Unable send topic to weblogic9.2 over SSL

I try to send topic to weblogic9.2 over SSL from a java application, but always get the error :"Exception in thread "main" java.lang.RuntimeException: Exception occurred while reading the license file". I have placed the license file license.bea
in my application, it didn't work. Any hints?

Attach with my test code,
public class TopicSend {
     public final static String JNDI_FACTORY = "weblogic.jndi.WLInitialContextFactory";
     public static String JMS_FACTORY = "ConnectionFactory";
     public static String TOPIC = "TP";
     public static String URL;
     protected TopicConnectionFactory tconFactory;
     protected TopicConnection tcon;
     protected TopicSession tsession;
     protected TopicPublisher tpublisher;
     protected Topic topic;
     protected TextMessage msg;
     static {
          Properties properties = new Properties();
          try {
               properties.load(new FileInputStream("param.properties"));
          } catch (FileNotFoundException e) {
               // TODO Auto-generated catch block
               e.printStackTrace();
          } catch (IOException e) {
               // TODO Auto-generated catch block
               e.printStackTrace();
          TopicSend.JMS_FACTORY = properties.getProperty("ConnectionFactory");
          TopicSend.TOPIC = properties.getProperty("Topic");
          TopicSend.URL = properties.getProperty("URL");
     public void init(Context ctx, String topicName) throws NamingException,
               JMSException, FileNotFoundException, IOException {
          tconFactory = (TopicConnectionFactory) PortableRemoteObject.narrow(ctx
                    .lookup(JMS_FACTORY), TopicConnectionFactory.class);
          tcon = tconFactory.createTopicConnection();
          tsession = tcon.createTopicSession(false, Session.AUTO_ACKNOWLEDGE);
          topic = (Topic) PortableRemoteObject.narrow(ctx.lookup(topicName),
                    Topic.class);
          tpublisher = tsession.createPublisher(topic);
          msg = tsession.createTextMessage();
          tcon.start();
     public void send(String message) throws JMSException {
          msg.setText(message);
          tpublisher.publish(msg);
     public void close() throws JMSException {
          tpublisher.close();
          tsession.close();
          tcon.close();
     public static void main(String[] args) throws Exception {
          InitialContext ic = getInitialContext(TopicSend.URL);
          TopicSend ts = new TopicSend();
          ts.init(ic, TOPIC);
          readAndSend(ts);
          ts.close();
     protected static void readAndSend(TopicSend ts) throws IOException,
               JMSException {
          BufferedReader msgStream = new BufferedReader(new InputStreamReader(
                    System.in));
          String line = null;
          System.out
                    .print("\n\t TopicSender Started �� Enter message (\"quit\" to quit): \n");
          do {
               System.out.print("Topic Sender Says > ");
               line = msgStream.readLine();
               if (line != null && line.trim().length() != 0) {
                    ts.send(line);
          } while (line != null && !line.equalsIgnoreCase("quit"));
     protected static InitialContext getInitialContext(String url)
               throws NamingException {
          Hashtable<String, String> env = new Hashtable<String, String>();
          env.put(Context.INITIAL_CONTEXT_FACTORY, JNDI_FACTORY);
          env.put(Context.PROVIDER_URL, url);
          env.put("weblogic.jndi.createIntermediateContexts", "true");
          return new InitialContext(env);
}

Similar Messages

  • PRoblem In Sending Mail OVER SSL

    HI All,
    I am using java mail api to send email using gmail smtp server address.And my application is running over SSL.
    My Client is running in tomcat application and server side code is in Jboss.
    I have written a code to send email and that code is der in client side , i mean in tomcat.
    I am getting one error given below::
    nested exception is:
    javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorExc
    eption: PKIX path building failed: sun.security.provider.certpath.SunCertPathBui
    lderException: unable to find valid certification path to requested target
    And given below my code ::
    Properties props = new Properties();
    System.out.println("Inside simple mail");
    props.setProperty("mail.transport.protocol","smtp");
    props.setProperty("mail.smtp.host","smtp.gmail.com");
    System.out.println("Port is set");
    props.setProperty("mail.user","xxxx");
    props.setProperty("mail.password","xxxx");
    props.put("mail.smtp.auth","true");
    *// props.put("mail.smtp.ssl.enable","true");*
    props.put("mail.smtp.starttls.enable","true");
    *// props.put("mail.smtp.socketFactory.class","javax.net.ssl.SSLSocketFactory");*
    MailSSLSocketFactory sf = new MailSSLSocketFactory();
    *     sf.setTrustAllHosts(true);*
    *     props.put("mail.smtp.ssl.socketFactory", sf);*
    *     BasicAuthenticator auth = new BasicAuthenticator();      *
    *     auth.getPasswordAuthentication();*
    Session mailSession = Session.getDefaultInstance(props, auth);
    mailSession.setDebug(true);
    MimeMessage message = new MimeMessage(mailSession);
    message.setSubject("Testing javamail plain");
    message.setContent("This is a test", "text/plain");
    *// message.setFrom(new InternetAddress())*
    message.addRecipient(Message.RecipientType.TO,
    new InternetAddress(pToMailId));
    Address add = new InternetAddress("xxxx");
    message.setFrom(add);
    System.out.println("Before connect");
    Transport.send(message);
    Can anyone help me out on this...
    Thanks in advance...
    Regards
    Deba

    Hi Thanks for the response...
    once again i ve tried but same problem...
    my code is below ::
    String host = "smtp.gmail.com";
                   String username = "[email protected]";
                   String password = "xxxx";
                   Properties props = new Properties();
                   props.put("mail.smtp.auth", "true");
                   props.put("mail.smtp.starttls.enable", "true");
                   props.put("mail.smtp.host", "smtp.gmail.com");
                   props.put("mail.transport.protocol", "smtp");
                   props.put("mail.smtp.auth", "true");
                   BasicAuthenticator auth = new BasicAuthenticator();
                   PasswordAuthentication lPasswordAuthentication = auth.getPasswordAuthentication();
                   Session session = Session.getDefaultInstance(props, auth);
                   session.setDebug(true);
                   Message msg = new MimeMessage(session);
                   InternetAddress addressFrom = new InternetAddress("[email protected]");
                   msg.setFrom(addressFrom);
                   InternetAddress addressTo = new InternetAddress(pToMailId);
                   msg.addRecipient(Message.RecipientType.TO, addressTo);
                   msg.setSubject("subject");
                   msg.setContent("message", "text/html");
                   Transport.send(msg);

  • FTP/File Sender Adapter over SSL - 500 Illegal PORT command.

    Hello Experts!
    I'm trying to configure FTP Sender Adapter over SSL. This is the configuration I'm using:
    Server: server01
    Port: 21
    Data Connection: Active
    Timeout: 100
    Connection Security: FTPS (FTP Using SSL/TLS) for Control and Data Connection
    Command Order: AUTH TLS, USER, PASS, PBSZ, PROT
    I have imported ftp server certificate into TrustedCAs key store. When the sender adapter tries to connect it receives the error 500 Illegal PORT command when getting files list.
    This is an excerpt of the logs of connection steps:
    #Plain##ftp server returns reply '220 Restricted Access. All Actions are monitored.'#
    #Plain##Detected 'AUTH TLS' command: Preparing TLS/SSL connection upgrade#
    #Plain##'AUTH TLS' successful: Upgrading control channel to TLS/SSL#
    #Plain##ftp server returns reply '234 Proceed with negotiation.'#
    #Plain##ftp server returns reply '331 Please specify the password.'#
    #Plain##ftp server returns reply '230 Login successful.'#
    #Plain##ftp server returns reply '200 PBSZ set to 0.'#
    #Plain##ftp server returns reply '200 PROT now Private.'#
    #Plain##ftp server returns reply '215 UNIX Type: L8'#
    #Plain##ftp server returns reply '200 Switching to ASCII mode.'#
    #Plain##ftp server returns reply '250 Directory successfully changed.'#
    #Plain##ftp server returns reply '500 Illegal PORT command.'#
    Does anybody know how to solve it?
    Thank you in advance!
    Roger Allué i Vall

    Ok! This is the maximum i could obtain:
    Fri Dec 11 15:28:12 2009 [pid 15206] FTP response: Client "10.58.42.108", "220 Restricted Access. All Actions are monitored."
    Fri Dec 11 15:28:12 2009 [pid 15206] FTP command: Client "10.58.42.108", "AUTH TLS"
    Fri Dec 11 15:28:12 2009 [pid 15206] FTP response: Client "10.58.42.108", "234 Proceed with negotiation."
    Fri Dec 11 15:28:12 2009 [pid 15206] FTP command: Client "10.58.42.108", "USER iubsint"
    Fri Dec 11 15:28:12 2009 [pid 15206] [iubsint] FTP response: Client "10.58.42.108", "331 Please specify the password."
    Fri Dec 11 15:28:12 2009 [pid 15206] [iubsint] FTP command: Client "10.58.42.108", "PASS <password>"
    Fri Dec 11 15:28:12 2009 [pid 15205] [iubsint] OK LOGIN: Client "10.58.42.108"
    Fri Dec 11 15:28:12 2009 [pid 15207] [iubsint] FTP response: Client "10.58.42.108", "230 Login successful."
    Fri Dec 11 15:28:12 2009 [pid 15207] [iubsint] FTP command: Client "10.58.42.108", "PBSZ 0"
    Fri Dec 11 15:28:12 2009 [pid 15207] [iubsint] FTP response: Client "10.58.42.108", "200 PBSZ set to 0."
    Fri Dec 11 15:28:12 2009 [pid 15207] [iubsint] FTP command: Client "10.58.42.108", "PROT P"
    Fri Dec 11 15:28:12 2009 [pid 15207] [iubsint] FTP response: Client "10.58.42.108", "200 PROT now Private."
    Fri Dec 11 15:28:12 2009 [pid 15207] [iubsint] FTP command: Client "10.58.42.108", "SYST"
    Fri Dec 11 15:28:12 2009 [pid 15207] [iubsint] FTP response: Client "10.58.42.108", "215 UNIX Type: L8"
    Fri Dec 11 15:28:12 2009 [pid 15207] [iubsint] FTP command: Client "10.58.42.108", "TYPE I"
    Fri Dec 11 15:28:12 2009 [pid 15207] [iubsint] FTP response: Client "10.58.42.108", "200 Switching to Binary mode."
    Fri Dec 11 15:28:12 2009 [pid 15207] [iubsint] FTP command: Client "10.58.42.108", "CWD /interfaces"
    Fri Dec 11 15:28:12 2009 [pid 15207] [iubsint] FTP response: Client "10.58.42.108", "250 Directory successfully changed."
    Fri Dec 11 15:28:12 2009 [pid 15207] [iubsint] FTP command: Client "10.58.42.108", "PORT 10,58,45,108,159,112"
    Fri Dec 11 15:28:12 2009 [pid 15207] [iubsint] FTP response: Client "10.58.42.108", "500 Illegal PORT command."
    I think we found the problem though. FTP Administrator says this is wrong:
    Fri Dec 11 15:28:12 2009 [pid 15207] [iubsint] FTP command: Client "10.58.42.108", "PORT 10,58,45,108,159,112"
    it should be
    Fri Dec 11 15:28:12 2009 [pid 15207] [iubsint] FTP command: Client "10.58.42.108", "PORT 10,58,42,108,159,112"
    Something is making SAP PI to take a wrong ip address (This server has two).
    I'll let you know if we solve it!!
    Thank you!!!

  • Unable to map WebDAV over SSL

    Hello,
    I have following issue: I have a WebDAV Windows Server 2012 with IIS and SSL signed by StartCom (so it is trusted by default). On Windows 8, I have no problem to map WebDAV over HTTP, however with HTTPS, I am unable to map it. I keep getting prompted for
    credentials all the time. I have tested this both on Windows 8 and Windows 8.1 RTM.
    Now the issue is that when I tried it on Windows 7, it mapped on both HTTP and HTTPS. I really have no idea what I am doing wrong, but I believe this could be client related rather than related to Windows Server and the WebDAV setup.
    Thank you.
    Edit: When running  net use * https://files.domain.com in cmd under Windows 8, I get directly error 1790, on Windows 7, I am prompted for username and password.
    Edit 2: When running net use * "\\files.domain.com@SSL\" /User:username password, on Windows 8, I get directly 1244 error.
    Edit 3: As such as it seems, this issue seems to be related to:
    http://social.technet.microsoft.com/Forums/windows/en-US/1a3c29ab-d038-4132-af99-b85bce51b5c2/sslv2-being-used-with-webdav, since the symptoms seem to be the same, however there is no solution provided on that thread.
    Edit 4: After running Microsoft Network Monitor, I can confidently say that the issue is indeed with the SSLv2 being used for WebDAV communications. See attached image.
    Full size picture...
    Edit 5: I just used Network Monitor on Windows 7, where the drive maps correctly over SSL, see the difference in a picture below.
    Full size picture...

    Thank you for your suggestion.
    However that tutorial doesn't exactly apply on my situation, this issue seems to be Windows 8/8.1 related, since everything works correctly under Windows 7. I added screenshots from Microsoft Network Monitor, both Windows 8 and Windows 7 while mapping
    the same WebDAV drive. Windows 7 is successful, however Windows 8 seems to fail during the SSL handshake.

  • WebDAV not working over SSL on CSS11503

    SOME HISTORY
    As you may recall we had an issue with interoperability between our WebCT Vista application and the Cisco CSS11503 Load Balancer. In a nutshell the Load Balancer would inject custom HTTP headers into HTTP packets, but only into the first HTTP packet of a TCP session. With your help we've learned that Cisco will change this in the August release of the CSS software.
    OUR NEW PROBLEM
    We are now having a related problem. In short, we cannot get WebDav to work over SSL. That is, when connect from Client to Load Balancer via SSL, and then Load Balancer to Web Server via plaintext, our application fails. Conversely, when we maintain a clear text connection straight through from Client to Web sever WebDav works.
    After doing some network traces of WebDav connections both with and without SSL I think we've discovered the cause of the problem: the Load Balancer fails to add our custom HTTP header "WL-Proxy-SSL: true" to HTTP "PROPFIND" requests, even though it correctly adds them to the HTTP "OPTIONS" requests.
    HOW WE CONFIGURED THE LOAD BALANCER
    We configured our Load Balancer with the Global configuration of
    http-method parse RFC2518-methods
    and with the command
    ssl-server 20 http-header static "WL-Proxy-SSL: true"
    so that the header "WL-Proxy-SSL: true" will be passed with the HTTP headers used for WebDav was well as with the 'standard' HTTP headers "GET, POST, HEAD", etc.
    Below is the relevant passage from the "CSS Command Reference" at
    http://www.cisco.com/univercd/cc/td/doc/product/webscale/css/css_750/cmdrefgd/cmdgloba.htm#wp1432749
    ======================================================================
    "By default, a Layer 5 content rule supports the HTTP CONNECT, GET, HEAD, POST, and PUT methods. Unless configured, the CSS recognizes and forwards the following HTTP methods directly to the destination server in a transparent caching environment, but does not load balance them:
    OPTIONS, TRACE, PROPFIND, PROPPATCH, MKCOL, MOVE, LOCK, UNLOCK, COPY, and DELETE.
    When you enable the CSS to support all RFC-2518 methods, the CSS parses the Request-URI field in an attempt to match a Layer 5 rule. If the contents of the Request-URI field are not in a compliant format of an absolute URI or an absolute path, the CSS tries to match the field to the next best wildcard ("/*") rule. If the match fails, the CSS attempts to match the Layer 4 rule, and then the Layer 3 rule."
    ========================================================================
    I interpret this to mean that when we configure "http-method parse RFC2518-methods" that the load balancer will treat all the HTTP headers in the group "OPTIONS, TRACE, PROPFIND, ...", etc the same as the "standard" HTTP headers "GET, POST, HEAD", etc.
    As I said earlier our network traces show that the "WL-Proxy-SSL: true"
    header present in the HTTP header OPTIONS but *not* in the header "PROPFIND".
    A BUG IN THE CSS COMMAND PROCESSOR?
    By my reckoning, this behaviour must be a bug in the CSS Command processor, because whatever the CSS does for the "OPTIONS" header it should also do for the "PROFIND" header.
    ATTACHMENTS
    I've included three attachments.
    trace.txt
    - text output from Ethereal of the network trace
    on the web server, with comments.
    webdav.ssl.snoop
    - the original network trace in Sun's 'snoop' format.
    css.2.cfg
    - the running configuration on the CSS11503
    Thanks in advance for your help.

    Hi
    I finally discovered what is the issue here. In appears that in case of unsigned applets, the code is unable to access SunJCE provider which contains most of the ciphers used by SSL protocol. This means that a session with SSL server is broken and effectively applet is not initialised.
    This problem is related to configuration of JRE under linux due to export control restrictions. Unfortunately I don't know how to make JRE to use SunJCE by default.
    As a workaround I have set up the following policies using Policy Manager:
    grant {
    permission java.security.SecurityPermission "putProviderProperty.SunJCE";
    grant {
    permission java.lang.RuntimePermission "getProtectionDomain";
    grant {
    permission java.lang.RuntimePermission "accessClassInPackage.sun.security.*";
    I don't know how insecure my actions are, but this definitely fixed problems with applets under SSL / HTTPS.
    Feel free to send me your ideas how to fix this issue in more elegant way.
    Best,
    Marcin

  • Rmi over ssl in jdk1.5.0

    hi,
    i am trying to connect a remote machine with rmi over ssl. but i got the following exceptions;
    java.rmi.ConnectIOException: error during JRMP connection establishment; nested exception is:
    Caused by: javax.net.ssl.SSLKeyException: RSA premaster secret error
    Caused by: java.security.NoSuchAlgorithmException: Cannot find any provider supporting RSA/ECB/PKCS1Padding
    Caused by: java.lang.IllegalArgumentException: can't support mode ECB
    i am using jdk1.5.0. i have tried many samples but i have not run them successfully however they were running successfully in j2sdk1.4.2.
    also i downloaded the bouncycastle provider but it did not work.
    is there anybody who knows about a running sample about rmi and ssl in jdk1.5.0? please send me....
    email: [email protected]

    Hi!
    I know it's not the exactly right topic, but I've nearly the same problem with a https connection for a webService. I'm not using turkish locale, I'm using BouncyCastle and the "Unlimited Strength" policy files. I've no problems if i start my application with eclipse, starting it with jdk1.5.0_03\jre\bin\java or jre1.5.0_03\bin\java form commandline i get the same stacktrace:
    javax.net.ssl.SSLKeyException: RSA premaster secret error
    Caused by: javax.net.ssl.SSLKeyException: RSA premaster secret error
    Caused by: java.security.NoSuchAlgorithmException: Cannot find any provider supporting RSA/ECB/PKCS1Padding
    Caused by: java.lang.IllegalArgumentException: can't support mode ECB
    if i try to get the cipher with
    Cipher c = Cipher.getInstance("RSA/ECB/PKCS1Padding");
    I'll get the same stacktrace, with
    Cipher c = Cipher.getInstance("RSA/ECB/PKCS1Padding", "BC");
    i works fine, but I've no idea how to run this code out of axis...
    Thanks & Regards
    Helmut

  • Error when trying to se smtp over ssl

    Hi all ,
    I have a webdynpro application that sends mail using smtp over ssl .
    Ihvae imported the ca certificate to trused ca key store , but when I run the application I get the following error :
    javax.mail.MessagingException: Exception reading response;
      nested exception is:
         javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
    could you please help
    Regards ,
    Oren

    My apologies for jumping into this thread, but I'm having a similar problem. I placed a file into the webroot/vod folder for testing purposes, but I cannot play the file when I use it as a source for the HTML5 <video> tag. When I try to access the file directly, http://63.116.232.4/vod/AmericanFlag.mov I get the following error messages:
    Not Found The requested URL /vod/AmericanFlag.mov was not found on this server.Apache/2.2.9 (Win32) DAV/2 mod_ssl/2.2.9 OpenSSL/0.9.8h Server at 63.116.232.4 Port 80
    The sample file, however, plays through Safari with no problems. http://www.librarymedia.net/Flash3/HTML5.html

  • Connecting to a remote OpenLDAP server over SSL.

    I've been trying for several weeks now to get a remote OpenLDAP server up and running; configured in such a way that it only allows SSL and requires certificate validation.
    I've created a CA with a self-signed certificate.
    I used that CA to create a server and client certificate.
    The server certificate is in /etc/ssl/certs, has a link by the name of its hash.0 pointing to it; permissions are all correct and /etc/ssl/slapd.conf point to it and the CA certificate.
    The client certificate is on my MacBook Pro in /etc/ssl/certs along with the CA certificate; each of which also has its hash linked to it. /etc/ssl/ldap.conf is set up properly, the permissions are correct, and the following test command ran as my user produces a successful result:
    ldapsearch -v -x -H ldaps://ldap.foo.org -b "dc=foo,dc=org" -d -1
    Now the problem part. I open Directory Utility; go to Services with Advanced Settings enabled. After unlocking it, I click the LDAPv3 and the pencil icon.
    I hit New... in the window that pops up and use ldap.foo.org as servername, SSL box ticked. I hit Continue, and behold; nothing happens.
    It is to say; Directory Utility hangs for a while; after which it goes back to the box I clicked Continue in without any error or warning popping up; but obviously hasn't advanced.
    The server logs indicate my Mac had actually connected; received the server certificate; but didn't send a client certificate at which point the TLS connection got aborted for some reason and the session ended.
    My Mac Console shows something even more bizare, though:
    11/09/08 23:09:22 com.apple.DirectoryServices[97123] Assertion failed: (ld != NULL), function ldapsearchext, file search.c, line 76.
    My suspicion is that Directory Utility can't verify the server certificate and aborts the TLS connection. I expect it also uses /etc/openldap/ldap.conf? How can I diagnose the root of this problem?
    Thanks a lot for your assistance; I just can't figure this out and any hint or pointer would be greatly appreciated. It now just looks like OSX does not support a secure LDAP over SSL configuration.
    Though it currently isn't set up to be that way, I'd like to have my client also provide a certificate (CN=lhunath.foo.org) and have the server validate that. For now I've got the server set to:
    TLSVerifyClient never
    (And of course, the client:)
    TLS_REQCERT demand
    Message was edited by: lhunath

    By the way; about the assertion error I get in Console; here's the relevant source of ldap.c. Looks like ld is not set; probably something going wrong before that with setting up the TLS connection, perhaps? Or not?
    * ldapsearchext - initiate an ldap search operation.
    * Parameters:
    * ld LDAP descriptor
    int
    ldapsearchext(
    LDAP *ld,
    assert( ld != NULL );

  • How to set up iPhone 5 iOS 6 email with IMAP over SSL on a custom port?

    Basically I have the same problem as this guy 5 years ago but the thread contained no useful answer. Maybe there are people out there who became smarter in the meantime? Please help me out how to get my iPhone read emails via IMAP over SSL on a custom port to the corporate server. The issue is that the iPhone only seems to work if you use the standard 993 port for IMAPS, not with a custom port as we have. I've installed the corporate root certificate in a profile, and it shows up as trusted and verified in the phone, so that should not be the issue. The mail app in the iPhone tries to connect, I can verify that from the server, but then does nothing, doesn't try to authenticate, doesn't log out, nothing is going on, and then drops the connection after 60 seconds. Repeats this every 5 minutes (as set to fetch e-mail every 5 minutes.)
    Original thread 5 years ago: https://discussions.apple.com/message/8104869#8104869

    Solved it by some (a lot) of fiddling.
    Turns out it's not a bug in the iPhone, it's a feature.
    Here's how to make it work.
    DOVECOT
    If the IMAPS port is anything other than 933 (the traditional IMAPS port) the iPhone's Mail App takes the "Use SSL" setting on the IMAP server as 'TLS', meaning it starts the communication in plain text and then issues (tries to issue) the STARTTLS command to switch the connection to encrypted. If, however, Dovecot is set up to start right away in encrypted mode, the two cannot talk to each other. For whatever reason neither the server nor the client realizes the connection is broken and only a timeout ends their misery.
    More explanation about SSL/TLS in the Dovecot wiki: http://wiki2.dovecot.org/SSL
    So to make this work, you have to set Dovecot the following way. (Fyi, I run Dovecot 2.0.19, versions 1.* have a somewhat different config parameters list.)
    1. In the /etc/dovecot/conf.d/10-master.conf file make sure you specify the inet_listener imap and disable (set its port to 0) for imaps like this:
    service imap-login {
      inet_listener imap {
        port = --your port # here--
      inet_listener imaps {
        port = 0
        ssl = yes
    This of course enables unencrypted imap for all hackers of the universe so you quickly need to also do the things below.
    2. In the /etc/dovecot/conf.d/10-ssl.conf file, make sure you set (uncomment) the following:
    ssl = required
    This sets Dovecot to only serve content to the client after a STARTTLS command was issued and the connection is already encrypted.
    3. In /etc/dovecot/conf.d/10-auth.conf set
    disable_plaintext_auth = yes
    This prevents plain text password authentication before encryption (TLS) is turned on. If you have also set ssl=required as per step 2, that will prevent all other kinds of authentications too on an unencrypted connection.
    When debugging this, please note that if you connect from localhost (the same machine the server runs on) disable_plaintext_auth=yes has no effect, as localhost is considered secure. You have to connect from a remote machine to make sure plain text authentication is disabled.
    Don't forget service dovecot restart.
    To test if your setup works as it's supposed to, issue the following (green) from a remote machine (not localhost) (I'm using Ubuntu, but telnet and openssl is available for almost all platforms) and make sure Dovecot responds with something like below (purple):
    telnet your.host.name.here yourimapsportnumber
    * OK [CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE STARTTLS LOGINDISABLED] Dovecot ready.
    Most importantly, make sure you see 'STARTTLS' and 'LOGINDISABLED'. Then issue STARTTLS and hopefully you see something like this:
    a STARTTLS
    a OK Begin TLS negotiation now.
    (The 'a' in front of STARTTLS is not a typo, a prefix is required by the IMAP server in front of all commands.)
    Close the telnet (with 'a logout' or Ctrl+C) and you can use openssl to further investigate as you would otherwise; at the end of a lot of output including the certificate chain you should see a line similar to the one below:
    openssl s_client -starttls imap -connect your.domain.name.here:yourimapsportnumber
    . OK Pre-login capabilities listed, post-login capabilities have more.
    You can then use the capability command to look for what authentication methods are available, if you see AUTH=PLAIN, you can then issue a login command (it's already under an encrypted connection), and if it's successful ("a OK Logged in"), then most likely your iPhone will be able to connect to Dovecot as well.
    a capability
    * CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE AUTH=PLAIN
    a login username password
    * CAPABILITY IMAP4rev1 LITERAL+ SASL-IR LOGIN-REFERRALS ID ENABLE IDLE SORT SORT=DISPLAY THREAD=REFERENCES THREAD=REFS MULTIAPPEND UNSELECT CHILDREN NAMESPACE UIDPLUS LIST-EXTENDED I18NLEVEL=1 CONDSTORE QRESYNC ESEARCH ESORT SEARCHRES WITHIN CONTEXT=SEARCH LIST-STATUS
    a OK Logged in
    POSTFIX
    Likewise, you have to set Postfix to wait for STARTTLS before encrypting the communication.
    1. You have to delete the setting smtpd_tls_wrappermode=yes from /etc/postfix/master.cf and/or /etc/postfix/main.cf, if it was enabled. This will mean Outlook won't be able to connect any more because it requires a TSL connection without issuing STARTTLS as per Postfix documentation (haven't tested.) In my case we don't use Outlook so I didn't care. Outlook + iPhone + custom SMTPS port are simply not possible together at the same time as far as I understand. Pick one to sacrifice.
    2. Require encrypted (TLS) mode for any data transfer in /etc/postfix/main.cf:
    smtpd_tls_security_level = encrypt
    3. Authentication should only happen while already in encrypted (TLS) mode, so set in /etc/postfix/main.cf:
    smtpd_tls_auth_only = yes
    Don't forget postfix reload.
    To test if this works, issue the following telnet and wait for the server's greeting:
    telnet your.host.name.here yoursmtpsportnumber
    220 your.host.name ESMTP Postfix (Ubuntu)
    Then type in the EHLO and make sure the list of options contains STARTTLS and does not include an AUTH line (that would mean unencrypted authentication is available):
    ehlo your.host.name.here
    250-STARTTLS
    Then issue starttls and wait for the server's confirmation:
    starttls
    220 2.0.0 Ready to start TLS
    Once again, it's time to use openssl for further testing, detailed info here http://qmail.jms1.net/test-auth.shtml
    CERTIFICATES
    You also need to be aware that iOS is somewhat particular when it comes to certificates. First of all, you have to make sure to set the following extensions on your root certificate (probably in the [ v3_ca ] section in your /etc/ssl/openssl.cnf, depending on your openssl setup), especially the 'critical' keyword:
    basicConstraints = critical,CA:true
    keyUsage = critical, cRLSign, keyCertSign
    subjectKeyIdentifier=hash
    authorityKeyIdentifier=keyid:always,issuer:always
    And then on the certificate you sign for your mail server, set the following, probably in the [ usr_cert ] section of /etc/ssl/openssl.cnf:
    basicConstraints=CA:FALSE
    keyUsage = nonRepudiation, digitalSignature, keyEncipherment
    subjectKeyIdentifier=hash
    authorityKeyIdentifier=keyid,issuer
    subjectAltName = DNS:your.domain.name.here
    issuerAltName=issuer:copy
    Please note, the above are results of extensive google-ing and trial and error, so maybe you can omit some of the stuff above and it still works. When it started working for me, I stopped experimenting because figuring this all out already took way too much time. The iPhone is horribly undocumented when it comes to details of its peculiar behaviors. If you experiment more and have more accurate information, please feel free to post here as a reply to this message.
    You have to import your root certificate into your iPhone embedded in a profile via the iPhone Configuration Utility (free, but only available in Windows or a Mac; details here: http://nat.guyton.net/2012/01/20/adding-trusted-root-certificate-authorities-to- ios-ipad-iphone/ ), after having first added it to Windows' certificate store as a trusted root certificate. This way the Utility will sign your certificate for the phone and it becomes usable; if you just add it from the phone it will be there but won't be used. Using a profile has the added benefit of being able to configure mail settings in it too, and that saves a lot of time when you have to install, remove, reconfigure, install again, etc. a million times until it works.
    Another undocumented constraint is that the key size is limited to a max of 4096. You can actually install a root certificate with a larger key, the iPhone Configuration Utility will do that for you without a word. The only suspicious thing is that on the confirmation screen shown on your iPhone when you install the profile you don't get the text "Root Certificate/ Installing the certificate will add it to the list of trusted certificates on your iPhone" in addition to your own custom prompt set up in the iPhone Configuration Utility. The missing additional text is your sign of trouble! - but how would know that before you saw it working once? In any case, if you force the big key certificate on the device, then when you open the Mail App, it opens up and then crashes immediately. Again, without a word. Supposedly Apple implemented this limit on the request of the US Government, read more here if you're interested: http://blogs.microsoft.co.il/blogs/kamtec1/archive/2012/10/13/limitation-of-appl e-devices-iphone-ipad-etc-on-rsa-key-size-bit.aspx .
    IN CLOSING...
    With all this, you can read and send email from your iPhone.
    Don't forget to set all your other clients (Thunderbird, Claws, etc.) to also use STARTTLS instead of SSL, otherwise they won't be able to connect after the changes above.

  • BAD_CERTIFICATE error calling a web service over SSL in ALSB 2.6

    We have a business service on an ALSB 2.6 server (running on WL 9.2.1) that connects to a web service over SSL. When we try to run it, we get the following exception:
    <Sep 17, 2009 7:49:17 AM PDT> <Error> <ALSB Kernel> <BEA-380001> <Exception on TransportManagerImpl.sendMessageToService, com.bea.
    wli.sb.transports.TransportException: FATAL Alert:BAD_CERTIFICATE - A corrupt or unuseable certificate was received.
    com.bea.wli.sb.transports.TransportException: FATAL Alert:BAD_CERTIFICATE - A corrupt or unuseable certificate was received.
    at com.bea.wli.sb.transports.TransportException.newInstance(TransportException.java:146)
    at com.bea.wli.sb.transports.http.HttpOutboundMessageContext.send(HttpOu
    tboundMessageContext.java:310)
    at com.bea.wli.sb.transports.http.HttpsTransportProvider.sendMessageAsync(HttpsTransportProvider.java:435)
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
    Truncated. see log file for complete stacktrace
    javax.net.ssl.SSLKeyException: FATAL Alert:BAD_CERTIFICATE - A corrupt or unuseable certificate was received.
    at com.certicom.tls.interfaceimpl.TLSConnectionImpl.fireException(Unknown Source)
    at com.certicom.tls.interfaceimpl.TLSConnectionImpl.fireAlertSent(Unknown Source)
    at com.certicom.tls.record.handshake.HandshakeHandler.fireAlert(Unknown Source)
    at com.certicom.tls.record.handshake.HandshakeHandler.fireAlert(Unknown Source)
    at com.certicom.tls.record.handshake.ClientStateReceivedServerHello.handle(Unknown Source)
    Truncated. see log file for complete stacktrace
    This exception only occurs when hitting the web service through the bus. I have written a standalone Java application that posts to the web service and it works fine. I ran the application on the server where the ALSB is running using the same jdk (1.5.0_06 - the version that ships with 9.2.1) and the same cacerts file so I know it's not a problem with the certificate not being trusted. I have tried updating the cacerts file to the latest one distributed with JRE 1.6 and it still doesn't work.
    After 8 hours of troubleshooting, I'm out of ideas. Does anyone have any suggestiosn?
    Thanks.
    Matt
    Edited by: user6946981 on Sep 17, 2009 7:58 AM

    Are you sure that your standalone application is using the same keystore (eg. cacert)? Default WebLogic configuration uses different keystore (demo).
    I saw BAD_CERTIFICATE error only once and the cause was in keytool that somehow corrupted certificate during import. Deleting and importing certificate again helped me, but I doubt you have the same problem as your standalone application works.
    Another idea ... Is hostname varification used? I know that the error message would look different if this was the cause, but try to add this parameter to your weblogic startup script: -Dweblogic.security.SSL.ignoreHostnameVerification=true
    Last but not least, there is difference between your standalone application and ALSB runtime as WebLogic uses Certicom SSL provider. If you don't find the reason, contact Oracle support. Maybe they can help you to tweak Certicom provider in some way.

  • Web service client behind a proxy server connecting to web service over SSL

    Hi Friends,
    A web service is exposed by an external system over SSL. We are behind a proxy server and are trying to get connected to web service over SSL. <p>
    We are getting the following error on the test browser of workshop<p><p>
    External Service Failure: FATAL Alert:HANDSHAKE_FAILURE - The handshake handler was unable to negotiate an acceptable set of security parameters.<p><p>
    the whole trace is <p>
    <p>JDIProxy attached
    <Sep 24, 2005 9:27:25 AM EDT> <Warning> <WLW> <000000> <Id=creditCheckCtrl:salesExpertServiceControl; Method=creditcheckcontr
    ol.SalesExpertServiceControl.doCreditVerification(); Failure=com.bea.control.ServiceControlException: SERVICE FAULT:
    Code:javax.net.ssl.SSLHandshakeException
    String:FATAL Alert:HANDSHAKE_FAILURE - The handshake handler was unable to negotiate an acceptable set of security parameters
    Detail:
    END SERVICE FAULT>
    <Sep 24, 2005 9:27:26 AM EDT> <Warning> <WLW> <000000> <Id=creditCheckCtrl; Method=creditcheckcontrol.CreditCheck.testCreditC
    heck(); Failure=com.bea.control.ServiceControlException: SERVICE FAULT:
    Code:javax.net.ssl.SSLHandshakeException
    String:FATAL Alert:HANDSHAKE_FAILURE - The handshake handler was unable to negotiate an acceptable set of security parameters
    Detail:
    END SERVICE FAULT [ServiceException]>
    <Sep 24, 2005 9:27:26 AM EDT> <Warning> <WLW> <000000> <Id=top-level; Method=processes.CreditCheck_wf.$__clientRequest(); Fai
    lure=com.bea.wli.bpm.runtime.UnhandledProcessException: Unhandled process exception [ServiceException]>
    <Sep 24, 2005 9:27:26 AM EDT> <Error> <WLW> <000000> <Failure=com.bea.wli.bpm.runtime.UnhandledProcessException: Unhandled pr
    ocess exception [ServiceException]><p>
    I am not able to make out what could be possibly wrong. Please let me know if you guys have any ideas about how to resolve it.
    Thanks
    Sridhar

    did you resolve this problem. I am looking at the same issue. If you did I would really appreciate your response.
    Thanks.

  • Web Service over SSL hangs if sent data size exceeds around 12Kb

    Hi,
    I have a Web Service running on a WebLogic Server 10.3. One of its purposes is to send and receive documents over a one-way SSL connection. The service runs fine if the documents are smaller than around 12Kb, however if its larger than that, the service simply hangs. From SSL debug information it looks like some data is sent but afterwards it simply stops. When testing the Web Service without SSL it works fine, which points to an SSL issue. Also, surprisingly, when it receives documents over the SSL, it also works fine. I assumed there is a parameter that limits the size of the POST message sent over SSL, however all the parameters that I found, that could do that, were already set to unlimited.

    We ended up resolving this issue. It turned out to be something really simple. The client that was sending the soap traffic did not have the proper SSL certificate installed on the server that was generating the soap traffic.

  • Web Service over SSL failing in BEA Workshop

    I have deployed a web service on weblogic 9.2
    I have enabled one-way ssl on it. got a trial ssl certificate from verisign. installed them on the keystore/truststore on the server as well as the jre (cacerts and jssecacerts truststores) being used by the client. the client is on different machine than the server.
    i have developed the service through 'bea weblogic workshop 9.2' now when i try to test the service through the 'web services explorer' within bea weblogic workshop i receive the following error:
    IWAB0135E An unexpected error has occurred.
    IOException
    sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
    on server:
    <Jul 13, 2009 6:45:44 PM EDT> <Warning> <Security> <BEA-090485> <CERTIFICATE_UNKNOWN alert was received from yunus.l1id.local - 10.10.2.72. The peer has an unspecified issue with the certificate. SSL debug tracing should be enabled on the peer to determine what the issue is.>
    if i try to access the web service (over ssl) through the browser (ie/firefox), it works fine. i have generated a proxy class to access this web service through the same bea workshop and that works fine too. certificates are identified and all. i also created a small .net (c#) application that calls this secure web service over ssl from another machine and it works fine too!
    of course non-secure url for the web service is working fine in every case.
    what can be the reason for this failing only in 'web services explorer' in bea workshop?
    cross posted at: http://www.coderanch.com/t/453879/Web-Services/java/Web-Service-over-SSL-failing
    thanks.

    Hello,
    I used this example, when I made my experiments with SSL and Glassfish (GF):
    http://java.sun.com/developer/EJTechTips/2006/tt0527.html#1
    If you have problems with GF I suggest to post a message here:
    http://forums.java.net/jive/forum.jspa?forumID=56
    e.g. here is one thread:
    http://forums.java.net/jive/thread.jspa?threadID=59993&tstart=0
    Miro.

  • BizTalk Tracking Profile Editor not tracking the data and how to implement the Orchestration as wcf service over SSL

    Hi Ashwinprabhu,
    thank you very much for your answer.
    i have one more query, I have orchestration published as wcf service in IIS and internally orchestration calling one more service , it means orchestration sending a request and getting response back from the service.
    actually we are implementing the copy of that called service through biztalk orchestration for system automatic and tracking failed messages and n/w failures.
    But tracking profiler not tracking the Data.
    And we need to develop the http service as https(Over SSL), we implemented in iis using self 
    signed certificate, it is working just browser for wsdl(in browser), we are not able to test the service in wcf test client, it is giving wsdl error, in wsdl schema reference showing with HTTP only,
    please help me how to resolve the issue.
    Teegala

    First things first, I think it's best to publish only schemas as WCF service for dependency management reasons. That said - WSDL availability is covered in the WCF adapter under the behaviors. If you're using HTTPBasic this may be hard to modify, but using
    WCFCustom allows you to add the WSDL behavior and specify that it should be available via HTTPS.
    As to the BAM, are you using TPE within the orchestration or at the port level?  I'd imagine your TPE tracks the start and end events of your orchestration using the Orchestration Schedule.  If you're fairly confident that the TPE is correct and
    yet don't see BAM data 1) make sure your SQL Agent is running healthy and all jobs look OK and 2) check the TDDS tables in both the message box and the BAMPrimaryImport databases.  These will show you if there has been some sort of sync issue. There's
    even a TDDS errors tables - so check that out.
    Kind Regards,
    -Dan
    If this answers your question, please Mark as Answer

  • ORA-29266: end-of-body reached - using SOAP_API over SSL

    Hey guys. I have a simple SOAP_API I am using to send SOAP over SSL. It seems to connect fine but give off some shaky results. This is the error I keep getting:
    ERROR at line 1:
    ORA-29266: end-of-body reached
    ORA-06512: at "SYS.UTL_HTTP", line 1321
    ORA-06512: at "LOANADMIN.SOAP_API", line 229
    ORA-06512: at "LOANADMIN.GET_CITY_FROM_ZIPCODE", line 29
    ORA-06512: at line 2
    it seems to mainly happen on these two peices of code:
    UTL_HTTP.write_text(l_http_request, l_envelope);
    UTL_HTTP.read_text(l_http_response, l_envelope);
    Sometimes the first and sometimes the latter. I know my XML is well formed, and im thinking the response is to big for the variable (im thinking the response could be larger than 32k. not sure though).
    I've searched all over this forum, but it seems like the people who have solutions to this particular problem found it on meta-link. I dont have a meta-link account. Could someone please simply explain the solution and problem im running into?
    That would help a lot. Thanks.
    Mo

    I'm having the same problem, and it is inside the SOAP_API package from http://www.oracle-base.com/dba/miscellaneous/soap_api.sql :
    ORA-29266: end-of-body reached
    ORA-06512: at "SYS.UTL_HTTP", line 1330
    ORA-06512: at "NAPS.SOAP_API", line 119
    I understand the responses given:
    EXCEPTION WHEN UTL_HTTP.end_of_body THEN
    utl_http.end_response(resp);
    END;
    and the suggestion to use UTL_HTTP.read_line instead of UTL_HTTP.read_text, but would like some assistance in modifying the procedure to ensure I get the full response returned.
    The procedure with the error is:
    FUNCTION invoke(p_request IN OUT NOCOPY t_request,
    p_url IN VARCHAR2,
    p_action IN VARCHAR2)
    RETURN t_response AS
    l_envelope VARCHAR2(32767);
    l_http_request UTL_HTTP.req;
    l_http_response UTL_HTTP.resp;
    l_response t_response;
    BEGIN
    generate_envelope(p_request, l_envelope);
    show_envelope(l_envelope);
    l_http_request := UTL_HTTP.begin_request(p_url, 'POST','HTTP/1.1');
    UTL_HTTP.set_header(l_http_request, 'Content-Type', 'text/xml');
    UTL_HTTP.set_header(l_http_request, 'Content-Length', LENGTH(l_envelope));
    UTL_HTTP.set_header(l_http_request, 'SOAPAction', p_action);
    UTL_HTTP.write_text(l_http_request, l_envelope);
    l_http_response := UTL_HTTP.get_response(l_http_request);
    UTL_HTTP.read_text(l_http_response, l_envelope);
    UTL_HTTP.end_response(l_http_response);
    l_response.doc := XMLTYPE.createxml(l_envelope);
    l_response.envelope_tag := p_request.envelope_tag;
    l_response.doc := l_response.doc.extract('/'||l_response.envelope_tag||':Envelope/'||l_response.envelope_tag||':Body/child::node()',
    'xmlns:'||l_response.envelope_tag||'="http://schemas.xmlsoap.org/soap/envelope/"');
    -- show_envelope(l_response.doc.getstringval());
    check_fault(l_response);
    RETURN l_response;
    END;
    I have tested the exact call I am making using 'soapUI 2.5.1' so I can compare results to ensure I get the code right, and I am expecting a response of 1755 bytes (well short of the 32767 that is said to cause this error).
    My call is not over SSL, the call I am trying to make is:
    <soapenv:Envelope xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:abr="http://abr.business.gov.au/ABRXMLSearchRPC/">
    <soapenv:Header/>
    <soapenv:Body>
    <abr:ABRSearchByABN soapenv:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">
    <searchString xsi:type="xsd:string">11006489103</searchString>
    <includeHistoricalDetails xsi:type="xsd:string">N</includeHistoricalDetails>
    <authenticationGuid xsi:type="xsd:string">?</authenticationGuid>
    </abr:ABRSearchByABN>
    </soapenv:Body>
    </soapenv:Envelope>
    The calling code is:
    DECLARE
    l_request soap_api.t_request;
    l_response soap_api.t_response;
    l_return VARCHAR2(32767);
    l_url VARCHAR2(32767);
    l_namespace VARCHAR2(32767);
    l_method VARCHAR2(32767);
    l_soap_action VARCHAR2(32767);
    l_result_name VARCHAR2(32767);
    BEGIN
    l_url := 'http://abr.business.gov.au/abrxmlsearchRPC/ABRXMLSearch.asmx';
    l_namespace := 'http://abr.business.gov.au/ABRXMLSearchRPC/"';
    l_method := 'ABRSearchByABN';
    l_soap_action := 'http://abr.business.gov.au/ABRXMLSearchRPC/ABRSearchByABN';
    l_request := soap_api.new_request(p_method => l_method,
    p_namespace => l_namespace);
    soap_api.add_parameter(p_request => l_request,
    p_name => 'searchString',
    p_type => 'xsd:string',
    p_value => '11006489103');
    soap_api.add_parameter(p_request => l_request,
    p_name => 'includeHistoricalDetails',
    p_type => 'xsd:string',
    p_value => 'N');
    soap_api.add_parameter(p_request => l_request,
    p_name => 'authenticationGuid',
    p_type => 'xsd:string',
    p_value => '?');
    l_response := soap_api.invoke(p_request => l_request,
    p_url => l_url,
    p_action => l_soap_action);
    l_return := l_response.doc.getStringVal();
    dbms_output.put_line('-----------------------------------------------------------');
    dbms_output.put_line(l_return);
    END;
    Edited by: 873298 on 18-Jul-2011 15:41

Maybe you are looking for