DUS
Signature Algorithm: MD5withRSA, OID =3D 1.2.840.113549.1.1.4
Key: RSA public key (512 bits):
public exponent: 10001
modulus: afa4814a734e02099c2f2b92d8d442c614cb75fd2493fc399a248743e6d8a1f76c=
e2b8f
42348fc498216cd6fd86cb6b0e7d654fd873d8eee4c42356258b7b25b
Validity: [From: Thu Oct 24 17:54:45 CEST 2002,
To: Tue Oct 25 17:54:45 CEST 2022]
Issuer: CN=3DCertGenCAB, OU=3DFOR TESTING ONLY, O=3DMyOrganization, L=3DM=
yTown, ST=3DMyS
tate, C=3DUS
SerialNumber: [ 234b5559 d1fa0f3f f5c82bdf ed032a87]
Certificate Extensions: 2
[1]: ObjectId: 2.5.29.15 Criticality=3Dtrue
KeyUsage [
Key_CertSign
]
[2]: ObjectId: 2.5.29.19 Criticality=3Dtrue
BasicConstraints:[
CA:true
PathLen:1
]
]
Algorithm: [MD5withRSA]
Signature:
0000: 42 38 2B 10 F5 05 AF 1A F0 22 92 30 41 3A 3A D3 B8+......".0A::.
0010: 16 A6 41 34 96 09 B2 FE 7E 99 56 7D D2 95 70 9B ..A4......V...p.
0020: 31 03 8A 1C 3C 75 B2 37 B9 B3 18 CF 9B 1A 5E 42 1...<u.7......^B
0030: 92 CB 7A DC 4A F2 4A F6 76 49 90 7B DB F3 C8 59 ..z.J.J.vI.....Y
]>
<12.07.2005 14:45 Uhr CEST> <Error> <WebLogicServer> <BEA-000297> <Inconsis=
tent
security configuration, java.lang.ArrayStoreException>
<12.07.2005 14:45 Uhr CEST> <Debug> <TLS> <000000> <SSLListenThread: incons=
isten
t configuration
java.lang.ArrayStoreException
at com.certicom.tls.interfaceimpl.CertificateSupport.addAuthChain(U=
nknow
n Source)
at com.certicom.net.ssl.SSLContext.addAuthChain(Unknown Source)
at com.bea.sslplus.CerticomSSLContext.addIdentity(Unknown Source)
at weblogic.security.utils.SSLContextWrapper.addIdentity(SSLContext=
Wrapp
er.java:87)
at weblogic.t3.srvr.SSLListenThread.initSSLContext(SSLListenThread.=
java:
181)
at weblogic.t3.srvr.SSLListenThread.<init>(SSLListenThread.java:140=
)
at weblogic.t3.srvr.SSLListenThread.<init>(SSLListenThread.java:126=
)
at weblogic.t3.srvr.T3Srvr.initializeListenThreads(T3Srvr.java:1637=
)
at weblogic.t3.srvr.T3Srvr.resume(T3Srvr.java:1009)
at weblogic.t3.srvr.T3Srvr.run(T3Srvr.java:361)
at weblogic.Server.main(Server.java:32)
>
<12.07.2005 14:45 Uhr CEST> <Emergency> <Security> <BEA-090034> <Not listen=
ing f
or SSL, java.io.IOException: Inconsistent security configuration, null.>
<12.07.2005 14:45 Uhr CEST> <Notice> <WebLogicServer> <BEA-000331> <Started=
WebL
ogic Admin Server "examplesServer" for domain "examples" running in Develop=
ment
Mode>
<12.07.2005 14:45 Uhr CEST> <Notice> <WebLogicServer> <BEA-000360> <Server =
start
ed in RUNNING mode>
<12.07.2005 14:45 Uhr CEST> <Notice> <WebLogicServer> <BEA-000355> <Thread =
"List
enThread.Default" listening on port 7001, ip address *.*>
-
Re: SSL, custom identity keystore, ArrayStoreException
Hi,
I am also facing the same issue securing web-logic server with pkcs#11 hardware module.
SSL Debug messages are as follows:
<Jul 12, 2010 11:55:31 AM IST> <Warning> <Security> <BEA-090482> <BAD_CERTIFICATE alert was received from noi1-501414.sfnt.local - 172.25.13
.153. Check the peer to determine why it rejected the certificate chain (trusted CA configuration, hostname verification). SSL debug tracing
may be required to determine the exact reason the certificate was rejected.>
<Jul 12, 2010 11:55:31 AM IST> <Debug> <SecuritySSL> <BEA-000000> <close(): 13101625>
<Jul 12, 2010 11:55:31 AM IST> <Debug> <SecuritySSL> <BEA-000000> <close(): 13101625>
<Jul 12, 2010 11:55:31 AM IST> <Debug> <SecuritySSL> <BEA-000000> <SSLIOContextTable.removeContext(ctx): 13102103>
<Jul 12, 2010 11:55:36 AM IST> <Debug> <SecuritySSL> <BEA-000000> <Filtering JSSE SSLSocket>
<Jul 12, 2010 11:55:36 AM IST> <Debug> <SecuritySSL> <BEA-000000> <SSLIOContextTable.addContext(ctx): 13105497>
<Jul 12, 2010 11:55:36 AM IST> <Debug> <SecuritySSL> <BEA-000000> <SSLSocket will be Muxing>
<Jul 12, 2010 11:55:36 AM IST> <Debug> <SecuritySSL> <BEA-000000> <isMuxerActivated: false>
<Jul 12, 2010 11:55:36 AM IST> <Debug> <SecuritySSL> <BEA-000000> <13105028 SSL3/TLS MAC>
<Jul 12, 2010 11:55:36 AM IST> <Debug> <SecuritySSL> <BEA-000000> <13105028 received HANDSHAKE>
<Jul 12, 2010 11:55:36 AM IST> <Debug> <SecuritySSL> <BEA-000000> <HANDSHAKEMESSAGE: ClientHello>
<Jul 12, 2010 11:55:36 AM IST> <Debug> <SecuritySSL> <BEA-000000> <write HANDSHAKE, offset = 0, length = 58>
<Jul 12, 2010 11:55:36 AM IST> <Debug> <SecuritySSL> <BEA-000000> <write HANDSHAKE, offset = 0, length = 585>
<Jul 12, 2010 11:55:36 AM IST> <Debug> <SecuritySSL> <BEA-000000> <write HANDSHAKE, offset = 0, length = 4>
<Jul 12, 2010 11:55:36 AM IST> <Debug> <SecuritySSL> <BEA-000000> <isMuxerActivated: false>
<Jul 12, 2010 11:55:36 AM IST> <Debug> <SecuritySSL> <BEA-000000> <13105028 SSL3/TLS MAC>
<Jul 12, 2010 11:55:36 AM IST> <Debug> <SecuritySSL> <BEA-000000> <13105028 received HANDSHAKE>
<Jul 12, 2010 11:55:36 AM IST> <Debug> <SecuritySSL> <BEA-000000> <HANDSHAKEMESSAGE: ClientKeyExchange RSA>
<Jul 12, 2010 11:55:36 AM IST> <Debug> <SecuritySSL> <BEA-000000> <Will use default Cipher for algorithm RSA/ECB/PKCS1Padding>
<Jul 12, 2010 11:55:36 AM IST> <Debug> <SecuritySSL> <BEA-000000> <Exception during handshake, stack trace follows
java.lang.IllegalStateException: Could not read BER data.(AlgorithmID.findAlgID: Could not find the OID)
at com.certicom.tls.provider.spec.JSAFE_RSAPrivateKey.<init>(Unknown Source)
at com.certicom.tls.provider.cipher.JSAFE_RSA.init(Unknown Source)
at com.certicom.tls.record.handshake.ServerStateSentHelloDone.handle(Unknown Source)
at com.certicom.tls.record.handshake.HandshakeHandler.handleHandshakeMessage(Unknown Source)
at com.certicom.tls.record.handshake.HandshakeHandler.handleHandshakeMessages(Unknown Source)
at com.certicom.tls.record.MessageInterpreter.interpretContent(Unknown Source)
at com.certicom.tls.record.MessageInterpreter.decryptMessage(Unknown Source)
at com.certicom.tls.record.ReadHandler.processRecord(Unknown Source)
at com.certicom.tls.record.ReadHandler.readRecord(Unknown Source)
at com.certicom.tls.record.ReadHandler.readUntilHandshakeComplete(Unknown Source)
at com.certicom.tls.interfaceimpl.TLSConnectionImpl.completeHandshake(Unknown Source)
at javax.net.ssl.impl.SSLSocketImpl.startHandshake(Unknown Source)
at weblogic.server.channels.DynamicSSLListenThread$1.run(DynamicSSLListenThread.java:130)
at weblogic.work.ExecuteThread.execute(ExecuteThread.java:201)
at weblogic.work.ExecuteThread.run(ExecuteThread.java:173)
Any help will be appreciated.....