IP confusion in Convergence

Question

Hello,
I just completed a single-host installation of CommSuite 7 (on Solaris 10 x86) and I seem to have put myself into a bind (nothing new there!).
I have customers that need access to my server from behind firewalls with immutable configurations (e.g., they'll allow connections on standard ports such as 80, 443, 143, 993, etc., but not on non-standard ports, e.g. 8080, etc.). In an effort to make all of the services that I wanted to expose available to those users, I created a second logical interface on the system and bound to that IP for various services.
Specifically, I have two hostnames for this system, colder.domain.com on the physical interface (e1000g0) and mail.domain.com on the logical interface (e1000g0:8).
I configured the listeners in Glassfish, for both ports 80 & 443, to only listen on colder's IP. For Messaging Server, I used configutil to set service.listenaddr to mail's IP.
At this point, things are mostly working:
1. I can connect via POP, POPS, IMAP, & IMAPS to mail, can login, and can see the messages in my inbox. I can also connect via HTTP & HTTPS to mail and see the "WMAP service active." message.
2. I can connect via HTTPS to all of the webapps on Glassfish (i.e., /da, /im, /rest, /commcli, /imps, /searchui, & /iwc).
3. I can connect to Calendar Server on the default port (3080 - I figured users would only access this through Convergence).
However, there is one problem.
While I can connect to Convergence and login as a provisioned user, upon login I am greeted with the message "The mail service is not available. Please try again later." The following appears in the iwc.log when I log into iwc:
PROXY_MAIL: INFO from com.sun.comms.client.web.services.sun.MailServiceProxy  Thread httpSSLWorkerThread-443-2 at 2010-04-12 10:31:08,846 - Performing Sun Mail Authentication
ADDRESS_BOOK: INFO from com.sun.comms.client.ab.coresrv.DBHandler  Thread httpSSLWorkerThread-443-0 at 2010-04-12 10:31:08,854 - Got DBPluginMap
PROXY_MAIL: ERROR from com.sun.comms.client.web.services.sun.MailServiceProxy  Thread httpSSLWorkerThread-443-2 at 2010-04-12 10:31:08,863 - cookies not present from MS response
PROXY_MAIL: INFO from com.sun.comms.client.web.services.sun.MailServiceProxy  Thread httpSSLWorkerThread-443-3 at 2010-04-12 10:31:08,865 - Performing Sun Mail Authentication
PROXY_MAIL: ERROR from com.sun.comms.client.web.services.sun.MailServiceProxy  Thread httpSSLWorkerThread-443-3 at 2010-04-12 10:31:08,880 - cookies not present from MS response
PROXY_CAL: INFO from com.sun.comms.client.web.services.sun.CalendarServiceProxy  Thread httpSSLWorkerThread-443-2 at 2010-04-12 10:31:08,972 - Performing Sun calendar Authentication
PROXY_MAIL: INFO from com.sun.comms.client.web.services.sun.MailServiceProxy  Thread httpSSLWorkerThread-443-3 at 2010-04-12 10:31:09,041 - Performing Sun Mail Authentication
PROXY_MAIL: ERROR from com.sun.comms.client.web.services.sun.MailServiceProxy  Thread httpSSLWorkerThread-443-3 at 2010-04-12 10:31:09,050 - cookies not present from MS responseHere are some of the pertinent iwc configuration properties:
mail.enable = true
mail.enablessl = false
mail.host = mail.domain.com
mail.port = 80
mail.proxyadminid = admin
mail.proxyadminpwd = ***removed***When I first added my test user, his LDAP entry included the attribute value mailHost: colder.domain.com, so my first thought was that it should instead be mailHost: mail.domain.com. I made that change, but then I saw the error message "The mail server unexpectedly closed the connection" in Convergence, and lots of imap log messages that said "get_imap_response: timed out reading from backend server". So I switched the mailHost back to colder.
The http log seems to indicate that indeed, it is trying to connect via IMAP to the wrong server:
[12/Apr/2010:10:42:45 -0500] colder httpd[10365]: General Error: IMAP connection to colder.domain.com:143 failed: Connection refused
[12/Apr/2010:10:42:45 -0500] colder httpd[10365]: General Error: Failed to connect to imap server on colder.domain.com
[12/Apr/2010:10:42:45 -0500] colder httpd[10365]: General Warning: Couldn't login testuser on IMAP server: Mail server unavailable. Administrator, check server log for details.Am I missing something obvious? Any suggestions as to what to check next?
Thanks,
Bill

Answer 1

OK, the last tidbit in the latter link had a rather cryptic description of what needed to be done, and I was able to figure it out. So that it is captured for posterity for the next person who googles for "Convert a PKCS12 certificate into JKS format", here's what I did:
1. Used pk12util to export my key & certificate from an existing web server key/certificate database:
# pk12util -o myCert.p12 -n Server-Cert \
-d /opt/SUNWappserver/domains/domain1/config \
-K myPassword -W myPassword2. Used the KeyTool class included with App Server (*not* the keytool utility included with the JRE!) to convert the pkcs12 file into a JKS keystore:
# java -classpath /opt/SUNWappserver/lib/appserv-rt.jar \
com.sun.enterprise.security.KeyTool \
-pkcs12 -pkcsFile myCert.p12 -pkcsKeyStorePass myPassword \
-pkcsKeyPass myPassword \
-jksFile /etc/opt/SUNWiim/default/config/server-keystore.jks \
-jksKeyStorePass myPassword3. Used "keytool -list" to verify that my certificate was indeed now included in my new server-keystore.jks.
4. Imported my CA certificate chain certs into the keystore:
# keytool -importcert -trustcacerts \
-alias 'utnAddTrustAB' \
-file UTNAddTrustServer_CA.crt \
-keystore /etc/opt/SUNWiim/default/config/server-keystore.jks \
-storepass myPassword -storetype JKS
# keytool -importcert -trustcacerts \
-alias 'NetSolCA' \
-file NetworkSolutions_CA.crt \
-keystore /etc/opt/SUNWiim/default/config/server-keystore.jks \
-storepass myPassword -storetype JKS5. Ran "keytool -list" again, and it now shows two "trustedCertEntry" certificates and one "PrivateKeyEntry" certificate (the one from my pkcs12 file).
6. Added these lines to the end of the iim.conf file:
! SSL Configuration
iim_server.sslkeystore = "/etc/opt/SUNWiim/default/config/server-keystore.jks"
iim_server.keystorepasswordfile = "/etc/opt/SUNWiim/default/config/sslpassword.conf"
iim_server.requiressl = "true"
iim_server.trust_all_cert = "false"After performing these steps, I fired up the server, the SMF log file has a line that indicates that SSL has been initialized (using JKS), and I am able to connect my Pidgin IM client to the server with my test user and the "Require SSL/TLS" option enabled, and it works!
Shane, thanks again for your excellent support. It's good to know that even though your paychecks have a different company name on the top, we as your customers continue to receive the same top-notch support we've become accustomed to over the years.
Bill
P.S. Feel free to show that last kudo to your boss when you ask him for your next raise. ;-)