无法使用Glassfish设置SSL

时间:2016-08-17 10:23:42

标签: java ssl https glassfish ssl-certificate

我尝试在Glassfish 4.1.1中安装SSL证书。

我做了以下事情:

keytool -importkeystore -srckeystore /home/user/domain.com.jks -destkeystore /opt/glassfish4/glassfish/domains/domain1/config/keystore.jks

keytool -import -trustcacerts -keystore keystore.jks -alias root -file root.crt
keytool -import -trustcacerts -keystore keystore.jks -alias intermediate1 -file 1_cross_Intermediate.crt
keytool -import -trustcacerts -keystore keystore.jks -alias intermediate2 -file 2_issuer_Intermediate.crt
keytool -import -trustcacerts -keystore keystore.jks -alias domain_com -file 3_user_domain.com.crt

然后我重命名了http-listener-2的SSL-reference来自' s1as'到' domain_com'在server-config上使用管理控制台。

通过管理控制台重新启动域,然后按“重新启动”#。

之后,我无法在https://domain.com:8181访问我的申请。错误:

  

ERR_CONNECTION_RESET

甚至无法使用

访问https://domain.com:4848的管理控制台
  

ERR_CONNECTION_CLOSED

我在哪里可以看到发生了什么以及如何正确配置SSL。

还有一句话:keystore的密码和glassfish的密码都是默认密码(changeit)并且相互匹配。我已经验证了。

你能提供一些在哪里寻找的线索吗?

提前谢谢!

更新:在glassfish-logs中,我有以下例外情况:

[2016-08-17T10:29:53.142+0000] [glassfish 4.1] [WARNING] [] [javax.enterprise.network.config] [tid: _ThreadID=43 _T$
  GRIZZLY0050: SSL support could not be configured!
java.io.IOException: A MultiException has 2 exceptions.  They are:
1. java.lang.Error: java.security.UnrecoverableKeyException: Cannot recover key
2. java.lang.IllegalStateException: Unable to perform operation: post construct on com.sun.enterprise.security.ssl.$

        at org.glassfish.grizzly.config.ssl.JSSE14SocketFactory.init(JSSE14SocketFactory.java:162)
        at org.glassfish.grizzly.config.SSLConfigurator.initializeSSLContext(SSLConfigurator.java:249)
        at org.glassfish.grizzly.config.SSLConfigurator.configureSSL(SSLConfigurator.java:131)
        at org.glassfish.grizzly.config.SSLConfigurator$InternalSSLContextConfigurator.createSSLContext(SSLConfigur$
        at org.glassfish.grizzly.ssl.SSLEngineConfigurator.createSSLEngine(SSLEngineConfigurator.java:209)
        at org.glassfish.grizzly.ssl.SSLEngineConfigurator.createSSLEngine(SSLEngineConfigurator.java:186)
        at org.glassfish.grizzly.ssl.SSLBaseFilter.handleRead(SSLBaseFilter.java:293)

[2016-08-17T10:29:53.143+0000] [glassfish 4.1] [WARNING] [] [org.glassfish.grizzly.filterchain.DefaultFilterChain] $
  GRIZZLY0013: Exception during FilterChain execution
java.lang.NullPointerException
        at org.glassfish.grizzly.ssl.SSLEngineConfigurator.createSSLEngine(SSLEngineConfigurator.java:214)
        at org.glassfish.grizzly.ssl.SSLEngineConfigurator.createSSLEngine(SSLEngineConfigurator.java:186)
        at org.glassfish.grizzly.ssl.SSLBaseFilter.handleRead(SSLBaseFilter.java:293)
        at org.glassfish.grizzly.filterchain.ExecutorResolver$9.execute(ExecutorResolver.java:119)
        at org.glassfish.grizzly.filterchain.DefaultFilterChain.executeFilter(DefaultFilterChain.java:283)
        at org.glassfish.grizzly.filterchain.DefaultFilterChain.executeChainPart(DefaultFilterChain.java:200)
        at org.glassfish.grizzly.filterchain.DefaultFilterChain.execute(DefaultFilterChain.java:132)
        at org.glassfish.grizzly.filterchain.DefaultFilterChain.process(DefaultFilterChain.java:111)

2 个答案:

答案 0 :(得分:2)

您忘了在cacerts.jks中插入证书 在这样的cacerts中包含根证书和中间证书 keytool -import -trustcacerts -keystore cacerts.jks -alias root -file root.crt
keytool -import -trustcacerts -keystore cacerts.jks -alias intermediate1 -file 1_cross_Intermediate.crt
keytool -import -trustcacerts -keystore cacerts.jks -alias intermediate2 -file 2_issuer_Intermediate.crt

无需在cacerts.jks中插入域名证书

答案 1 :(得分:1)

可能仍需要在您的密钥库上工作。您可以使用KSE编辑密钥,更容易处理证书。

  • 您确定密钥库和证书条目都具有 密码" changeit"?

  • 证书链是否适合此证书条目?