OSB11g: Issue with nodemanager nmConnect after using custom keystore

Question

Environment: OSB 11g ( 4 manages servers in cluster, 1 admin server)
Issue:
For interacting with Paycorp payment gateway, we have used custom identity and trust keystore. For that we have made changes in admin server and all managed servers in Keystore tab (in admin console) and added PaycorpPKI credential mapper in security realms -> myRealm -> Providers -> Credential Mapping.
Things are working fine for OSB code as we are able to connect to secured paycorp gateway by doing these steps.
BUT by doing these changes, the nodemanager command nmConnect('weblogic','welcome1','x.x.x.x',5556,'MyOSBDomain') is not able to connect to node manager.
The exception is:
wls:/offline> nmConnect('weblogic','welcome1','x.x.x.x',5556,'MyOSBDomain')
Connecting to Node Manager ...
<18/04/2011 4:46:26 PM EST> <Notice> <Security> <BEA-090898> <Ignoring the trusted CA certificate "CN=thawte Primary Root CA - G3,OU=(c) 2008 thawte\, Inc. - For authorized use only,OU=Certification Services Division,O=thawte\, Inc.,C=US". The loading of the trusted certificate list raised a certificate parsing exception PKIX: Unsupported OID in the AlgorithmIdentifier object: 1.2.840.113549.1.1.11.>
<18/04/2011 4:46:26 PM EST> <Notice> <Security> <BEA-090898> <Ignoring the trusted CA certificate "CN=T-TeleSec GlobalRoot Class 3,OU=T-Systems Trust Center,O=T-Systems Enterprise Services GmbH,C=DE". The loading of the trusted certificate list raised a certificate parsing exception PKIX: Unsupported OID in the AlgorithmIdentifier object: 1.2.840.113549.1.1.11.>
<18/04/2011 4:46:26 PM EST> <Notice> <Security> <BEA-090898> <Ignoring the trusted CA certificate "CN=T-TeleSec GlobalRoot Class 2,OU=T-Systems Trust Center,O=T-Systems Enterprise Services GmbH,C=DE". The loading of the trusted certificate list raised a certificate parsing exception PKIX: Unsupported OID in the AlgorithmIdentifier object: 1.2.840.113549.1.1.11.>
<18/04/2011 4:46:26 PM EST> <Notice> <Security> <BEA-090898> <Ignoring the trusted CA certificate "CN=GlobalSign,O=GlobalSign,OU=GlobalSign Root CA - R3". The loading of the trusted certificate list raised a certificate parsing exception PKIX: Unsupported OID in the AlgorithmIdentifier object: 1.2.840.113549.1.1.11.>
<18/04/2011 4:46:26 PM EST> <Notice> <Security> <BEA-090898> <Ignoring the trusted CA certificate "OU=Security Communication RootCA2,O=SECOM Trust Systems CO.\,LTD.,C=JP". The loading of the trusted certificate list raised a certificate parsing exception PKIX: Unsupported OID in the AlgorithmIdentifier object: 1.2.840.113549.1.1.11.>
<18/04/2011 4:46:26 PM EST> <Notice> <Security> <BEA-090898> <Ignoring the trusted CA certificate "CN=VeriSign Universal Root Certification Authority,OU=(c) 2008 VeriSign\, Inc. - For authorized use only,OU=VeriSign Trust Network,O=VeriSign\, Inc.,C=US". The loading of the trusted certificate list raised a certificate parsing exception PKIX: Unsupported OID in the AlgorithmIdentifier object: 1.2.840.113549.1.1.11.>
<18/04/2011 4:46:26 PM EST> <Notice> <Security> <BEA-090898> <Ignoring the trusted CA certificate "CN=KEYNECTIS ROOT CA,OU=ROOT,O=KEYNECTIS,C=FR". The loading of the trusted certificate list raised a certificate parsing exception PKIX: Unsupported OID in the AlgorithmIdentifier object: 1.2.840.113549.1.1.11.>
<18/04/2011 4:46:26 PM EST> <Notice> <Security> <BEA-090898> <Ignoring the trusted CA certificate "CN=GeoTrust Primary Certification Authority - G3,OU=(c) 2008 GeoTrust Inc. - For authorized use only,O=GeoTrust Inc.,C=US". The loading of the trusted certificate list raised a certificate parsing exception PKIX: Unsupported OID in the AlgorithmIdentifier object: 1.2.840.113549.1.1.11.>
<18/04/2011 4:46:26 PM EST> <Warning> <Security> <BEA-090476> <Invalid/unknown SSL header was received from peer hostname-osb - x.x.x.x during SSL handshake.>
Traceback (innermost last):
File "<console>", line 1, in ?
File "<iostream>", line 123, in nmConnect
File "<iostream>", line 646, in raiseWLSTException
WLSTException: Error occured while performing nmConnect : Cannot connect to Node Manager. : [Security:090476]Invalid/unknown SSL header was received from peer hostname-osb - x.x.x.x during SSL handshake.
nodemanager.properties file
DomainsFile=/hta/vha/opt/app/osb11R1/wlserver_10.3/common/nodemanager/nodemanager.domains
LogLimit=0
PropertiesVersion=10.3
javaHome=/usr/jdk/instances/jdk1.6.0_21
AuthenticationEnabled=true
NodeManagerHome=/hta/vha/opt/app/osb11R1/wlserver_10.3/common/nodemanager
JavaHome=/usr/jdk/instances/jdk1.6.0_21/jre
LogLevel=INFO
DomainsFileEnabled=true
StartScriptName=startWebLogic.sh
ListenAddress=
NativeVersionEnabled=true
ListenPort=5556
LogToStderr=true
SecureListener=false
LogCount=1
StopScriptEnabled=false
QuitEnabled=false
LogAppend=true
StateCheckInterval=500
CrashRecoveryEnabled=false
StartScriptEnabled=true
LogFile=/hta/vha/opt/app/osb11R1/wlserver_10.3/common/nodemanager/nodemanager.log
LogFormatter=weblogic.nodemanager.server.LogFormatter
ListenBacklog=50
We did following steps to resolve this issue but in vain
S1. Changed Type to 'Plain' from 'SSL' in Machines -> osbMac01 -> Node Manager
S2. Changed SecureListener=true to SecureListener=false in nodemanager.properties
S3. kill the nodemanager and then start.
I guess there is some configuration in nodemanager.properties file that is creating this issue. Can anyone help with the same?
Thanks,
Sameer
Edited by: sameer h on Apr 18, 2011 7:09 PM

Answer 1

SecureListener=falseYou have turned off secure listener for node manager, hence it will accepting 'plain' requests only and cant handle ssl handshakes
nmConnect('weblogic','welcome1','x.x.x.x',5556,'MyOSBDomain')Here you have left the 6th parameter to nmConnect as blank. The default in this case will be ssl and nmConnect is excepting ssl handshake response back from nodemanager, but nm cant reply ssl because it is not enabled.
Solution
1) Turn on Secure Listener = true. Then you can use this exact syntax for nmConnect.
2) Keep secure listener to false. use nmConnect() with all 6 parameters
nmConnect([username, password], [host], [port], [domainName], [domainDir] [nmType])
Pass 'plain' for the nmType attribute
Refer: http://download.oracle.com/docs/cd/E13222_01/wls/docs91/config_scripting/reference.html#1030962