Scribd
Upload
224 views

NodeManager SSLKeyException

The document describes an issue where a NodeManager started on a cloned VM was throwing SSL certificate errors. This was because the SSL certificates corresponded to the original VM and not the cloned one. The document provides two solutions: 1. Disable SSL hostname verification as a workaround. 2. Recreate the SSL certificates using the CertGen utility to generate a new private key for the cloned VM. This involves backing up the existing keystore, generating a new private key, importing it to the keystore and copying the updated keystore back. This is described as the recommended approach.

Uploaded by

Nihar RM
Copyright
© © All Rights Reserved
Available Formats
Download as DOCX, PDF, TXT or read online on Scribd
224 views

NodeManager SSLKeyException

The document describes an issue where a NodeManager started on a cloned VM was throwing SSL certificate errors. This was because the SSL certificates corresponded to the original VM and not the cloned one. The document provides two solutions: 1. Disable SSL hostname verification as a workaround. 2. Recreate the SSL certificates using the CertGen utility to generate a new private key for the cloned VM. This involves backing up the existing keystore, generating a new private key, importing it to the keystore and copying the updated keystore back. This is described as the recommended approach.

Uploaded by

Nihar RM
Copyright
© © All Rights Reserved
Available Formats
Download as DOCX, PDF, TXT or read online on Scribd
You are on page 1/ 2

NodeManager:

[Security:090482]BAD_CERTIFICATE
alert javax.net.ssl.SSLKeyException
May 15, 2014 by Sumit Gupta
Recently I cloned an OAM VM. When I started NodeManager for the cloned machine, I got
below errors:-
06-May-2014 10:58:08 weblogic.nodemanager.server.Handler run
WARNING: Uncaught exception in server handlerjavax.net.ssl.SSLKeyException:
[Security:090482]BAD_CERTIFICATE alert was received from newmachine.OraWorld
127.0.0.1. Check the peer to determine why it rejected the certificate chain (trusted CA
configuration, hostname verification). SSL debug tracing may be required to determine the
exact reason the certificate was rejected.
javax.net.ssl.SSLKeyException: [Security:090482]BAD_CERTIFICATE alert was received
from newmachine.OraWorld 127.0.0.1. Check the peer to determine why it rejected the
certificate chain (trusted CA configuration, hostname verification). SSL debug tracing may
be required to determine the exact reason the certificate was rejected.
at com.certicom.tls.interfaceimpl.TLSConnectionImpl.fireException(Unknown Source)
at com.certicom.tls.interfaceimpl.TLSConnectionImpl.fireAlertReceived(Unknown Source)
at com.certicom.tls.record.alert.AlertHandler.handle(Unknown Source)
at com.certicom.tls.record.alert.AlertHandler.handleAlertMessages(Unknown Source)
at com.certicom.tls.record.MessageInterpreter.interpretContent(Unknown Source)
The cause of the above issue was the certificates corresponded to the old machine. So, there
are two ways to solve it.
1. Disable Flags Workaround
Put the following flags at the right places.
Node Manager: -Dweblogic.nodemanager.sslHostNameVerificationEnabled=false
Admin Server: -Dweblogic.security.SSL.ignoreHostnameVerification=true
2. Recreate the Certificates The recommended way.
Node manager by default uses the WebLogic demo identity keystore. The keystore is
generated at install time using the CertGen utility. The generated private key uses the
common name (cn) resolved by Java.

2.1 Set the PATH
. $WL_HOME/server/bin/setWLSEnv.sh

2.2 Backup DemoIdentity.jks under $WL_HOME/server/lib
2.3 Generate the private key.
java utils.CertGen -keyfilepass DemoIdentityPassPhrase -certfile newcert -
keyfile newkey

2.4 Import the key generated above to the keystore.
java utils.ImportPrivateKey -keystore DemoIdentity.jks -storepass
DemoIdentityKeyStorePassPhrase -keyfile newkey.pem -keyfilepass
DemoIdentityPassPhrase -certfile newcert.pem -alias demoidentity

2.5 Copy DemoIdentity.jks to $WL_HOME/server/lib
2.6 Restart your nodemanager

You might also like