SSL, custom identity keystore, ArrayStoreException - Weblogic

This is a discussion on SSL, custom identity keystore, ArrayStoreException - Weblogic ; hi, i use Weblogic 8.1 SP4, SUN JDK 1.4.2_05 (which comes with the Weblogic ins= tallaion) on Windows XP SP2 (x86). i configured SSL via the console to use = a custom identity key store. this is the server element ...

+ Reply to Thread
Results 1 to 2 of 2

SSL, custom identity keystore, ArrayStoreException

  1. Default SSL, custom identity keystore, ArrayStoreException

    hi,

    i use Weblogic 8.1 SP4, SUN JDK 1.4.2_05 (which comes with the Weblogic ins=
    tallaion) on Windows XP SP2 (x86). i configured SSL via the console to use =
    a custom identity key store.

    this is the server element from the config.xml:

    <Server COMEnabled=3D"true" ConsoleInputEnabled=3D"false"
    CustomIdentityKeyStoreFileName=3D"C:\bea\weblogic81\server\lib\Demo=
    IdentityPkcs11KeyStore.p11"
    CustomIdentityKeyStorePassPhraseEncrypted=3D"{3DES}YxTgMAXByeE=3D"
    CustomIdentityKeyStoreType=3D"PKCS11KeyStore"
    CustomTrustKeyStoreFileName=3D"C:\bea\weblogic81\server\lib\DemoTru=
    st.jks"
    CustomTrustKeyStorePassPhraseEncrypted=3D"{3DES}2crOaiJFjTCPF+2RXDh=
    9dEDRgsTrQrVwYaoLKpATcnQ=3D"
    CustomTrustKeyStoreType=3D"JKS" DomainLogFilter=3D""
    ExpectedToRun=3D"false" IgnoreSessionsDuringShutdown=3D"true"
    JavaCompiler=3D"javac" KeyStores=3D"CustomIdentityAndCustomTrust"
    ListenAddress=3D"" ListenPort=3D"7001" Name=3D"examplesServer"
    ServerVersion=3D"8.1.4.0" SocketReaderTimeoutMaxMillis=3D"10" Stdou=
    tDebugEnabled=3D"true">
    <SSL Enabled=3D"true" IdentityAndTrustLocations=3D"KeyStores"
    ListenPort=3D"7002" Name=3D"examplesServer"
    ServerPrivateKeyAlias=3D"CN=3Dtestcomputer1,OU=3DInsitute for A=
    pplied Information Processing and Communications,O=3DGRAZ UNIVERSITY OF TEC=
    HNOLOGY,C=3DAT" ServerPrivateKeyPassPhraseEncrypted=3D"{3DES}YxTgMAXByeE=3D=
    "/>
    </Server>

    as you can see, i use a different key store type. it is a PKCS#11 key store=
    which can integrate any crypto hardware which supports PKCS#11. i installe=
    d the PKCS#11 JCE provider in the java.security file of the JRE. the lines =
    in this file look like this now:

    security.provider.1=3Dsun.security.provider.Sun
    security.provider.2=3Diaik.pkcs.pkcs11.provider.IAIKPkcs11
    security.provider.3=3Dcom.sun.net.ssl.internal.ssl.Provider
    security.provider.4=3Dcom.sun.rsajca.Provider
    security.provider.5=3Dcom.sun.crypto.provider.SunJCE
    security.provider.6=3Dsun.security.jgss.SunProvider
    security.provider.7=3Diaik.security.provider.IAIK

    moreover, i places all necessary files in the jre/lib/ext directory. the se=
    rver seems to load the key store successfully. however, the SSL implementat=
    ion inside the Weblogic server (Certicom as i can see) causes an java.lang.=
    ArrayStoreException which seems to prevent SSL from working. it also causes=
    a java.lang.IllegalStateException before, because it naively assumes that =
    it can encode all private keys (which cannot work for hardware protected pr=
    ivate keys); at least it seems to recover from this IllegalStateException.
    the actual problem seems to happen when the SSL/TLS implementation tries to=
    add the certificate chain to the SSL context. it looks as if this context =
    class only accepts certificates of a special class. the certificate chain o=
    f my key store is of type iaik.x509.X509Certificate[], where iaik.x509.X509=
    Certificate is the certificate implementation of one of the installed provi=
    ders and extends java.security.cert.X509Certificate. is there any known res=
    triction for the certificate chain?

    here is the log output with debug.ssl enabled:


    C:\bea\weblogic81\samples\domains\examples>echo off
    <12.07.2005 14:43 Uhr CEST> <Info> <WebLogicServer> <BEA-000377> <Starting =
    WebLo
    gic Server with Java HotSpot(TM) Client VM Version 1.4.2_05-b04 from Sun Mi=
    crosy
    stems Inc.>
    <12.07.2005 14:44 Uhr CEST> <Debug> <TLS> <000000> <Enabled muxing IO for S=
    SL in
    server>
    <12.07.2005 14:44 Uhr CEST> <Info> <Configuration Management> <BEA-150016> =
    <This
    server is being started as the administration server.>
    <12.07.2005 14:44 Uhr CEST> <Info> <Management> <BEA-141107> <Version: WebL=
    ogic
    Server 8.1 SP4 Mon Nov 29 16:21:29 PST 2004 471647
    WebLogic XMLX Module 8.1 SP4 Mon Nov 29 16:21:29 PST 2004 471647 >
    <12.07.2005 14:44 Uhr CEST> <Notice> <Management> <BEA-140005> <Loading dom=
    ain c
    onfiguration from configuration repository at C:\bea\weblogic81\samples\dom=
    ains\
    examples\.\config.xml.>
    <12.07.2005 14:44 Uhr CEST> <Notice> <Log Management> <BEA-170019> <The ser=
    ver l
    og file C:\bea\weblogic81\samples\domains\examples\examplesServer\examplesS=
    erver
    ..log is opened. All server side log events will be written to this file.>
    <12.07.2005 14:44 Uhr CEST> <Debug> <TLS> <000000> <SSLManager(server=3Dexa=
    mplesSe
    rver, realm=3Dmyrealm)>
    <12.07.2005 14:44 Uhr CEST> <Notice> <Security> <BEA-090082> <Security init=
    ializ
    ing using security realm myrealm.>
    <12.07.2005 14:44 Uhr CEST> <Notice> <WebLogicServer> <BEA-000327> <Startin=
    g Web
    Logic Admin Server "examplesServer" for domain "examples">
    <12.07.2005 14:44 Uhr CEST> <Debug> <RJVM> <BEA-000571> <Network Configurat=
    ion D
    etail for Channel "examplesServer"
    Channel Weight 50
    Accept Backlog 50
    Login Timeout 5000ms
    Max Message Size 10000000
    Message Timeout 60s
    Idle Timeout 65s
    Tunneling Timeout 40s
    Tunneling Ping 45s>
    <12.07.2005 14:45 Uhr CEST> <Warning> <EJB> <BEA-011057> <The table 'ejbAcc=
    ounts
    ' was created by the user. The container does not drop or alter user create=
    d tab
    les. The container would verify the table in this case.>
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    After the server has booted, your browser should
    automatically launch and point to the WebLogic Server
    Index running on this server. If your browser
    fails to launch, point your browser to the URL
    "http://testcomputer1:7001/examplesWebApp/index.jsp"
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    <12.07.2005 14:45 Uhr CEST> <Debug> <TLS> <000000> <SSL/Domestic license fo=
    und>

    <12.07.2005 14:45 Uhr CEST> <Debug> <TLS> <000000> <Certicom SSL license fo=
    und>

    <12.07.2005 14:45 Uhr CEST> <Debug> <TLS> <000000> <SSL Session TTL :90000>
    <12.07.2005 14:45 Uhr CEST> <Debug> <TLS> <000000> <SSLListenThread.getSSLM=
    anage
    r()>
    <12.07.2005 14:45 Uhr CEST> <Debug> <TLS> <000000> <SSLManager: getting ser=
    ver p
    rivate key>
    <12.07.2005 14:45 Uhr CEST> <Notice> <Security> <BEA-090170> <Loading the p=
    rivat
    e key stored under the alias CN=3Dtestcomputer1,OU=3DInsitute for Applied I=
    nformatio
    n Processing and Communications,O=3DGRAZ UNIVERSITY OF TECHNOLOGY,C=3DAT fr=
    om the PK
    CS11KeyStore keystore file C:\bea\weblogic81\server\lib\DemoIdentityPkcs11K=
    eySto
    re.p11.>
    <12.07.2005 14:45 Uhr CEST> <Debug> <TLS> <000000> <SSLManager.getServerCer=
    tific
    ate()>
    <12.07.2005 14:45 Uhr CEST> <Notice> <Security> <BEA-090171> <Loading the i=
    denti
    ty certificate stored under the alias CN=3Dtestcomputer1,OU=3DInsitute for =
    Applied I
    nformation Processing and Communications,O=3DGRAZ UNIVERSITY OF TECHNOLOGY,=
    C=3DAT fr
    om the PKCS11KeyStore keystore file C:\bea\weblogic81\server\lib\DemoIdenti=
    tyPkc
    s11KeyStore.p11.>
    java.lang.IllegalStateException: Could not read BER data.(AlgorithmID.findA=
    lgID:
    encoding should not be null.)
    at com.certicom.tls.provider.spec.JSAFE_RSAPrivateKey.<init>(Unknow=
    n Sou
    rce)
    at com.certicom.tls.provider.cipher.JSAFE_RSA.init(Unknown Source)
    at com.certicom.tls.interfaceimpl.CertificateSupport.CheckIfKeyMatc=
    h(Unk
    nown Source)
    at com.bea.sslplus.CerticomSSLContext.doKeysMatch(Unknown Source)
    at weblogic.security.utils.SSLContextWrapper.doKeysMatch(SSLContext=
    Wrapp
    er.java:93)
    at weblogic.t3.srvr.SSLListenThread.checkIdentity(SSLListenThread.j=
    ava:3
    23)
    at weblogic.t3.srvr.SSLListenThread.initSSLContext(SSLListenThread.=
    java:
    169)
    at weblogic.t3.srvr.SSLListenThread.<init>(SSLListenThread.java:140=
    )
    at weblogic.t3.srvr.SSLListenThread.<init>(SSLListenThread.java:126=
    )
    at weblogic.t3.srvr.T3Srvr.initializeListenThreads(T3Srvr.java:1637=
    )
    at weblogic.t3.srvr.T3Srvr.resume(T3Srvr.java:1009)
    at weblogic.t3.srvr.T3Srvr.run(T3Srvr.java:361)
    at weblogic.Server.main(Server.java:32)
    <12.07.2005 14:45 Uhr CEST> <Debug> <TLS> <000000> <Key match check failed =
    with
    exception, may not have access to private key data to perform this check>
    <12.07.2005 14:45 Uhr CEST> <Warning> <Security> <BEA-090552> <The public a=
    nd pr
    ivate key could not be checked for consistency.>
    <12.07.2005 14:45 Uhr CEST> <Notice> <Security> <BEA-090169> <Loading trust=
    ed ce
    rtificates from the JKS keystore file C:\bea\weblogic81\server\lib\DemoTrus=
    t.jks
    ..>
    <12.07.2005 14:45 Uhr CEST> <Debug> <TLS> <000000> <SSLManager: loaded 5 tr=
    usted
    CAs from C:\bea\weblogic81\server\lib\DemoTrust.jks>
    <12.07.2005 14:45 Uhr CEST> <Debug> <TLS> <000000> <Trusted CA: [
    [
    Version: V3
    Subject: CN=3DCACERT, OU=3DFOR TESTING ONLY, O=3DMyOrganization, L=3DMyTo=
    wn, ST=3DMyStat
    e, C=3DUS
    Signature Algorithm: MD5withRSA, OID =3D 1.2.840.113549.1.1.4

    Key: RSA public key (512 bits):
    public exponent: 10001
    modulus: b6585ed2a4a969a0c85f3a5300f3a53ab340d15b232fa264bfb2c89b74265b0c8f=
    87a62
    c26c4a25d981a031ffdaecfba92b6ebde4fa9c63a13efcb281cffab71

    Validity: [From: Thu Mar 21 21:12:27 CET 2002,
    To: Tue Mar 22 21:12:27 CET 2022]
    Issuer: CN=3DCACERT, OU=3DFOR TESTING ONLY, O=3DMyOrganization, L=3DMyTow=
    n, ST=3DMyState
    , C=3DUS
    SerialNumber: [ 33f10648 fcde0deb 4199921f d64537f4]

    Certificate Extensions: 1
    [1]: ObjectId: 2.5.29.15 Criticality=3Dtrue
    KeyUsage [
    Key_CertSign
    ]

    ]
    Algorithm: [MD5withRSA]
    Signature:
    0000: 9D 26 4C 29 C8 91 C3 A7 06 C3 24 6F AE B4 F8 82 .&L)......$o....
    0010: 80 4D AA CB 7C 79 46 84 81 C4 66 95 F4 1E D8 C4 .M...yF...f.....
    0020: E9 B7 D9 7C E2 23 33 A4 B7 21 E0 AA 54 2B 4A FF .....#3..!..T+J.
    0030: CB 21 20 88 81 21 DB AC 90 54 D8 7D 79 63 23 3C .! ..!...T..yc#<

    ]>
    <12.07.2005 14:45 Uhr CEST> <Debug> <TLS> <000000> <Trusted CA: [
    [
    Version: V3
    Subject: EMAILADDRESS=3Dsupport@bea.com, CN=3DDemo Certificate Authority =
    Constrain
    ts, OU=3DSecurity, O=3DBEA WebLogic, L=3DSan Francisco, ST=3DCalifornia, C=
    =3DUS
    Signature Algorithm: MD5withRSA, OID =3D 1.2.840.113549.1.1.4

    Key: RSA public key (512 bits):
    public exponent: 10001
    modulus: b808cf5d02f2c7dd6868676acd44f72b3dd4d0dcd42d6929c796a0ffef1812a15b=
    ba33e
    c7b5900545509c0c33f59aabff362118a864eebdfb97b6995b4dc1bc9

    Validity: [From: Fri Nov 01 21:02:22 CET 2002,
    To: Mon Oct 16 22:02:22 CEST 2006]
    Issuer: EMAILADDRESS=3Dsupport@bea.com, CN=3DDemo Certificate Authority C=
    onstraint
    s, OU=3DSecurity, O=3DBEA WebLogic, L=3DSan Francisco, ST=3DCalifornia, C=
    =3DUS
    SerialNumber: [ 00]

    Certificate Extensions: 1
    [1]: ObjectId: 2.5.29.19 Criticality=3Dtrue
    BasicConstraints:[
    CA:true
    PathLen:1
    ]

    ]
    Algorithm: [MD5withRSA]
    Signature:
    0000: 83 57 9E 88 D3 32 26 A9 37 6A 04 B4 31 3B 40 08 .W...2&.7j..1;@.
    0010: 24 C1 1E 04 6D 77 64 86 14 98 1B 70 36 17 08 29 $...mwd....p6..)
    0020: C5 CC 63 40 7C 24 3D 06 1B 60 5F D0 23 18 A1 F9 ..c@.$=3D..`_.#...
    0030: C5 B1 1E 6B 43 1E 4D 09 54 2C 65 B8 06 8C F6 4E ...kC.M.T,e....N

    ]>
    <12.07.2005 14:45 Uhr CEST> <Debug> <TLS> <000000> <Trusted CA: [
    [
    Version: V3
    Subject: EMAILADDRESS=3Dsecurity@bea.com, CN=3DDemo Certificate Authority=
    Constrai
    nts, OU=3DSecurity, O=3DBEA WebLogic, L=3DSan Francisco, ST=3DCalifornia, C=
    =3DUS
    Signature Algorithm: MD5withRSA, OID =3D 1.2.840.113549.1.1.4

    Key: RSA public key (1024 bits):
    public exponent: 10001
    modulus: df29c3f25e497cba1be20e9df7874db48d047a9e90365f5b6e59acc27ae3218cf5=
    0558e
    34633556a5f5f46cfbc8ef9bce6421695eacacc830982236c8f9d16957ccd5faa2bb338204a=
    c5b5e
    69a95d1a604f517bd28234d9ce465b0b8e6461b95c60f6b24512d8c7323ad262bd880c585c7=
    703e0
    22dd267961159ca34e6d21587

    Validity: [From: Fri Nov 01 21:02:11 CET 2002,
    To: Mon Oct 16 22:02:11 CEST 2006]
    Issuer: EMAILADDRESS=3Dsecurity@bea.com, CN=3DDemo Certificate Authority =
    Constrain
    ts, OU=3DSecurity, O=3DBEA WebLogic, L=3DSan Francisco, ST=3DCalifornia, C=
    =3DUS
    SerialNumber: [ 00]

    Certificate Extensions: 1
    [1]: ObjectId: 2.5.29.19 Criticality=3Dtrue
    BasicConstraints:[
    CA:true
    PathLen:1
    ]

    ]
    Algorithm: [MD5withRSA]
    Signature:
    0000: 52 FB 4A 2A 5B 11 B2 A9 B6 4E D3 6F 33 7F DB 50 R.J*[....N.o3..P
    0010: 4F 64 4A A2 37 EE C3 2C 2B 0E 81 96 F7 A5 27 E4 OdJ.7..,+.....'.
    0020: 8A A9 16 70 47 22 EE 5A B6 58 89 A3 73 94 A6 21 ...pG".Z.X..s..!
    0030: F5 F0 A9 30 2C DF 03 54 FF F7 B7 72 B7 3B 79 17 ...0,..T...r.;y.
    0040: 74 8B 8B 6E A0 0B D2 2E 71 C8 19 40 86 BE E0 13 t..n....q..@....
    0050: 97 95 84 8C 9E 32 0E C4 4C 13 CB C8 63 B6 04 5D .....2..L...c..]
    0060: 77 63 6E 0B 96 C3 BE 31 7F 63 5B B7 F1 32 B6 8F wcn....1.c[..2..
    0070: 37 AD 3C 41 E2 57 91 9C 34 13 47 06 C2 BC 36 01 7.<A.W..4.G...6.

    ]>
    <12.07.2005 14:45 Uhr CEST> <Debug> <TLS> <000000> <Trusted CA: [
    [
    Version: V3
    Subject: CN=3DIAIK Karl's Test PCA, OU=3DKarl, OU=3DIAIK, O=3DTU Graz, C=
    =3DAT
    Signature Algorithm: SHA1withRSA, OID =3D 1.2.840.113549.1.1.5

    Key: RSA public key (2048 bits):
    public exponent: 10001
    modulus: d252f24878d0879f0211910592df3808a9d0463631ee70b6e27bcda237a952c550=
    496b3
    863bc06e3f760fbf12541f91334608f8016de55797360b82e71dfd6969c6839b6b8bd7602b6=
    2e18b
    36ddde62dcac15599dd7ed60f4bac5bd53cf0192ff2c699604494395a778630119b6e8cf19f=
    5d434
    cafe3e381f2f5d7d1544295469a0c0850480d00bfe6d758dc5c5d281f0e5c987c868381593a=
    fba03
    4c516b217b05219be483e8d81808ebc09d34a2964e125dd1edc669a2b9292422cb35f2722eb=
    339c3
    d175ed1748aad7cf6fd681f62938bc928c075d0906ee3208edd842027d3ab6a906e5ead0952=
    e9186
    22b7d258681c28e7ff57c520329dce9e28c67439d

    Validity: [From: Thu Jan 20 16:18:14 CET 2005,
    To: Fri Jan 01 12:00:00 CET 2010]
    Issuer: CN=3DIAIK Karl's Test PCA, OU=3DKarl, OU=3DIAIK, O=3DTU Graz, C=
    =3DAT
    SerialNumber: [ 01]

    Certificate Extensions: 5
    [1]: ObjectId: 2.5.29.14 Criticality=3Dfalse
    SubjectKeyIdentifier [
    KeyIdentifier [
    0000: C9 D6 FB 68 59 6E C0 0C 84 C2 CB 32 9C 7D 0E 6F ...hYn.....2...o
    0010: 40 5C 4D 7B @\M.
    ]
    ]

    [2]: ObjectId: 2.5.29.35 Criticality=3Dfalse
    AuthorityKeyIdentifier [
    KeyIdentifier [
    0000: C9 D6 FB 68 59 6E C0 0C 84 C2 CB 32 9C 7D 0E 6F ...hYn.....2...o
    0010: 40 5C 4D 7B @\M.
    ]

    ]

    [3]: ObjectId: 2.5.29.32 Criticality=3Dfalse
    CertificatePolicies [
    [CertificatePolicyId: [1.3.6.1.4.1.2706.1.2.123.1.1]
    [PolicyQualifierInfo: [
    qualifierID: 1.3.6.1.5.5.7.2.2
    qualifier: 0000: 30 47 1A 45 54 68 69 73 20 63 65 72 74 69 66 69 0G.ET=
    his c
    ertifi
    0010: 63 61 74 65 20 6F 6E 6C 79 20 6D 61 79 20 62 65 cate only may be
    0020: 20 75 73 65 64 20 66 6F 72 20 64 65 6D 6F 6E 73 used for demons
    0030: 74 72 61 74 69 6F 6E 20 61 6E 64 20 74 65 73 74 tration and test
    0040: 20 70 75 72 70 6F 73 65 73 purposes

    ]] ]
    ]

    [4]: ObjectId: 2.5.29.15 Criticality=3Dtrue
    KeyUsage [
    Key_CertSign
    Crl_Sign
    ]

    [5]: ObjectId: 2.5.29.19 Criticality=3Dtrue
    BasicConstraints:[
    CA:true
    PathLen:2147483647
    ]

    ]
    Algorithm: [SHA1withRSA]
    Signature:
    0000: A6 46 A7 40 92 7B F0 79 0B 13 25 3B 1F A8 3B 0C .F.@...y..%;..;.
    0010: 9F CE 0D C1 E7 97 DC D0 2A 88 24 F6 49 93 03 66 ........*.$.I..f
    0020: 5B 23 47 66 80 A0 55 CF 38 E8 E0 3A 4E 75 CE 1D [#Gf..U.8..:Nu..
    0030: A8 C1 65 06 FE 6E 41 E7 EB 6B 9D 5A 5C E8 87 11 ..e..nA..k.Z\...
    0040: 90 B0 7A EA EC 91 00 50 31 88 5E 71 4F C6 84 D6 ..z....P1.^qO...
    0050: D5 0F C7 FA A1 AE 1A FD 02 36 42 BE B3 DC 8A F5 .........6B.....
    0060: 59 A2 05 49 95 4A 9C DF 4C AF 0A C7 84 02 D8 45 Y..I.J..L......E
    0070: 55 9E E7 DD DA 9F A2 60 C5 D1 7E FC ED B7 5F AC U......`......_.
    0080: A6 B0 86 66 5B 1F 3D 80 93 B4 87 A3 A3 74 DB C5 ...f[.=3D......t..
    0090: EA 0E 56 03 D8 B4 32 87 80 B1 F4 B6 2D DA 04 44 ..V...2.....-..D
    00A0: FB D7 C7 05 57 97 66 7D E7 41 FC F5 C7 EE 0C DD ....W.f..A......
    00B0: A6 23 64 07 F3 74 2A 4C 83 B4 85 CF 69 70 AE FB .#d..t*L....ip..
    00C0: 27 C2 D5 15 10 76 36 71 B3 F4 41 16 5E 7D 1C 78 '....v6q..A.^..x
    00D0: 9B AD 1C E8 46 76 28 74 D7 84 CD E0 85 1B FE F5 ....Fv(t........
    00E0: 55 03 D5 27 E9 E3 B2 A2 94 20 CD 56 C6 DC 87 72 U..'..... .V...r
    00F0: 8D 40 AF CF D9 81 8C 39 A3 BA 59 AB EA D1 4C F9 .@.....9..Y...L.

    ]>
    <12.07.2005 14:45 Uhr CEST> <Debug> <TLS> <000000> <Trusted CA: [
    [
    Version: V3
    Subject: CN=3DCertGenCAB, OU=3DFOR TESTING ONLY, O=3DMyOrganization, L=3D=
    MyTown, ST=3DMy
    State, C=3DUS
    Signature Algorithm: MD5withRSA, OID =3D 1.2.840.113549.1.1.4

    Key: RSA public key (512 bits):
    public exponent: 10001
    modulus: afa4814a734e02099c2f2b92d8d442c614cb75fd2493fc399a248743e6d8a1f76c=
    e2b8f
    42348fc498216cd6fd86cb6b0e7d654fd873d8eee4c42356258b7b25b

    Validity: [From: Thu Oct 24 17:54:45 CEST 2002,
    To: Tue Oct 25 17:54:45 CEST 2022]
    Issuer: CN=3DCertGenCAB, OU=3DFOR TESTING ONLY, O=3DMyOrganization, L=3DM=
    yTown, ST=3DMyS
    tate, C=3DUS
    SerialNumber: [ 234b5559 d1fa0f3f f5c82bdf ed032a87]

    Certificate Extensions: 2
    [1]: ObjectId: 2.5.29.15 Criticality=3Dtrue
    KeyUsage [
    Key_CertSign
    ]

    [2]: ObjectId: 2.5.29.19 Criticality=3Dtrue
    BasicConstraints:[
    CA:true
    PathLen:1
    ]

    ]
    Algorithm: [MD5withRSA]
    Signature:
    0000: 42 38 2B 10 F5 05 AF 1A F0 22 92 30 41 3A 3A D3 B8+......".0A::.
    0010: 16 A6 41 34 96 09 B2 FE 7E 99 56 7D D2 95 70 9B ..A4......V...p.
    0020: 31 03 8A 1C 3C 75 B2 37 B9 B3 18 CF 9B 1A 5E 42 1...<u.7......^B
    0030: 92 CB 7A DC 4A F2 4A F6 76 49 90 7B DB F3 C8 59 ..z.J.J.vI.....Y

    ]>
    <12.07.2005 14:45 Uhr CEST> <Error> <WebLogicServer> <BEA-000297> <Inconsis=
    tent
    security configuration, java.lang.ArrayStoreException>
    <12.07.2005 14:45 Uhr CEST> <Debug> <TLS> <000000> <SSLListenThread: incons=
    isten
    t configuration
    java.lang.ArrayStoreException
    at com.certicom.tls.interfaceimpl.CertificateSupport.addAuthChain(U=
    nknow
    n Source)
    at com.certicom.net.ssl.SSLContext.addAuthChain(Unknown Source)
    at com.bea.sslplus.CerticomSSLContext.addIdentity(Unknown Source)
    at weblogic.security.utils.SSLContextWrapper.addIdentity(SSLContext=
    Wrapp
    er.java:87)
    at weblogic.t3.srvr.SSLListenThread.initSSLContext(SSLListenThread.=
    java:
    181)
    at weblogic.t3.srvr.SSLListenThread.<init>(SSLListenThread.java:140=
    )
    at weblogic.t3.srvr.SSLListenThread.<init>(SSLListenThread.java:126=
    )
    at weblogic.t3.srvr.T3Srvr.initializeListenThreads(T3Srvr.java:1637=
    )
    at weblogic.t3.srvr.T3Srvr.resume(T3Srvr.java:1009)
    at weblogic.t3.srvr.T3Srvr.run(T3Srvr.java:361)
    at weblogic.Server.main(Server.java:32)
    >

    <12.07.2005 14:45 Uhr CEST> <Emergency> <Security> <BEA-090034> <Not listen=
    ing f
    or SSL, java.io.IOException: Inconsistent security configuration, null.>
    <12.07.2005 14:45 Uhr CEST> <Notice> <WebLogicServer> <BEA-000331> <Started=
    WebL
    ogic Admin Server "examplesServer" for domain "examples" running in Develop=
    ment
    Mode>
    <12.07.2005 14:45 Uhr CEST> <Notice> <WebLogicServer> <BEA-000360> <Server =
    start
    ed in RUNNING mode>
    <12.07.2005 14:45 Uhr CEST> <Notice> <WebLogicServer> <BEA-000355> <Thread =
    "List
    enThread.Default" listening on port 7001, ip address *.*>

  2. Default Re: SSL, custom identity keystore, ArrayStoreException

    Hi,
    I am also facing the same issue securing web-logic server with pkcs#11 hardware module.
    SSL Debug messages are as follows:
    <Jul 12, 2010 11:55:31 AM IST> <Warning> <Security> <BEA-090482> <BAD_CERTIFICATE alert was received from noi1-501414.sfnt.local - 172.25.13
    .153. Check the peer to determine why it rejected the certificate chain (trusted CA configuration, hostname verification). SSL debug tracing
    may be required to determine the exact reason the certificate was rejected.>
    <Jul 12, 2010 11:55:31 AM IST> <Debug> <SecuritySSL> <BEA-000000> <close(): 13101625>
    <Jul 12, 2010 11:55:31 AM IST> <Debug> <SecuritySSL> <BEA-000000> <close(): 13101625>
    <Jul 12, 2010 11:55:31 AM IST> <Debug> <SecuritySSL> <BEA-000000> <SSLIOContextTable.removeContext(ctx): 13102103>
    <Jul 12, 2010 11:55:36 AM IST> <Debug> <SecuritySSL> <BEA-000000> <Filtering JSSE SSLSocket>
    <Jul 12, 2010 11:55:36 AM IST> <Debug> <SecuritySSL> <BEA-000000> <SSLIOContextTable.addContext(ctx): 13105497>
    <Jul 12, 2010 11:55:36 AM IST> <Debug> <SecuritySSL> <BEA-000000> <SSLSocket will be Muxing>
    <Jul 12, 2010 11:55:36 AM IST> <Debug> <SecuritySSL> <BEA-000000> <isMuxerActivated: false>
    <Jul 12, 2010 11:55:36 AM IST> <Debug> <SecuritySSL> <BEA-000000> <13105028 SSL3/TLS MAC>
    <Jul 12, 2010 11:55:36 AM IST> <Debug> <SecuritySSL> <BEA-000000> <13105028 received HANDSHAKE>
    <Jul 12, 2010 11:55:36 AM IST> <Debug> <SecuritySSL> <BEA-000000> <HANDSHAKEMESSAGE: ClientHello>
    <Jul 12, 2010 11:55:36 AM IST> <Debug> <SecuritySSL> <BEA-000000> <write HANDSHAKE, offset = 0, length = 58>
    <Jul 12, 2010 11:55:36 AM IST> <Debug> <SecuritySSL> <BEA-000000> <write HANDSHAKE, offset = 0, length = 585>
    <Jul 12, 2010 11:55:36 AM IST> <Debug> <SecuritySSL> <BEA-000000> <write HANDSHAKE, offset = 0, length = 4>
    <Jul 12, 2010 11:55:36 AM IST> <Debug> <SecuritySSL> <BEA-000000> <isMuxerActivated: false>
    <Jul 12, 2010 11:55:36 AM IST> <Debug> <SecuritySSL> <BEA-000000> <13105028 SSL3/TLS MAC>
    <Jul 12, 2010 11:55:36 AM IST> <Debug> <SecuritySSL> <BEA-000000> <13105028 received HANDSHAKE>
    <Jul 12, 2010 11:55:36 AM IST> <Debug> <SecuritySSL> <BEA-000000> <HANDSHAKEMESSAGE: ClientKeyExchange RSA>
    <Jul 12, 2010 11:55:36 AM IST> <Debug> <SecuritySSL> <BEA-000000> <Will use default Cipher for algorithm RSA/ECB/PKCS1Padding>
    <Jul 12, 2010 11:55:36 AM IST> <Debug> <SecuritySSL> <BEA-000000> <Exception during handshake, stack trace follows
    java.lang.IllegalStateException: Could not read BER data.(AlgorithmID.findAlgID: Could not find the OID)
    at com.certicom.tls.provider.spec.JSAFE_RSAPrivateKey.<init>(Unknown Source)
    at com.certicom.tls.provider.cipher.JSAFE_RSA.init(Unknown Source)
    at com.certicom.tls.record.handshake.ServerStateSentHelloDone.handle(Unknown Source)
    at com.certicom.tls.record.handshake.HandshakeHandler.handleHandshakeMessage(Unknown Source)
    at com.certicom.tls.record.handshake.HandshakeHandler.handleHandshakeMessages(Unknown Source)
    at com.certicom.tls.record.MessageInterpreter.interpretContent(Unknown Source)
    at com.certicom.tls.record.MessageInterpreter.decryptMessage(Unknown Source)
    at com.certicom.tls.record.ReadHandler.processRecord(Unknown Source)
    at com.certicom.tls.record.ReadHandler.readRecord(Unknown Source)
    at com.certicom.tls.record.ReadHandler.readUntilHandshakeComplete(Unknown Source)
    at com.certicom.tls.interfaceimpl.TLSConnectionImpl.completeHandshake(Unknown Source)
    at javax.net.ssl.impl.SSLSocketImpl.startHandshake(Unknown Source)
    at weblogic.server.channels.DynamicSSLListenThread$1.run(DynamicSSLListenThread.java:130)
    at weblogic.work.ExecuteThread.execute(ExecuteThread.java:201)
    at weblogic.work.ExecuteThread.run(ExecuteThread.java:173)


    Any help will be appreciated.....

+ Reply to Thread