Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I'm attempting to make a service call to salesforce.com. I've added the certificate chain to my keystore but when the service verifies the domain certificate it gets hung up on the wild card for the sub domain part of the CN but this is the cert that I have taken directly from the site. I've found that WebLogic doesn't support wildcards in the certificate CN. Is it possible to modify the CN without invalidating the cert.

The error when I test the service from within WebLogic OSB is:

The invocation resulted in an error: [Security:090504]Certificate chain received from sensis-proxy-vs.sensis.com.au - 161.117.32.128 --> cs5.salesforce.com failed hostname verification check. Certificate contained *.salesforce.com but check expected cs5.salesforce.com.

share|improve this question

2 Answers 2

The problem here is that the default hostname verifier for WebLogic doesn't support SSL certificates where the CN contains a wildcard for the hostname.

It is possible to change WebLogic's hostname verifier, and WebLogic ships with a class that can verify CNs with wildcards.

  1. Go to the WebLogic admin console -> Environment -> Servers -> your server -> Configuration -> SSL

  2. Click "Lock & Edit"

  3. Open the "Advanced" flap

  4. Change "Hostname Verification" from "BEA Hostname Verifier" to "Custom Hostname Verifier"

  5. Set "Custom Hostname Verifier" to weblogic.security.utils.SSLWLSWildcardHostnameVerifier

  6. Click "Save" and then "Activate Changes"

  7. Restart your server.

share|improve this answer

Friend are you looking for to debug SSL issues with weblogic server?

Error:

FINE: ……….. Eating Exception ……….
java.security.NoSuchAlgorithmException: Algorithm ECDH not available
+ at javax.crypto.KeyAgreement.getInstance(DashoA13*..)+

Reason:

This is something like both the Client and the Server is not able to negotiate on a common Cipher (Algorithm) and hence the handshake is failing.

Just to give you a brief idea: the Cipher is initialized by the Client end and Sever has to choose any one of the Ciphers presented by the Client to communicate on SSL. If the Server does not supports any such Cipher algorithm which is common to Client then the communication will not happen.

So, If can force the Client (Weblogic) to use the weaker ciphers and the Server does not have any constraints on using the limited ciphers then we can make the connection over SSL.

Resolution:

As by default Weblogic Server uses the certicom implementation of SSL.

The above exception is because the certicom implementation of SSL is not able get a common cipher negotiation.

We can tell Weblogic server to use the SUN implementation of SSL to solve the issue.

In order to use the SUN implementation of SSL we can use the following properties in the Weblogic server:

  • Djavax.net.ssl.keyStore
  • Djavax.net.ssl.keyStoreType
  • Djavax.net.ssl.keyStorePassword
  • Djavax.net.ssl.trustStore
  • Djavax.net.ssl.trustStoreType
  • Djavax.net.ssl.trustStorePassword
  • Djava.protocol.handler.pkgs=com.sun.net.ssl.internal.www.protocol

all the above properties can be used as JAVA properties so that the WLS JVM uses these values rather than using its own implementation.

We can also use the above properties in our code as mentioned below:

System.setProperty( “javax.net.ssl.keyStore”, “***” );
System.setProperty( “javax.net.ssl.keyStoreType”, “JKS” );
System.setProperty( “javax.net.ssl.keyStorePassword”, “***” );
System.setProperty( “javax.net.ssl.trustStore”, “***” );
System.setProperty( “javax.net.ssl.trustStoreType”, “JKS” );
System.setProperty( “javax.net.ssl.trustStorePassword”, “***” );
Security.addProvider( new com.sun.net.ssl.internal.ssl.Provider() );
System.setProperty( “java.protocol.handler.pkgs”, “com.sun.net.ssl.internal.www.protocol” );

NOTE - Also for SSL runtime debug, you can use the Admin Console . For server log on to Admin Console >>>> Servers >>> MS1 >>> debug >>>> weblogic tree >>>> ssl option . Check the option and click enable.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.