3

I'm attempting to make a service call to salesforce.com. I've added the certificate chain to my keystore but when the service verifies the domain certificate it gets hung up on the wild card for the sub domain part of the CN but this is the cert that I have taken directly from the site. I've found that WebLogic doesn't support wildcards in the certificate CN. Is it possible to modify the CN without invalidating the cert.

The error when I test the service from within WebLogic OSB is:

The invocation resulted in an error: [Security:090504]Certificate chain received from sensis-proxy-vs.sensis.com.au - 161.117.32.128 --> cs5.salesforce.com failed hostname verification check. Certificate contained *.salesforce.com but check expected cs5.salesforce.com.

4 Answers 4

6

The problem here is that the default hostname verifier for WebLogic doesn't support SSL certificates where the CN contains a wildcard for the hostname.

It is possible to change WebLogic's hostname verifier, and WebLogic ships with a class that can verify CNs with wildcards.

  1. Go to the WebLogic admin console -> Environment -> Servers -> your server -> Configuration -> SSL

  2. Click "Lock & Edit"

  3. Open the "Advanced" flap

  4. Change "Hostname Verification" from "BEA Hostname Verifier" to "Custom Hostname Verifier"

  5. Set "Custom Hostname Verifier" to weblogic.security.utils.SSLWLSWildcardHostnameVerifier

  6. Click "Save" and then "Activate Changes"

  7. Restart your server.

2

Friend are you looking for to debug SSL issues with weblogic server?

Error:

FINE: ……….. Eating Exception ……….
java.security.NoSuchAlgorithmException: Algorithm ECDH not available
+ at javax.crypto.KeyAgreement.getInstance(DashoA13*..)+

Reason:

This is something like both the Client and the Server is not able to negotiate on a common Cipher (Algorithm) and hence the handshake is failing.

Just to give you a brief idea: the Cipher is initialized by the Client end and Sever has to choose any one of the Ciphers presented by the Client to communicate on SSL. If the Server does not supports any such Cipher algorithm which is common to Client then the communication will not happen.

So, If can force the Client (Weblogic) to use the weaker ciphers and the Server does not have any constraints on using the limited ciphers then we can make the connection over SSL.

Resolution:

As by default Weblogic Server uses the certicom implementation of SSL.

The above exception is because the certicom implementation of SSL is not able get a common cipher negotiation.

We can tell Weblogic server to use the SUN implementation of SSL to solve the issue.

In order to use the SUN implementation of SSL we can use the following properties in the Weblogic server:

  • Djavax.net.ssl.keyStore
  • Djavax.net.ssl.keyStoreType
  • Djavax.net.ssl.keyStorePassword
  • Djavax.net.ssl.trustStore
  • Djavax.net.ssl.trustStoreType
  • Djavax.net.ssl.trustStorePassword
  • Djava.protocol.handler.pkgs=com.sun.net.ssl.internal.www.protocol

all the above properties can be used as JAVA properties so that the WLS JVM uses these values rather than using its own implementation.

We can also use the above properties in our code as mentioned below:

System.setProperty( “javax.net.ssl.keyStore”, “***” );
System.setProperty( “javax.net.ssl.keyStoreType”, “JKS” );
System.setProperty( “javax.net.ssl.keyStorePassword”, “***” );
System.setProperty( “javax.net.ssl.trustStore”, “***” );
System.setProperty( “javax.net.ssl.trustStoreType”, “JKS” );
System.setProperty( “javax.net.ssl.trustStorePassword”, “***” );
Security.addProvider( new com.sun.net.ssl.internal.ssl.Provider() );
System.setProperty( “java.protocol.handler.pkgs”, “com.sun.net.ssl.internal.www.protocol” );

NOTE - Also for SSL runtime debug, you can use the Admin Console . For server log on to Admin Console >>>> Servers >>> MS1 >>> debug >>>> weblogic tree >>>> ssl option . Check the option and click enable.

1

Go to the WebLogic admin console -> Environment -> Servers -> your server -> Configuration -> SSL

Open the "Advanced" flap

Change "Hostname Verification" from "BEA Hostname Verifier" to "None"

Click "Save"

Restart your server.

0

In alternatively we can work like below.

Above Answer # setting "Set "Custom Hostname Verifier" to weblogic.security.utils.SSLWLSWildcardHostnameVerifier" did not work for me.

I have done following steps it has worked for me:

Go to the

WebLogic admin console -> Environment -> Servers -> your server -> Configuration -> SSL

  • Click "Lock & Edit"

    • Open the "Advanced" flap

    • Change "Hostname Verification" from "BEA Hostname Verifier" to "None"

    • Click "Save" and then "Activate Changes"

    • Restart your server.

And the Client application which connect to this SSL Enabled environment i have run java with following -D option :

-Dweblogic.security.SSL.ignoreHostnameVerification=true

Now I am able to connect from client application to SSL enabled environment Internally my client need to work with t3s (SSL) enabled JMS in the Weblogic server. It solved the below exception which i was getting in my client application:

javax.naming.CommunicationException: t3s://slc09kty.MYHost.com:7202: Destination 10.XX.XX.164, 7202 unreachable; nested exception is:
        javax.net.ssl.SSLKeyException: Hostname verification failed:

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .