+

Search Tips   |   Advanced Search

SSL errors for security


We might encounter various problems after configuring or enabling SSL. You may not be able to stop the dmgr after configuring the SSL. You may not be able to access resource using HTTPS. The client and the server may not be able to negotiate the proper level of security. The problems mentioned here are only a few of the possibilities. Solving these problems is imperative to the successful operation of WAS.

What type of problem are you having?

 

Stopping the dmgr after configuring SSL

After configuring the SSL repertoires, if we stop the dmgr without also stopping the node agents, we might receive the following error message when you restart the deployment manager: 

CWWMU0509I: The server "nodeagent" cannot be reached. It appears to be stopped. CWWMU0211I: Error details may be seen in the file:
           /opt/WebSphere/AppServer/logs/nodeagent/stopServer.log

The error occurs because the dmgr did not propagate the new SSL certificate to the node agents. The node agents are using an older certificate file than the dmgr and the certificate files are incompatible. To work around this problem, manually stop the node agent and dmgr processes.

(Windows) To end the processes, use the Task Manager.

(UNIX) Run the command to end the process

we need to consider certain items when identifying the specific process to stop. For each process that is stopped, WAS stores the process ID in a pid file and we need to find these *.pid files.

For example, the server1.pid for a stand-alone install action might be found at: install_root/logs/server1.pid

 

Accessing resources using HTTPS

If unable to access resources using an SSL URL (beginning with https:), or encounter error messages that indicate SSL problems, verify that the HTTP server is configured correctly for SSL. Browse the welcome page of the HTTP server using SSL by entering the URL: https: //host_name. If the page works with HTTP, but not HTTPS, the problem is with the HTTP server.

If the HTTP server handles SSL-encrypted requests successfully, or is not involved (for example, traffic flows from a Java client application directly to an enterprise bean that is hosted by WAS, or the problem displays only after enabling WebSphere Application WAS security), what kind of error are you seeing?

You get this error message org.omg.CORBA.INTERNAL: EntryNotFoundException or NTRegistryImp E CWSCJ0070E: No privilege id configured for: when programmatically creating a credential

For general tips on diagnosing and resolving security-related problems, see Security components troubleshooting tips

If we do not see a problem that resembles thes, or if the information provided does not solve the problem, see Troubleshooting help from IBM

 

javax.net.ssl.SSLHandshakeException - The client and server could not negotiate the desired level of security. Reason: handshake failure

If we see a Java exception stack similar to the following example: 

[Root exception is org.omg.CORBA.TRANSIENT:  CAUGHT_EXCEPTION_WHILE_CONFIGURING_ SSL_CLIENT_SOCKET: CWWJE0080E:   javax.net.ssl.SSLHandshakeException - The client and server could not negotiate the desired level of   security. Reason: handshake  failure:host=MYSERVER,port=1079 minor code: 4942F303 completed: No]   at  com.ibm.CORBA.transport.TransportConnectionBase.connect  (TransportConnectionBase.java:NNN)

Some possible causes are:

To correct these problems:

  1. Review the SSL settings. In the admin console, click Security > SSL certificate and key management. Under Configuration settings, click Manage endpoint security configurations > endpoint_configuration_name. Under Related items, click SSL configurations > SSL_configuration_name. We can also browse the file manually by viewing the install_root/properties/sas.client.props file.

  2. Check the property specified by the com.ibm.ssl.protocol file to determine which protocol is specified.

  3. Check the cipher types specified by the com.ibm.ssl.enabledCipherSuites interface. We might want to add more cipher types to the list. To see which cipher suites are currently enabled, click Quality of protection settings (QoP), and look for the Cipher Suites property.

  4. Correct the protocol or cipher problem by using a different client or server protocol and cipher selection. Typical protocols are SSL or SSLv3.

  5. Make the cipher selection 40-bit instead of 128-bit. For Common Secure Interoperability Version 2 (CSIv2), set both of the following properties to false in sas.client.props, or set security level=medium in the admin console settings:

    • com.ibm.CSI.performMessageConfidentialityRequired=false

    • com.ibm.CSI.performMessageConfidentialitySupported=false

 

javax.net.ssl.SSLHandshakeException: unknown certificate

If we see a Java exception stack similar to the following example, it might be caused by not having the personal certificate for the server in the client truststore file: 

ERROR: Could not get the initial context or unable to look up the starting context.  Exiting.  Exception received: javax.naming.ServiceUnavailableException: A  communication failure occurred while attempting to obtain an initial context using  the provider url: "corbaloc:iiop:localhost:2809". Make sure that the host and port  information is correct and that the server identified by the provider url is a  running name server. If no port number is specified, the default port number 2809  is used. Other possible causes include the network environment or workstation  network configuration. [Root exception is org.omg.CORBA.TRANSIENT:  CAUGHT_EXCEPTION_WHILE_CONFIGURING_SSL_CLIENT_SOCKET: CWWJE0080E:  javax.net.ssl.SSLHandshakeException - The client and server could not  negotiate the desired level of security. Reason: unknown  certificate:host=MYSERVER,port=1940 minor code: 4942F303 completed: No]

To correct this problem:

  1. Check the client truststore file to determine if the signer certificate from the server personal certificate is there. For a self-signed server personal certificate, the signer certificate is the public key of the personal certificate. For a certificate authority (CA)-signed server personal certificate, the signer certificate is the root CA certificate of the CA that signed the personal certificate.

  2. Add the server signer certificate to the client truststore file.

 

javax.net.ssl.SSLHandshakeException: bad certificate

A Java exception stack error might display if the following situations occur:

The following message is an example of the Java exception stack error: 

ERROR: Could not get the initial context or unable to look  up the starting context. Exiting.   Exception received: javax.naming.ServiceUnavailableException:  A communication failure occurred while attempting to obtain an  initial context using the provider url: "corbaloc:iiop:localhost:2809".  Make sure that the host and port information is correct and that the server identified by the provider url is a running name  server. If no port number is specified, the default port number 2809  is used. Other possible causes include the network environment or  workstation network configuration. 
[Root exception is org.omg.CORBA.TRANSIENT: CAUGHT_EXCEPTION_WHILE_CONFIGURING_SSL_ CLIENT_SOCKET: CWWJE0080E: javax.net.ssl.SSLHandshakeException - The client and  server could not negotiate the desired level of security. Reason:  bad certificate: host=MYSERVER,port=1940 minor code: 4942F303 completed: No]

To verify this problem, check the server truststore file to determine if the signer certificate from the client personal certificate is there. For a self-signed client personal certificate, the signer certificate is the public key of the personal certificate. For a certificate authority-signed client personal certificate, the signer certificate is the root CA certificate of the CA that signed the personal certificate.

To correct this problem, add the client signer certificate to the server truststore file.

 

org.omg.CORBA.INTERNAL: EntryNotFoundException or NTRegistryImp E CWSCJ0070E: No privilege id configured for: error when programmatically creating a credential

If we encounter the following exception in a client application attempting to request a credential from a WAS using SSL mutual authentication: 

ERROR: Could not get the initial context or unable to look up the starting context.  Exiting. Exception received: org.omg.CORBA.INTERNAL: Trace from server: 1198777258  at host MYHOST on port 0 >>org.omg.CORBA.INTERNAL: EntryNotFoundException minor  code: 494210B0 completed:  No at com.ibm.ISecurityLocalObjectBaseL13Impl.PrincipalAuthFailReason. map_auth_fail_to_minor_code(PrincipalAuthFailReason.java:99)
or a simultaneous error from the WAS that resembles: 

[7/31/02 15:38:48:452 CDT] 27318f5 NTRegistryImp E CWSCJ0070E: No privilege id  configured for: testuser

The cause might be that the user ID sent by the client to the server is not in the user registry for that server.

To confirm this problem, check that an entry exists for the personal certificate that is sent to the server. Depending on the user registry mechanism, look at the native operating system user ID or LDAP server entries.

To correct this problem, add the user ID to the user registry entry (for example, operating system, LDAP directory, or other custom registry) for the personal certificate identity.

 

"Catalog" tablet is blank (no item displayed) in GUI application client

This error message occurs when you install an ActiveX client sample application that uses the PlantsByWebSphere Active X to EJB Bridge.

The cause is that the server certificate is not in the client trustore specified in the client.ssl.props file. Although the "com.ibm.ssl.enableSignerExchangePrompt" signer property might be set to true, the auto-exchange prompt only supports a command-line prompt. If the sample application relies on a GUI and does not provide access to a command prompt, for example using standard in and standard out, the auto-exchange prompt does not function.

The applet client under the Client Technology Samples does not have access to the command prompt and it cannot see the auto-exchange prompt. Thus, the applet client cannot rely on the auto-exchange prompt feature.

To correct this problem, retrieve the certificate manually using the retrieveSigners utility.

 

Modify SSL Configurations after migration using -scriptCompatibility true

After migrating using scriptCompatibility true, all attributes of the SSL configurations cannot be edited through the admin console. In particular, the hardware cryptography settings cannot be displayed or edited.

By using the scriptCompatibility true flag, the SSL configurations are not migrated to the new format for support in the 6.1 release. New capabilities were added that are not supported when the configurations are not migrated to the latest format.

To solve this problem, create new SSL configuration definitions to replace those in the pre 6.1 format or continue to edit those configurations using scripting.

 

Stand-Alone configuration fails when digital certificates are defined with the NOTRUST option

If the digital certificates are defined with the NOTRUST option, it is possible that we might receive the following error message: 

Trace: 2008/06/18 16:57:57.798 01 t=8C50B8 c=UNK key=S2 (0000000A)  Description: Log Boss/390 Error  from filename: ./bbgcfcom.cpp  at line: 376  error message: BBOO0042E Function AsynchIOaccept failed with RV=-1, RC=124, RSN=050B0146, ?EDC5124I  Too many open files. (errno2=0x0594003D)??

If this error appears, enter 'D OMVS,P. If we have a NOTRUST issue a large number appears under 'OPNSOCK'.

Check the digital certificates and make sure they are not marked with the NOTRUST option.

This can occur if the certificates were created with a date beyond the expiration date of the CERTAUTH that was used to create it.


 

Related concepts


welc6toptroubleshooting.html

 

Related tasks


Retrieving signers using the retrieveSigners utility at the client
Troubleshooting security configurations

 

Related


Application deployment troubleshooting tips