Hostname verifier does not get invoked

Question

Hi All,
I am new to weblogic and currently facing an issue with SSL. I checked this forum but none of the solutions really worked for me, so seeking advice starting a new thread. Kindly help.
Problem 1
I have a REST webservice running in one weblogic server and another weblogic server contains a client which is based on the code from the following link -
http://wiki.open-esb.java.net/attach/RestBCEchoSSL/SslClient.java
One way handshaking is enabled in both the weblogic and the KeyStore and Truststore are read from configurable directory in the client java code. I specify a directory which resides outside weblogic home.
Even though there is an HostnameVerifier implemented in the code to return true always, it does not get invoked and I get a certificate exception as below -
<Warning> <Security> <BEA-090542> <Certificate chain received from xx.yy.zz.rrr - xx.yy.zz.rrr was not trusted causing SSL handshake failure. Check the certificate chain to determine if it should be trusted or not. If it should be trusted, then update the client trusted CA configuration to trust the CA certificate that signed the peer certificate chain. If you are connecting to a WLS server that is using demo certificates (the default WLS server behavior), and you want this client to trust demo certificates, then specify -Dweblogic.security.TrustKeyStore=DemoTrust on the command line for this client.>
But when I run the java client from Eclipse I am able to invoke the webservice methods using HTTPs.
So is not it possible to add a default hostname verifier as in the java code when the application is deployed in weblogic?
Problem 2
I another attempt to solve the above issue I turned off the hostname verification from weblogic admin console in the client weblogic side. In the console for the server Configuration > SSL->Hostname Verification field is set to "None". But that did not help.
Then I added the '-Dweblogic.security.SSL.ignoreHostnameVerification=true' flag into the <domain>/bin/startWebLogic.sh file and restarted the weblogic. No luck again.
${JAVA_HOME}/bin/java ${JAVA_VM} ${MEM_ARGS} ${JAVA_OPTIONS} -Dweblogic.Name=${SERVER_NAME} -Djava.security.policy=${WL_HOME}/server/lib/weblogic.policy -Dweblogic.security.SSL.ignoreHostnameVerification=true ${PROXY_SETTINGS} ${SERVER_CLASS}
I tried recreating the certificate using the' hostname' instead of the ip address ( also added an entry into the /etc/hosts file putting the ip and hostname so that I can do ping <hostname> from the client and get response returned from the server side). Again no luck :(. I keep getting the same handshake failure as mentioned above.
The weblogic version is 10.x.
Thanks,
Amrit

Answer 1

I did some more research for the issue mentioned which I yet to get rid of.
1) I wrote a REST web service which makes a call to another REST service deployed on another weblogic using HTTPs (same code as mentioned above is used). I delpoyed the war and made a http call to the first webservice, the other REST service was invoked successfully using HTTPs. So this confirmed that there is no problem with the certificates or keystore or hostname verifictaion.
2) My actual application still throws the handshake exception as below -
<Warning> <Security> <BEA-090542> <Certificate chain received from xx.yy.zz.rrr - xx.yy.zz.rrr was not trusted causing SSL handshake failure. Check the certificate chain to determine if it should be trusted or not. If it should be trusted, then update the client trusted CA configuration to trust the CA certificate that signed the peer certificate chain. If you are connecting to a WLS server that is using demo certificates (the default WLS server behavior), and you want this client to trust demo certificates, then specify -Dweblogic.security.TrustKeyStore=DemoTrust on the command line for this client.>
So I think the problem is something else but weblogic is priniting the exception message wrong.
The process hierarchy ( in UNIX ) is as shown below -
bea 31914 31913 0 14:29 ? 00:00:00 /bin/sh <DOMAIN HOME>//bin/startWebLogic.sh
bea 31989 31914 0 14:29 ? 00:01:25 /opt/bea/jdk160_24/bin/java <The weblogic start server process> started by startWebLogic.sh
bea 32107 31989 0 14:29 ? 00:00:09 /opt/bea/jdk160_24/bin/java <One of custom process>
bea 2038 32107 0 18:38 ? 00:00:15 /opt/bea/jdk160_24/bin/java <Another custom process which contains my java classes containing the REST client>
The problem is there in both Weblogic 11 and 10.3 version.
I will be grateful if someone gives any clue about the problem.