IBM Liberty SSL 握手失败

Question

我正在使用 Liberty 16.0.0.4

我正在尝试调用 xxxx SOAP 服务，但出现以下错误

[ERROR ] CWPKI0022E: SSL HANDSHAKE FAILURE: A signer with SubjectDN CN=xxxx, was sent from the target host. The signer might need to be added to local trust store serverHome/resources/security/key.jks, located in SSL configuration alias defaultSSLConfig. The extended error message from the SSL handshake exception is: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

我使用了下一个命令来生成证书

openssl s_client -connect xxxxURL:443 | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > xxx.cert

然后使用下一个命令将其注入 liberty jks 默认文件

keytool -import -trustcacerts -alias xxxSigner -file xxx.cert -keystore *pathToHomeServer/resources/security/key.jks* -storepass Liberty -storetype jks

这也是我的 server.xml 相关标签

<featureManager>
    <feature>webProfile-7.0</feature>
    <feature>jaxb-2.2</feature>
    <feature>concurrent-1.0</feature>
    <feature>javaMail-1.5</feature>
    <feature>localConnector-1.0</feature>
    <feature>jaxws-2.2</feature>
    <feature>apiDiscovery-1.0</feature>
    <feature>ssl-1.0</feature>
</featureManager>

<keyStore id="defaultKeyStore" location="${server.config.dir}/resources/security/key.jks" password="{xor}EzY9Oi0rJg==" type="jks" />
<keyStore id="defaultTrustStore" location="${server.config.dir}/resources/security/key.jks" password="{xor}EzY9Oi0rJg==" type="jks" />

<sslDefault sslRef="defaultSSLConfig" />

<ssl id="defaultSSLConfig" keyStoreRef="defaultKeyStore" trustStoreRef="defaultTrustStore" sslProtocol="TLSv1.2"/>

<httpEndpoint id="defaultHttpEndpoint" httpPort="9080" httpsPort="9443">
    <sslOptions sslRef="defaultSSLConfig"></sslOptions>
</httpEndpoint>

所以我这边是什么问题

Answer 1

当您将 -showcerts 附加到您的 openssl 命令时，如果您明确添加签名者本身（显示在证书堆栈的底部），它是否有效？

Answer 2

不确定为什么您的方法不起作用，但另一种方法是使用浏览器检索证书，然后使用密钥工具添加它，如此处所述（参见 8/5/2015 评论文章底部）：developer.ibm.com/wasdev/docs/single-sign-google-liberty

IBM Liberty SSL 握手失败

IBM Liberty SSL HANDSHAKE FAILURE

ssl

web-services

websphere-liberty