Forum Discussion

Tim_Arp_112576's avatar
Tim_Arp_112576
Icon for Nimbostratus rankNimbostratus
Jul 29, 2004

IBM WebSphere 5.1 SOAP and Certs

I'm fairly new to Java, but that is the language of choice at my company. I have programmed in about every language execept Java. So I'm picking it up as I go, not too bad so far. Anyway I'm writing a Servlet based on the simple example of listing the Virtual Servers on a bigip. I'm using SOAP to connect. I'm getting an error on connecting that the cert is unknown. I have tried using the InstallCert class that Joe wrote. That doesn't seem to work, that is I run it and no other output (no news is good news, right?). Is there another way to either get the self-signed cert on the system or configure the code to ignore it like I would in the browser?

 

 

Error opening socket: javax.net.ssl.SSLHandshakeException: unknown certificate
dev
devops
iControl
v4
  • Tim_Arp_112576's avatar
    Tim_Arp_112576
    Icon for Nimbostratus rankNimbostratus
    Jul 29, 2004
    It's working now. I didn't end up change the keystore because that reference was correct. I deleted the keystore I was trying. Next, I used a tool from IBM called ikeyman. This created the keystore with some default verisign certs in it. Then I ran installCert. So far so good. Keyman -list showed the certs including the one I just added. (the wierd thing was when I ran keyman -list initially I did not get prompted for a password.) Ran my code and all is well.

     

     

    Thanks Joe! ....You probably haven't heard the last from me though. :wink:
  • Joe_Pruitt's avatar
    Joe_Pruitt
    Jul 29, 2004
    installCert.java will just suck the certificate out of a ssl site and place it in the user.home/.keystore file. This will place the file in the home directory of the account you are logged into.

     

     

    A way to verify that the keystore is created is to run the keytool -list command to list out the contents of the keystore. You should see the certificate from the target system in there.

     

     

    You can also test that the certificate is installed properly by running any of the soap java sample applications in the SDK.

     

     

    Most likely is that your problem is that the WebSpere runtime is not running under the same user context that you installed the certificate into.

     

     

    The easiest solution I can see would be to move the .keystore file to a common location that is accessible to the WebSphere runtime and then configure your code in there to point to the new location.

     

     

    So, let's say you create a directory /trustedstuff and put the file in there. Then in your code you need to specify the location of this keystore

     

     

    System.setProperty("javax.net.ssl.trustStore", "/trustedstuff/.keystore"); 
  
 ... 
 call.invoke(...); 
 ...

     

     

    Then the ssl runtime will know the correct location to look.

     

     

    Another debugging trick is to add the -Djavax.net.debug=ssl runtime argument to enable ssl level tracing. Not sure how this works from a non-console based app but it's worth a try if things still aren't working out.

     

     

    Let me know if this works for you or not.

     

     

    -Joe