Friend are you looking for to debug SSL issues with weblogic server?
Error:
FINE: ……….. Eating Exception ……….
java.security.NoSuchAlgorithmException: Algorithm ECDH not available
+ at javax.crypto.KeyAgreement.getInstance(DashoA13*..)+
Reason:
This is something like both the Client and the Server is not able to negotiate on a common Cipher (Algorithm) and hence the handshake is failing.
Just to give you a brief idea: the Cipher is initialized by the Client end and Sever has to choose any one of the Ciphers presented by the Client to communicate on SSL.
If the Server does not supports any such Cipher algorithm which is common to Client then the communication will not happen.
So, If can force the Client (Weblogic) to use the weaker ciphers and the Server does not have any constraints on using the limited ciphers then we can make the connection over SSL.
Resolution:
As by default Weblogic Server uses the certicom implementation of SSL.
The above exception is because the certicom implementation of SSL is not able get a common cipher negotiation.
We can tell Weblogic server to use the SUN implementation of SSL to solve the issue.
In order to use the SUN implementation of SSL we can use the following properties in the Weblogic server:
- Djavax.net.ssl.keyStore
- Djavax.net.ssl.keyStoreType
- Djavax.net.ssl.keyStorePassword
- Djavax.net.ssl.trustStore
- Djavax.net.ssl.trustStoreType
- Djavax.net.ssl.trustStorePassword
- Djava.protocol.handler.pkgs=com.sun.net.ssl.internal.www.protocol
all the above properties can be used as JAVA properties so that the WLS JVM uses these values rather than using its own implementation.
We can also use the above properties in our code as mentioned below:
System.setProperty( “javax.net.ssl.keyStore”, “***” );
System.setProperty( “javax.net.ssl.keyStoreType”, “JKS” );
System.setProperty( “javax.net.ssl.keyStorePassword”, “***” );
System.setProperty( “javax.net.ssl.trustStore”, “***” );
System.setProperty( “javax.net.ssl.trustStoreType”, “JKS” );
System.setProperty( “javax.net.ssl.trustStorePassword”, “***” );
Security.addProvider( new com.sun.net.ssl.internal.ssl.Provider() );
System.setProperty( “java.protocol.handler.pkgs”, “com.sun.net.ssl.internal.www.protocol” );
NOTE - Also for SSL runtime debug, you can use the Admin Console . For server log on to Admin Console >>>> Servers >>> MS1 >>> debug >>>> weblogic tree >>>> ssl option . Check the option and click enable.