Question

我整天坐在问题上并放弃了。我写了一个泽西客户端在Jetty上工作，而在Weblogic上工作。原因可能隐藏在证书中：CN =“* .somecompany.com”。 Weblogic不喜欢CN中的通配符。有没有人有这方面的工作解决方案？

我将这些添加到Weblogic start params，但是Weblogic使用了很多其他客户端，所以我不想添加这些参数：ignoreHostnameVerification： -

-Dssl.debug=true -Dweblogic.security.SSL.ignoreHostnameVerification=true 
-Dweblogic.security.SSL.enforceConstraints=off 
-Dweblogic.nodemanager.sslHostNameVerificationEnabled=false
-Dweblogic.security.SSL.allowSmallRSAExponent=true
-Dweblogic.security.SSL.ignoreHostnameVerification=true

我还使用webbrowser访问了REST服务并将证书下载到磁盘，然后使用keytool将其添加到truststore。它仍然无法正常工作。

唯一最好的方法是编写一些自定义验证主机名的东西？也许这个通配符是一个问题..但我是新手，不知道如何写它，一个工作的例子将不胜感激，我将无法自己做： /

以下是我发现的例外情况（不确定哪些存在但何时仍然无效）我试图通过以下方式修复它：

1）将整个证书链导入信任库（Java和Weblogic信任库）

2）将起始参数添加到Weblogic，但这不是一个好的解决方案

com.sun.jersey.api.client.ClientHandlerException: javax.net.ssl.SSLKeyException: FATAL 
Alert:BAD_CERTIFICATE - A corrupt or unuseable certificate was received.
com.sun.jersey.api.client.ClientHandlerException: 
javax.net.ssl.SSLKeyException: FATAL Alert:BAD_CERTIFICATE - A corrupt 
or unuseable certificate was received.
         at 
    com.sun.jersey.client.urlconnection.URLConnectionClientHandler.handle(URLConnectionClientHa    ndler.java:131)
         at com.sun.jersey.api.client.Client.handle(Client.java:629)
     at 
com.sun.jersey.api.client.WebResource.handle(WebResource.java:601)
     at 
com.sun.jersey.api.client.WebResource.access$200(WebResource.java:74)
     at 
com.sun.jersey.api.client.WebResource$Builder.post(WebResource.java:507)
     at

第二

with Severity: FATAL, Type: 42
java.lang.Exception: New alert stack
    at com.certicom.tls.record.alert.Alert.<init>(Unknown Source)
    at         com.certicom.tls.record.handshake.HandshakeHandler.handleHandshakeMessages(Unknown Source)
    at com.certicom.tls.record.MessageInterpreter.interpretContent(Unknown Source)
    at com.certicom.tls.record.MessageInterpreter.decryptMessage(Unknown Source)
    at com.certicom.tls.record.ReadHandler.processRecord(Unknown Source)
    at com.certicom.tls.record.ReadHandler.readRecord(Unknown Source)
    at com.certicom.tls.record.ReadHandler.readUntilHandshakeComplete(Unknown Source)
    at com.certicom.tls.interfaceimpl.TLSConnectionImpl.completeHandshake(Unknown     Source)
    at com.certicom.tls.record.WriteHandler.write(Unknown Source)
    at com.certicom.io.OutputSSLIOStreamWrapper.write(Unknown Source)
    at java.io.BufferedOutputStream.flushBuffer(BufferedOutputStream.java:82)
    at java.io.BufferedOutputStream.flush(BufferedOutputStream.java:140)
    at java.io.FilterOutputStream.flush(FilterOutputStream.java:140)
    at weblogic.net.http.HttpURLConnection.writeRequests(HttpURLConnection.java:154)
    at weblogic.net.http.HttpURLConnection.getInputStream(HttpURLConnection.java:358)
    at     weblogic.net.http.SOAPHttpsURLConnection.getInputStream(SOAPHttpsURLConnection.java:37)
    at weblogic.net.http.HttpURLConnection.getHeaderField(HttpURLConnection.java:702)
    at weblogic.net.http.HttpURLConnection.getResponseCode(HttpURLConnection.java:962)
    at      com.sun.jersey.client.urlconnection.URLConnectionClientHandler._invoke(URLConnectionClientHandler.java:217)
    at     com.sun.jersey.client.urlconnection.URLConnectionClientHandler.handle(URLConnectionClientHandler.java:129)
    at com.sun.jersey.api.client.Client.handle(Client.java:629)
    at com.sun.jersey.api.client.WebResource.handle(WebResource.java:601)
    at com.sun.jersey.api.client.WebResource.access$200(WebResource.java:74)
    at com.sun.jersey.api.client.WebResource$Builder.post(WebResource.java:507)
    at

THIRD

 E7C0E2529308F> <> <1387573464164> <BEA-000000> <Failure loading trusted CA list
java.security.cert.CertificateParsingException: Could not set value for ASN.1     string     object.
    at com.certicom.security.cert.internal.x509.X509V3CertImpl.<init>(Unknown Source)
    at com.certicom.tls.interfaceimpl.CertificateSupport.addTrustedCertificate(Unknown      Source)
    at com.certicom.net.ssl.SSLContext.addTrustedCertificate(Unknown Source)
    at com.bea.sslplus.CerticomSSLContext.addTrustedCA(Unknown Source)
    at weblogic.security.utils.SSLContextWrapper.addTrustedCA(SSLContextWrapper.java:62)
    at weblogic.security.utils.SSLSetup.getSSLContext(SSLSetup.java:320)
    at weblogic.net.http.HttpsClient.openServer(HttpsClient.java:334)
    at weblogic.net.http.HttpsClient.New(HttpsClient.java:566)
    at weblogic.net.http.HttpsURLConnection.getHttpClient(HttpsURLConnection.java:339)
    at weblogic.net.http.HttpURLConnection.getInputStream(HttpURLConnection.java:408)
    at weblogic.net.http.SOAPHttpsURLConnection.getInputStream(SOAPHttpsURLConnection.java:37)
    at weblogic.net.http.HttpURLConnection.getHeaderField(HttpURLConnection.java:702)
    at weblogic.net.http.HttpURLConnection.getResponseCode(HttpURLConnection.java:962)
    at com.sun.jersey.client.urlconnection.URLConnectionClientHandler._invoke(URLConnectionClientHandler.java:217)
    at com.sun.jersey.client.urlconnection.URLConnectionClientHandler.handle(URLConnectionClientHandler.java:129)
    at com.sun.jersey.api.client.Client.handle(Client.java:629)
    at com.sun.jersey.api.client.WebResource.handle(WebResource.java:601)
    at com.sun.jersey.api.client.WebResource.access$200(WebResource.java:74)
    at com.sun.jersey.api.client.WebResource$Builder.post(WebResource.java:507)
    at

Answer 1

尝试将网站证书添加到weblogic truststore，然后在weblogic startup中添加以下参数

-DUseSunHttpHandler=true
-Dssl.SocketFactory.provider=sun.security.ssl.SSLSocketFactoryImpl 
-Dssl.ServerSocketFactory.provider=sun.security.ssl.SSLSocketFactoryImpl

我有像你这样的问题，通过这篇文章，我解决了它 Cannot access HTTPS from Weblogic

Answer 2

通过在JVM参数中添加这些条目来修复问题

"-Dweblogic.security.SSL.nojce=true"
"-Dweblogic.ssl.JSSEEnabled=true"
"-Dweblogic.security.SSL.enableJSSE=true"

Jersey + Weblogic - javax.net.ssl.SSLKeyException：致命警报：BAD_CERTIFICATE

2 个答案: