OSR 2way SSL client configuration in Weblogic

Question

We've implemented 2way SSL in our Weblogic domains that host endpoints for use by OSB and OSR, using signed ( not self-signed! ) certificates. OSB works great and invokes the endpoints successfully over 2way SSL.
The problem is that OSR doesn't use the same security keystore / truststore as WebLogic. The Weblogic server hosting OSR is configured with the same keystore / truststore that the OSB server uses, and the OSR mgd server also has "Use Server Certs" enabled.
The OSR 10g server and the endpoint domain both use the same versions: Weblogic 10.3, using jrockit_160_05, both running on Linux 2.6.18-92.1.17.0.2.el5xen #1 SMP Tue Nov 18 04:11:19 EST 2008 i686 i686 i386 GNU/Linux on different hosts.
For one-way SSL, I imported ( with PStoreTool.sh ) the server certificate from the endpoints' domain into the registry's conf/pstore.xml & redeployed, and then OSR was able to trust the incoming server cert. That's been working great.
I'd like to have OSR submit the same certificate that OSB does so that OSR can act as a client in 2-way SSL. So I've used this:
# Get the server cert from the OSR WL server
sslTool.sh serverInfo url https://"OSR_HOST" certFile "OSR_HOST_FILE"
# Add it into extracted pstore
PStoreTool.sh new -alias "CN value" -keypassword ****t -config conf/pstore.xml -certFile "OSR_HOST_FILE"
# encrypt keypass
sslTool.sh encrypt --password *****
and added an entry in the registry.war's app/uddi/conf/security.xml of:
sslConnectionAlias>OSR_HOST</sslConnectionAlias>
sslConnectionPassword_coded>"output from sslTool encrypt"</sslConnectionPassword_coded>
But when trying to publish an https:// endpoint into OSR, I get an error in the OSR console of:
Invalid WSDL location! WSDLException: faultCode=INVALID_WSDL: Cannot get WSDL at 'https://...."'. Exception occured: javax.net.ssl.SSLHandshakeException: Received fatal alert: decrypt_error.
The OSR server logs shows this
ERROR: com.idoox.wsdl.xml.WSDLReaderImpl - javax.net.ssl.SSLHandshakeException: Received fatal alert: decrypt_error
ERROR: com.systinet.uddi.webui.WebUIRawService - Web Framework exception
EXCEPTION: com.systinet.uddi.webui.WebUIException: (18003) UDDI error occurred.
javax.servlet.ServletException: com.systinet.uddi.webui.WebUIException: (18003) UDDI error occurred.
In the weblogic endpoint domain, I get this error at the same time - after the OSR certificate has been presented:
<Sep 17, 2009 4:12:40 PM EDT> <Debug> <SecuritySSL> <BEA-000000> <HANDSHAKEMESSAGE: CertificateVerify>
<Sep 17, 2009 4:12:40 PM EDT> <Debug> <SecuritySSL> <BEA-000000> <Using JCE Cipher: SunJCE version 1.6 for algorithm RSA/ECB/NoPadding>
<Sep 17, 2009 4:12:40 PM EDT> <Debug> <SecuritySSL> <BEA-000000> <NEW ALERT with Severity: FATAL, Type: 51
java.lang.Exception: New alert stack
at com.certicom.tls.record.alert.Alert.<init>(Unknown Source)
at com.certicom.tls.record.handshake.HandshakeHandler.fireAlert(Unknown Source)
at com.certicom.tls.record.handshake.ServerStateReceivedClientKeyExchange.handle(Unknown Source)
at com.certicom.tls.record.handshake.HandshakeHandler.handleHandshakeMessage(Unknown Source)
at com.certicom.tls.record.handshake.HandshakeHandler.handleHandshakeMessages(Unknown Source)
For two-way SSL, what steps are needed? The documentation on PStoreTool only lists available commands, but not how they would be used to perform 2way ssl config.

Answer 1

After many, many, many iterations, I finally have an OSR that can import over 2way SSL.
So here are the steps I used ( variables in caps )
* Extract the conf/pstore.xml and app/uddi/conf/security/xml from registry.war
jar -xf conf/pstore.xml
jar -xf app/uddi/conf/security.xml
* Encrypt the password for later use:
PStoreTool.sh encrypt --password=OSR_PASS
( gives you an encrypted string )
* Edit the security.xml, add these lines:
<sslConnectionAlias>OSR_ALIAS</sslConnectionAlias>
<sslConnectionPassword_coded>encrypted_password</sslConnectionPassword_coded>
</security>
<destinationConfig>
<alias>OSR_ALIAS</alias> <!-- same alias -->
<password_coded>encrypted_password</password_coded>
<destination url="https://SERVICE_ENDPOINT/*"/> <!-- server hosting the endpoints that you're importing -->
</destinationConfig>
* put security.xml back
jar -tf registry.war app/uddi/conf/security.xml
* import the OSR server's identity cert ( to use as a client cert in outbound 2way SSL
sslTool.sh serverInfo url https://OSR_HOST  certFile ./OSR_HOST.cer
PStoreTool.sh add -config conf/pstore.xml -certFile ./OSR_HOST.cer
* If your OSR cert is signed, also import signer certs with PStoreTool as previous
* create a new user
PStoreTool.sh new -alias OSR_ALIAS -keypassword unencrypted_password -config conf/pstore.xml
* overwrite the user with the cert
sslTool.sh pstoreEI -i keystore /etc/java/OSR_IDENTITY_KEYSTORE.jks storepass *** alias *** keypass *** --pstore [REGISTRY_HOME]/conf/clientconf.xml pstoreAlias OSR_ALIAS pstoreKeypass OSR_PASS
sslTool.sh pstoreEI -i keystore /etc/java/OSR_IDENTITY_KEYSTORE.jks storepass *** alias *** keypass *** pstore conf/pstore.xml pstoreAlias OSR_ALIAS --pstoreKeypass OSR_PASS
* Put the pstore.xml back
jar -uf registry.war conf/pstore.xml
Stop your OSR server, undeploy the registry.war, remove the OSR managed server's tmp directory, redeploy and restart.
If you get "BAD_CERT" - you have a self-signed cert in pstore.xml that needs to be overwritten with your real cert from your OSR's identity jks
If you get "login failed" - you need to run the "PStoreTool new"