<2011-7-12 下午05时35分12秒 CST> <Warning> <Security> <BEA-090477> <Certificate chain received from localhost - 127.0.0.1 was not trusted causing SSL handshake failure.> <2011-7-12 下午05时35分12秒 CST> <Warning> <Security> <BEA-090482> <BAD_CERTIFICATE alert was received from gang-office-laptop - 127.0.0.1. Check the peer to determine why it rejected the certificate chain (trusted CA configuration, hostname verification).
<2011-7-12 下午05时35分12秒 CST> <Warning> <Security> <BEA-090477> <Certificate chain received from localhost - 127.0.0.1 was not trusted causing SSL handshake failure.> <2011-7-12 下午05时35分12秒 CST> <Warning> <Security> <BEA-090482> <BAD_CERTIFICATE alert was received from gang-office-laptop - 127.0.0.1. Check the peer to determine why it rejected the certificate chain (trusted CA configuration, hostname verification). SSL debug tracing may be required to determine the exact reason the certificate was rejected.> com.sun.jersey.api.client.ClientHandlerException: javax.net.ssl.SSLKeyException: [Security:090477]Certificate chain received from localhost - 127.0.0.1 was not trusted causing SSL handshake failure. at com.sun.jersey.client.urlconnection.URLConnectionClientHandler.handle(URLConnectionClientHandler.java:131) at com.sun.jersey.api.client.Client.handle(Client.java:616) at com.sun.jersey.api.client.WebResource.handle(WebResource.java:559) at com.sun.jersey.api.client.WebResource.access$200(WebResource.java:72) at com.sun.jersey.api.client.WebResource$Builder.get(WebResource.java:454) at com.oracle.tis.mcsp.RemoteIncidentTicketRepository.findUnSynchronized(RemoteIncidentTicketRepository.java:103) at com.oracle.tis.mcsp.IncidentTicketProducer.produce(IncidentTicketProducer.java:43) at com.oracle.tis.kaiser.McspIncidentTicketProducer.produce(McspIncidentTicketProducer.java:20) at com.oracle.tis.AbstractSynchronizer.synchronize(AbstractSynchronizer.java:24) at com.oracle.tis.job.SynchronizerQuartzJobBean.executeInternal(SynchronizerQuartzJobBean.java:30) at org.springframework.scheduling.quartz.QuartzJobBean.execute(QuartzJobBean.java:86) at org.quartz.core.JobRunShell.run(JobRunShell.java:216) at org.quartz.simpl.SimpleThreadPool$WorkerThread.run(SimpleThreadPool.java:549)
## wls = Weblogic sever # 1. Create the wls identity keystore (In portal server) cd wldomains/itsp_domain/config # where the weblogic domain config file is. $JAVA_HOME/bin/keytool -genkey -alias wls-identity -keyalg RSA -keypass changeit -storepass changeit -keystore wls_identity.jks -dname "CN=itsp, OU=Engineering, O=SUN, L=Reston, ST=VA, C=US"
# 2. Import the wls identity to the wls truststore (In portal server) cd wldomains/itsp_domain/config # where the weblogic domain config file is. $JAVA_HOME/bin/keytool -export -alias wls-identity -storepass changeit -file wls.cer -keystore wls_identity.jks $JAVA_HOME/bin/keytool -import -v -trustcacerts -alias wls-identity -file wls.cer -keystore wls_truststore.jks -keypass changeit -storepass changeit
# 3. Create the Kaiser-adapter identity keystore (In TIS-adapter server) cd certificate/v3/kaiser # where the keystore files of the adapter are placed. $JAVA_HOME/bin/keytool -genkey -alias kaiser-identity -keyalg RSA -keypass changeit -storepass changeit -keystore kaiser_identity.jks -dname "CN=kp.org, OU=Engineering, O=SUN, L=Reston, ST=VA, C=US"
# 4. Import the Kaiser-adapter's identity into Weblogic trust keystore # 4.1 Export the Kaiser-adapter identity to a cer file (In TIS-adapter server) cd certificate/v3/kaiser # where the keystore files of the adapter are placed. $JAVA_HOME/bin/keytool -export -alias kaiser-identity -storepass changeit -file kaiser.cer -keystore kaiser_identity.jks
# 4.2 Import the Kaiser-adapter identity from the cer file to the wls truststore (In portal server) # First, please copy the kaiser.cer file got in the previous step into the following directory.
cd wldomains/itsp_domain/config # where the weblogic domain config file is. $JAVA_HOME/bin/keytool -import -v -trustcacerts -alias kaiser-identity -file kaiser.cer -keystore wls_truststore.jks -keypass changeit -storepass changeit
# 5. Import wls's identity into Kaiser-adapter trust keystore # 5.1 Export the wls's identity to a cer file (In portal server) cd wldomains/itsp_domain/config # where the weblogic domain config file is. $JAVA_HOME/bin/keytool -export -alias wls-identity -storepass changeit -file wls.cer -keystore wls_identity.jks
#5.2 Import the wls's identity from the cer file to the Kaiser-adapter truststore (In TIS-adatper server) # First, please copy the wls.cer file got in the previous step into the following directory. cd certificate/v3/kaiser # where the keystore files of the adapter are placed. $JAVA_HOME/bin/keytool -import -v -trustcacerts -alias wls-identity -file wls.cer -keystore kaiser_truststore.jks -keypass changeit -storepass changeit
# After the steps above, in the portal server directory "wldomains/itsp_domain/config" there should be the following 2 files: wls_identity.jks (has the following key: wls-identity) wls_truststore.jks(has the following keys: wls-identity, kaiser-identity)
# In the Kaiser TIS adapter server directory "certificate/v3/kaiser" there should be the following 2 files: kaiser_identity.jks(has the following key: kaiser-identity) kaiser_truststore.jks(has the following key: wls-identity)
# 6. Configure Weblogic keystores # Login weblogic console, go to "Environment -> Servers -> some_server -> tab 'Keystores' ", set: # Keystores: Custom Identity and Custom Trust (select this item by clicking "change" button to see the candidate options); # Custom Identity Keystore: /xxx/xxx/wls_identity.jks (Full path of where the "wls_identity.jks" file is); # Custom Identity Keystore Type: jks # Custom Identity Keystore Passphrase: changeit (the keystore password)