Why get "fatal alert: bad_certificate" but "certificate_expired"

Hi all,
I am testing 2 way SSL authentication now.
Expected Result:
When the client side provides a expired client cert to the server during handshaking, the server is supposed to return fatal alert: certificate_expired, which is exactly the client side wanna receive.
Acturally Result:
At first, I test server side with Tomcat, but the coming out result is that server will reject the connection with fatal alert: certificate_unknown.
Then, I try Weblogic. From Weblogic, I can see the warn:
<Nov 16, 2007 3:31:01 PM GMT+08:00>
<Warning><Security><BEA-090479>
<Certificate chain received from 206.225.50.35 - 206.225.50.35 failed date validity checks.>
But the client side will receive fatal alert : bad_certificate.
Any solution to get the expected response from server with fatal alert: certificate_expired?
Your help are appreciated!

Similar Messages

Getting error in OSB :: FATAL Alert:BAD_CERTIFICATE - A corrupt or unuseable certificate was received..

Hi There,
am getting error when invoking a webservice from OSB .
"The invocation resulted in an error: FATAL Alert:BAD_CERTIFICATE - A corrupt or unuseable certificate was received..".
certs were loaded to the trust store and could see certificates in Trust store.
surprisingly, same webservice works from SOA BPEL and even from soapUI.
I even made Host Name verification to NONE... none of those helped.
your suggestions are very much appreciated.
Thanks,
Karthik.

Enable -Dssl.debug=true java option and capture the logs.
You might find this userful
http://weblogic-wonders.com/weblogic/2010/01/28/troubleshooting-ssl-issues/

CA-Signed certificate: Received fatal alert: bad_certificate

Hello. I am still trying to get rmi ssl to work in the way I want (see my post http://forums.sun.com/thread.jspa?threadID=5351278&tstart=15 ).
I read that CA signed certificates are preferred to self signed certificates due to several reasons. Due to the fact, that I want to run a lot of different services, each with an own certificate, it is out of question to let them be signed by a real CA (for now all is in a testing environment and once I have solved all the problems this might become an option).
So for now, I create my own certificate authority and sign the certificates for my services (who interact with each other via ssl).
If there is a flaw in my setup, please tell me. If not continue reading.
In my scenario, a service A is querying a server S to discover a service B. S sends all the information about B back to A, including the certificate of B (so A can use ssl to talk to B). I use client authentication.
Each component uses a keystore, which acts as a truststore at the same time.
When I use self signed certificates and import them to the other keystores (using keytool) everything works as it should.
My setup using ca-signed certificates fails.
At the beginning the server has all the certificates in his keystore (A & B & S, which were signed with the servers secret key, who acts as my CA). A contains the servers certificate and his own, which has been signed with the servers private key (A &S). B contains the servers certificate and his own, which has been signed with the servers private key (B & S).
As far as I understand ssl, if A wants to talk to B, it needs the certificate of B (and needs to trust it).
In my scenario, A is receiving the certificate of B, when it queries the server for information about B. The certificate is imported into As keystore (works), but the method call fails with:
javax.net.ssl.SSLHandshakeException: Received fatal alert: bad_certificate
Is rmi ssl creating and using selfsigned certificates from the private keys in the keystore? Maybe I made a mistake, but I don't see it.
A has a certificate of B (and trusts it, because it was signed by an authority whose certificate is trusted from the beginning). B should trust the certificate of A (because it was signed by the same authority). So why is there a bad certificate?
My guess is, in the ssl handshake, A is using his private key to create a self signed certificate and is sending this to B. B has no reason of trusting a self-signed certificate and the handshake fails.
If you have any ideas, I appreciate them a lot.

ejp wrote:
So for now, I create my own certificate authority and sign the certificates for my services (who interact with each other via ssl).So all you have to do is ensure that every client trusts your CA.This is done by importing the CA's certificate into each trust store.
Each component uses a keystore, which acts as a truststore at the same time.That's a really bad idea. They serve completely different purposes. Don't do that.Ok, I will change that. So the trust store is used for certificates I trust (which then can be used by ssl), the keystore is used to store secret keys or if I want to do "cryptography by hand".
As far as I understand ssl, if A wants to talk to B, it needs the certificate of B (and needs to trust it).That's true if B is a server. If A is the server in this scenario it is B that needs to trust A.
In my scenario, A is receiving the certificate of B, when it queries the server for information about B. The certificate is imported into As keystore (works)Should be truststoreI will change that it's only imported into the trust store (-> will do the separation of trust/key store).
but the method call fails with:
javax.net.ssl.SSLHandshakeException: Received fatal alert: bad_certificateSo there is something wrong with the certificate that B sent.Yes, but I don't know why. I created a certificate signing request (csr) for B (using keytool) and then used openssl to create the certificate. When I use a private key and openssl to create a selfsigned certificate e.g. create csr for B, export private key of B, use openssl to create the certificate with the private key of B), it has the same checksum as a self signed certificate using keytool.
The trust store of B contains the CA signed certificate of B and the CA certificate. I don't understand why it is a "bad certificate".
Maybe separating key and trust store will solve the problem or give some new hints.
Is rmi ssl creating and using selfsigned certificates from the private keys in the keystore?No. SSL doesn't generate certificates at all. You do. SSL just looks in the keystore for a certificate to send that matches what the peer will accept, and sending that.
So maybe the CA cert is used for it, which would be fault. I'm going to check that.
A has a certificate of B (and trusts it, because it was signed by an authority whose certificate is trusted from the beginning). B should trust the certificate of A (because it was signed by the same authority).> A and B don't need mutual trust unless you have needClientAuth set 'true' somewhere, which you haven't mentioned.I mentioned it, but it came to my mind at the end of my post, so it's kind of hidden in the text. So, I do use client authentication.> > My guess is, in the ssl handshake, A is using his private key to create a self signed certificate> No. See above.> > and is sending this to B. B has no reason of trusting a self-signed certificate and the handshake fails.> No. There is something wrong with the certificate that was received by the side that first got the bad_certificate alert.Thanks a lot. I see several things clearer now.

Got SSLKeyException:FATAL Alert:BAD_CERTIFICATE using weblogic ws test tool

Hi,
Iam trying to test the webservices using the WebLogic Webservice standard testing home page. The services work fine without SSL, but if the server is setup to use SSL, I get a BAD CERTIFICATE exception using the testing home page.
Although, when I invoke the services through a different SOAP client they do work with SSL turned on provided I import the trusted ca (using my own certificate authority) to java cacerts file.
I set up the custom trust and identity keystores and Iam using my own trusted authority. Configured the SSL as detailed in
http://e-docs.bea.com/wls/docs81/secmanage/ssl.html
Is this a bug related to WebLogic Webservice testing home page or am I missing something. Any help will be greatly appreciated.
Thanks
Veena.
weblogic.webservice.tools.wsdlp.WSDLParseException: Failed to retrieve WSDL from https://raiders.fgm.com:7002/searchservice/SearchService?WSDL. Please check the URL and make sure that it is a valid XML file [javax.net.ssl.SSLKeyException: FATAL Alert:BAD_CERTIFICATE - A corrupt or unuseable certificate was received.] at weblogic.webservice.tools.wsdlp.DefinitionFactory.createDefinition(Ljava.lang.String;)Lweblogic.xml.xmlnode.XMLNode;(DefinitionFactory.java:151) at weblogic.webservice.tools.wsdlp.WSDLParser.(Ljava.lang.String;)V(WSDLParser.java:76) at weblogic.webservice.WebServiceFactory.createFromWSDL(Ljava.lang.String;Ljava.lang.String;Ljavax.xml.rpc.encoding.TypeMappingRegistry;)Lweblogic.webservice.WebService;(WebServiceFactory.java:108) at weblogic.webservice.WebServiceFactory.createFromWSDL(Ljava.lang.String;Ljavax.xml.rpc.encoding.TypeMappingRegistry;)Lweblogic.webservice.WebService;(WebServiceFactory.java:84) at weblogic.webservice.server.servlet.ServletBase.invokeOperation(Ljava.lang.String;Ljavax.servlet.http.HttpServletRequest;Ljavax.servlet.http.HttpServletResponse;Ljavax.xml.rpc.encoding.TypeMappingRegistry;Lweblogic.webservice.Operation;)V(ServletBase.java:295) at weblogic.webservice.server.servlet.WebServiceServlet.invokeOperation(Ljava.lang.String;Ljavax.servlet.http.HttpServletRequest;Ljavax.servlet.http.HttpServletResponse;Ljavax.xml.rpc.encoding.TypeMappingRegistry;Lweblogic.webservice.Operation;)V(WebServiceServlet.java:343) at weblogic.webservice.server.servlet.ServletBase.handleGet(Ljavax.servlet.http.HttpServletRequest;Ljavax.servlet.http.HttpServletResponse;Lweblogic.webservice.WebService;)V(ServletBase.java:266) at weblogic.webservice.server.servlet.ServletBase.doGet(Ljavax.servlet.http.HttpServletRequest;Ljavax.servlet.http.HttpServletResponse;)V(ServletBase.java:158) at weblogic.webservice.server.servlet.WebServiceServlet.doGet(Ljavax.servlet.http.HttpServletRequest;Ljavax.servlet.http.HttpServletResponse;)V(WebServiceServlet.java:254) at javax.servlet.http.HttpServlet.service(Ljavax.servlet.http.HttpServletRequest;Ljavax.servlet.http.HttpServletResponse;)V(HttpServlet.java:740) at javax.servlet.http.HttpServlet.service(Ljavax.servlet.ServletRequest;Ljavax.servlet.ServletResponse;)V(HttpServlet.java:853) at weblogic.servlet.internal.ServletStubImpl$ServletInvocationAction.run()Ljava.lang.Object;(ServletStubImpl.java:996) at weblogic.servlet.internal.ServletStubImpl.invokeServlet(Ljavax.servlet.ServletRequest;Ljavax.servlet.ServletResponse;Lweblogic.servlet.internal.FilterChainImpl;)V(ServletStubImpl.java:419) at weblogic.servlet.internal.ServletStubImpl.invokeServlet(Ljavax.servlet.ServletRequest;Ljavax.servlet.ServletResponse;)V(ServletStubImpl.java:315) at weblogic.servlet.internal.WebAppServletContext$ServletInvocationAction.run()Ljava.lang.Object;(WebAppServletContext.java:6452) at weblogic.security.acl.internal.AuthenticatedSubject.doAs(Lweblogic.security.subject.AbstractSubject;Ljava.security.PrivilegedAction;)Ljava.lang.Object;(AuthenticatedSubject.java:321) at weblogic.security.service.SecurityManager.runAs(Lweblogic.security.acl.internal.AuthenticatedSubject;Lweblogic.security.acl.internal.AuthenticatedSubject;Ljava.security.PrivilegedAction;)Ljava.lang.Object;(SecurityManager.java:118) at weblogic.servlet.internal.WebAppServletContext.invokeServlet(Lweblogic.servlet.internal.ServletRequestImpl;Lweblogic.servlet.internal.ServletResponseImpl;)V(WebAppServletContext.java:3661) at weblogic.servlet.internal.ServletRequestImpl.execute(Lweblogic.kernel.ExecuteThread;)V(ServletRequestImpl.java:2630) at weblogic.kernel.ExecuteThread.execute(Lweblogic.kernel.ExecuteRequest;)V(ExecuteThread.java:219) at weblogic.kernel.ExecuteThread.run()V(ExecuteThread.java:178) at java.lang.Thread.startThreadFromVM(Ljava.lang.Thread;)V(Unknown Source)

Thank You Prasanna for your response.
I converted the trusted CA cert to PEM format and copied it to the domain directory and restarted the weblogic server after setting the following properties weblogic.webservice.client.ssl.strictcertchecking=false
weblogic.security.SSL.ignoreHostnameVerification=true
But, Iam still getting the BAD certificate exception.
Thanks
Veena.

FATAL Alert:BAD_CERTIFICATE - A corrupt or unuseable certificate was receiv

I am trying to invoke a third part web-service (EDC RAVE) through the Oracle Service Bus/Weblogic Server. However whenever I try to use a business service to connect I get the following error message:
The invocation resulted in an error: FATAL Alert:BAD_CERTIFICATE - A corrupt or unuseable certificate was received..
I have tried to add the certificate to the set of trusted demo certificates but that doesn't seem to have solved the problem. Does anyone know how to resolve the problem?
The only solution I have found is:
http://download.oracle.com/docs/cd/E13222_01/wls/docs81/webserv/trouble.html#1071057
But I am using 10.3, not 8.1.

Hi,
I am getting the same error while invoking a Rave webservice from ALSB or from a web application hosted on weblogic 10.3.
I have tried first two of the options below, still got the same execption:
1) Disable host name verification ( never a pleasant thought )
2) Write your own custom hostname verification
3) Ask them to get a cert specific to their host ( with a CN of "someserver.mdsol.com, for instance ).
3rd one is not an option for us, as Medidata does not want to do any change in their setup or to obtain new certificate with CN specific to their host.
After troubleshooting for several days I am out of ideas. Would appreciate if someone helps me on this.
Some further details:
The Rave server presents a wildcard certificate with CN as *.mdsol.com. I have imported all the certificates in the chain to the trust store.
Configured the trust store in weblogic and disabled host name verification.
I have enabled the ssl debug, when i invoke Rave webservice, getting the following errors :
<Aug 29, 2010 8:05:18 PM IST> <Debug> <SecuritySSL> <BEA-000000> <Use Certicom SSL with Domestic strength>
<Aug 29, 2010 8:05:18 PM IST> <Debug> <SecuritySSL> <BEA-000000> <Ignoring not supported JCE Mac: SunJCE version 1.6 for algorithm HmacSHA1>
<Aug 29, 2010 8:05:18 PM IST> <Debug> <SecuritySSL> <BEA-000000> <Will use default Mac for algorithm HmacSHA1>
<Aug 29, 2010 8:05:18 PM IST> <Debug> <SecuritySSL> <BEA-000000> <Ignoring not supported JCE Mac: SunJCE version 1.6 for algorithm HmacMD5>
<Aug 29, 2010 8:05:18 PM IST> <Debug> <SecuritySSL> <BEA-000000> <Will use default Mac for algorithm HmacMD5>
<Aug 29, 2010 8:05:18 PM IST> <Debug> <SecuritySSL> <BEA-000000> <Ignoring not supported JCE KeyAgreement: SunJCE version 1.6 for algorithm DiffieHellman>
<Aug 29, 2010 8:05:18 PM IST> <Debug> <SecuritySSL> <BEA-000000> <Will use default KeyAgreement for algorithm DiffieHellman>
<Aug 29, 2010 8:05:18 PM IST> <Debug> <SecuritySSL> <BEA-000000> <Will use default KeyAgreement for algorithm ECDH>
<Aug 29, 2010 8:05:18 PM IST> <Debug> <SecuritySSL> <BEA-000000> <Using JCE Cipher: SunJCE version 1.6 for algorithm DESede/CBC/NoPadding>
<Aug 29, 2010 8:05:18 PM IST> <Debug> <SecuritySSL> <BEA-000000> <Using JCE Cipher: SunJCE version 1.6 for algorithm DES/CBC/NoPadding>
<Aug 29, 2010 8:05:18 PM IST> <Debug> <SecuritySSL> <BEA-000000> <Using JCE Cipher: SunJCE version 1.6 for algorithm AES/CBC/NoPadding>
<Aug 29, 2010 8:05:18 PM IST> <Debug> <SecuritySSL> <BEA-000000> <Using JCE Cipher: SunJCE version 1.6 for algorithm RC4>
<Aug 29, 2010 8:05:18 PM IST> <Debug> <SecuritySSL> <BEA-000000> <Using JCE Cipher: SunJCE version 1.6 for algorithm RSA>
<Aug 29, 2010 8:05:18 PM IST> <Debug> <SecuritySSL> <BEA-000000> <Using JCE Cipher: SunJCE version 1.6 for algorithm RSA/ECB/NoPadding>
<Aug 29, 2010 8:05:18 PM IST> <Debug> <SecuritySSL> <BEA-000000> <SSL Session TTL :90000>
<Aug 29, 2010 8:05:18 PM IST> <Debug> <SecuritySSL> <BEA-000000> <SSLSetup: loading trusted CA certificates>
<Aug 29, 2010 8:05:18 PM IST> <Debug> <SecuritySSL> <BEA-000000> <SSL enableUnencryptedNullCipher= false>
<Aug 29, 2010 8:05:18 PM IST> <Debug> <SecuritySSL> <BEA-000000> <SSLContextManager: loading server SSL identity>
<Aug 29, 2010 8:05:18 PM IST> <Notice> <Security> <BEA-090171> <Loading the identity certificate and private key stored under the alias usadc-vsedc35.quintiles.
net from the JKS keystore file C:\eDC-ODM\Beta\ssl\wls\dev1\WLS1\keystore\edc_server.jks.>
<Aug 29, 2010 8:05:18 PM IST> <Debug> <SecuritySSL> <BEA-000000> <Loaded public identity certificate chain:>
<Aug 29, 2010 8:05:18 PM IST> <Debug> <SecuritySSL> <BEA-000000> <Subject: CN=usadc-vsedc35.quintiles.net, OU=Global Solutions, O=Quintiles, L=Morrisville, ST=NC, C=US; Issuer: CN=USKAN-SECSA01, DC=quintiles, DC=net>
<Aug 29, 2010 8:05:18 PM IST> <Debug> <SecuritySSL> <BEA-000000> <Subject: CN=USKAN-SECSA01, DC=quintiles, DC=net; Issuer: CN=uskan-secs02, DC=quintiles, DC=net>
<Aug 29, 2010 8:05:18 PM IST> <Debug> <SecuritySSL> <BEA-000000> <Subject: CN=uskan-secs02, DC=quintiles, DC=net; Issuer: CN=uskan-secs02, DC=quintiles, DC=net>
<Aug 29, 2010 8:05:18 PM IST> <Debug> <SecuritySSL> <BEA-000000> <Using JCE Cipher: SunJCE version 1.6 for algorithm RSA/ECB/NoPadding>
<Aug 29, 2010 8:05:20 PM IST> <Notice> <Security> <BEA-090169> <Loading trusted certificates from the JKS keystore file C:\eDC-ODM\Beta\ssl\alsb\truststore\pftrust.jks.>
<Aug 29, 2010 8:05:20 PM IST> <Debug> <SecuritySSL> <BEA-000000> <SSLContextManager: loaded 4 trusted CAs from C:\eDC-ODM\Beta\ssl\alsb\truststore\pftrust.jks>
<Aug 29, 2010 8:05:20 PM IST> <Debug> <SecuritySSL> <BEA-000000> <Subject: CN=ca.webcrf.net, OU=IAS Engineering, O=Phase Forward, L=Waltham, ST=Massachusetts, C=US; Issuer: CN=ca.webcrf.net, OU=IAS Engineering, O=Phase Forward, L=Waltham, ST=Massachusetts, C=US>
<Aug 29, 2010 8:05:20 PM IST> <Debug> <SecuritySSL> <BEA-000000> <Subject: OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc.", C=US; Issuer: OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc.", C=US>
<Aug 29, 2010 8:05:20 PM IST> <Debug> <SecuritySSL> <BEA-000000> <Subject: CN=*.mdsol.com, OU=Domain Control Validated, O=*.mdsol.com; Issuer: SERIALNUMBER=07969287, CN=Go Daddy Secure Certification Authority, OU=http://certificates.godaddy.com/repository, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US>
<Aug 29, 2010 8:05:20 PM IST> <Debug> <SecuritySSL> <BEA-000000> <Subject: SERIALNUMBER=07969287, CN=Go Daddy Secure Certification Authority, OU=http://certificates.godaddy.com/repository, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US; Issuer: OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc.", C=US>
<Aug 29, 2010 8:05:20 PM IST> <Debug> <SecuritySSL> <BEA-000000> <Failed to load server trusted CAs
java.security.cert.CertificateParsingException: Could not set value for ASN.1 string object.
at com.certicom.security.cert.internal.x509.X509V3CertImpl.<init>(Unknown Source)
at com.certicom.tls.interfaceimpl.CertificateSupport.addTrustedCertificate(Unknown Source)
at com.certicom.net.ssl.SSLContext.addTrustedCertificate(Unknown Source)
at com.bea.sslplus.CerticomSSLContext.addTrustedCA(Unknown Source)
at weblogic.security.utils.SSLContextWrapper.addTrustedCA(SSLContextWrapper.java:62)
at weblogic.security.utils.SSLContextManager.createServerSSLContext(SSLContextManager.java:424)
at weblogic.security.utils.SSLContextManager.getDefaultServerSSLContext(SSLContextManager.java:318)
at weblogic.security.utils.SSLContextManager.getServerTrustedCAs(SSLContextManager.java:279)
at weblogic.security.utils.SSLSetup.getTrustedCAs(SSLSetup.java:438)
at weblogic.security.utils.SSLSetup.getSSLContext(SSLSetup.java:317)
at weblogic.security.SSL.SSLClientInfo.getSSLSocketFactory(SSLClientInfo.java:101)
at weblogic.security.SSL.SSLSocketFactory.setSSLClientInfo(SSLSocketFactory.java:218)
at weblogic.security.SSL.SSLSocketFactory.<init>(SSLSocketFactory.java:36)
at weblogic.security.SSL.SSLSocketFactory.getInstance(SSLSocketFactory.java:68)
at weblogic.net.http.HttpsClient.New(HttpsClient.java:561)
at weblogic.net.http.HttpsURLConnection.connect(HttpsURLConnection.java:242)
at com.sun.xml.ws.transport.http.client.HttpClientTransport.getOutput(HttpClientTransport.java:133)
at com.sun.xml.ws.transport.http.client.HttpTransportPipe.process(HttpTransportPipe.java:140)
at com.sun.xml.ws.transport.http.client.HttpTransportPipe.processRequest(HttpTransportPipe.java:86)
at com.sun.xml.ws.api.pipe.Fiber.__doRun(Fiber.java:598)
at com.sun.xml.ws.api.pipe.Fiber._doRun(Fiber.java:557)
at com.sun.xml.ws.api.pipe.Fiber.doRun(Fiber.java:542)
at com.sun.xml.ws.api.pipe.Fiber.runSync(Fiber.java:439)
at com.sun.xml.ws.client.Stub.process(Stub.java:248)
at com.sun.xml.ws.client.dispatch.DispatchImpl.doInvoke(DispatchImpl.java:180)
at com.sun.xml.ws.client.dispatch.DispatchImpl.invoke(DispatchImpl.java:206)
at test.GetFromRWS.doGet(GetFromRWS.java:67)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:707)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:820)
at weblogic.servlet.internal.StubSecurityHelper$ServletServiceAction.run(StubSecurityHelper.java:227)
at weblogic.servlet.internal.StubSecurityHelper.invokeServlet(StubSecurityHelper.java:125)
at weblogic.servlet.internal.ServletStubImpl.execute(ServletStubImpl.java:292)
at weblogic.servlet.internal.ServletStubImpl.execute(ServletStubImpl.java:175)
at weblogic.servlet.internal.WebAppServletContext$ServletInvocationAction.run(WebAppServletContext.java:3495)
at weblogic.security.acl.internal.AuthenticatedSubject.doAs(AuthenticatedSubject.java:321)
at weblogic.security.service.SecurityManager.runAs(Unknown Source)
at weblogic.servlet.internal.WebAppServletContext.securedExecute(WebAppServletContext.java:2180)
at weblogic.servlet.internal.WebAppServletContext.execute(WebAppServletContext.java:2086)
at weblogic.servlet.internal.ServletRequestImpl.run(ServletRequestImpl.java:1406)
at weblogic.work.ExecuteThread.execute(ExecuteThread.java:201)
at weblogic.work.ExecuteThread.run(ExecuteThread.java:173)
>
<Aug 29, 2010 8:05:22 PM IST> <Debug> <SecuritySSL> <BEA-000000> <Filtering JSSE SSLSocket>
<Aug 29, 2010 8:05:22 PM IST> <Debug> <SecuritySSL> <BEA-000000> <SSLIOContextTable.addContext(ctx): 4106403>
<Aug 29, 2010 8:05:22 PM IST> <Debug> <SecuritySSL> <BEA-000000> <SSLSocket will be Muxing>
<Aug 29, 2010 8:05:22 PM IST> <Debug> <SecuritySSL> <BEA-000000> <write SSL_20_RECORD>
<Aug 29, 2010 8:05:22 PM IST> <Debug> <SecuritySSL> <BEA-000000> <isMuxerActivated: false>
<Aug 29, 2010 8:05:23 PM IST> <Debug> <SecuritySSL> <BEA-000000> <11680652 SSL3/TLS MAC>
<Aug 29, 2010 8:05:23 PM IST> <Debug> <SecuritySSL> <BEA-000000> <11680652 received HANDSHAKE>
<Aug 29, 2010 8:05:23 PM IST> <Debug> <SecuritySSL> <BEA-000000> <HANDSHAKEMESSAGE: ServerHello>
<Aug 29, 2010 8:05:23 PM IST> <Debug> <SecuritySSL> <BEA-000000> <isMuxerActivated: false>
<Aug 29, 2010 8:05:24 PM IST> <Debug> <SecuritySSL> <BEA-000000> <11680652 SSL3/TLS MAC>
<Aug 29, 2010 8:05:24 PM IST> <Debug> <SecuritySSL> <BEA-000000> <11680652 received HANDSHAKE>
<Aug 29, 2010 8:05:24 PM IST> <Debug> <SecuritySSL> <BEA-000000> <HANDSHAKEMESSAGE: Certificate>
<Aug 29, 2010 8:05:24 PM IST> <Debug> <SecuritySSL> <BEA-000000> <NEW ALERT with Severity: FATAL, Type: 42
java.lang.Exception: New alert stack
at com.certicom.tls.record.alert.Alert.<init>(Unknown Source)
at com.certicom.tls.record.handshake.HandshakeHandler.handleHandshakeMessages(Unknown Source)
at com.certicom.tls.record.MessageInterpreter.interpretContent(Unknown Source)
at com.certicom.tls.record.MessageInterpreter.decryptMessage(Unknown Source)
at com.certicom.tls.record.ReadHandler.processRecord(Unknown Source)
at com.certicom.tls.record.ReadHandler.readRecord(Unknown Source)
at com.certicom.tls.record.ReadHandler.readUntilHandshakeComplete(Unknown Source)
at com.certicom.tls.interfaceimpl.TLSConnectionImpl.completeHandshake(Unknown Source)
at com.certicom.tls.record.WriteHandler.write(Unknown Source)
at com.certicom.io.OutputSSLIOStreamWrapper.write(Unknown Source)
at java.io.BufferedOutputStream.flushBuffer(BufferedOutputStream.java:65)
at java.io.BufferedOutputStream.flush(BufferedOutputStream.java:123)
at java.io.FilterOutputStream.flush(FilterOutputStream.java:123)
at weblogic.net.http.HttpURLConnection.writeRequests(HttpURLConnection.java:154)
at weblogic.net.http.HttpURLConnection.getInputStream(HttpURLConnection.java:358)
at weblogic.net.http.SOAPHttpsURLConnection.getInputStream(SOAPHttpsURLConnection.java:37)
at weblogic.net.http.HttpURLConnection.getResponseCode(HttpURLConnection.java:947)
at com.sun.xml.ws.transport.http.client.HttpClientTransport.checkResponseCode(HttpClientTransport.java:221)
at com.sun.xml.ws.transport.http.client.HttpTransportPipe.process(HttpTransportPipe.java:149)
at com.sun.xml.ws.transport.http.client.HttpTransportPipe.processRequest(HttpTransportPipe.java:86)
at com.sun.xml.ws.api.pipe.Fiber.__doRun(Fiber.java:598)
at com.sun.xml.ws.api.pipe.Fiber._doRun(Fiber.java:557)
at com.sun.xml.ws.api.pipe.Fiber.doRun(Fiber.java:542)
at com.sun.xml.ws.api.pipe.Fiber.runSync(Fiber.java:439)
at com.sun.xml.ws.client.Stub.process(Stub.java:248)
at com.sun.xml.ws.client.dispatch.DispatchImpl.doInvoke(DispatchImpl.java:180)
at com.sun.xml.ws.client.dispatch.DispatchImpl.invoke(DispatchImpl.java:206)
at test.GetFromRWS.doGet(GetFromRWS.java:67)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:707)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:820)
at weblogic.servlet.internal.StubSecurityHelper$ServletServiceAction.run(StubSecurityHelper.java:227)
at weblogic.servlet.internal.StubSecurityHelper.invokeServlet(StubSecurityHelper.java:125)
at weblogic.servlet.internal.ServletStubImpl.execute(ServletStubImpl.java:292)
at weblogic.servlet.internal.ServletStubImpl.execute(ServletStubImpl.java:175)
at weblogic.servlet.internal.WebAppServletContext$ServletInvocationAction.run(WebAppServletContext.java:3495)
at weblogic.security.acl.internal.AuthenticatedSubject.doAs(AuthenticatedSubject.java:321)
at weblogic.security.service.SecurityManager.runAs(Unknown Source)
at weblogic.servlet.internal.WebAppServletContext.securedExecute(WebAppServletContext.java:2180)
at weblogic.servlet.internal.WebAppServletContext.execute(WebAppServletContext.java:2086)
at weblogic.servlet.internal.ServletRequestImpl.run(ServletRequestImpl.java:1406)
at weblogic.work.ExecuteThread.execute(ExecuteThread.java:201)
at weblogic.work.ExecuteThread.run(ExecuteThread.java:173)
Thanks 'n Regards,
Satya
Edited by: user10115986 on Aug 31, 2010 2:03 AM

Https Issue:SSLHandshakeException:Received fatal alert:bad_certificate

hi experts,
My scenario is Proxy to AS2. In AS2 receiver I have https protocol. I have put SSL Certificate(keystore) value.
Let say
View- x
Certificate name- cer
then I have given
TRUSTED\x\cer
in SSL Certificate(keystore) field of AS2 receiver channel.
Let me know weather it is correct.
Second field in Communication channel is "Private key for Client Authentication". I have kept it as blank.
I am getting an error in AS2 Receiver Channel saying:-
Message processing failed. Cause: javax.resource.ResourceException: Fatal exception: com.sap.aii.af.ra.cci.XIRecoverableException: SEEBURGER AS2: javax.net.ssl.SSLHandshakeException: Received fatal alert: bad_certificate # , SEEBURGER AS2: javax.net.ssl.SSLHandshakeException: Received fatal alert: bad_certificate #
My certificate has not expired yet.
Please help me in this matter.
Thanks
Jaideep

hi experts,
Please look into the below matter and help me to resolve it.
Thanks
Jaideep

Client Auth failure:SSLException Received fatal alert: bad_certificate

Friends,
I have managed to establish a one -way https connection between the client and the tomcat-server by keeping the client-Authentication=false
<Connector
enableLookups="true"
port="8443"
scheme="https"
secure="true"
maxProcessors="75"
debug="0"
clientAuth="false"
keystorePass="arps3241"
keystoreFile="/usr/local/tomcat/bin/arps-dev.keystore"
className="org.apache.coyote.tomcat5.CoyoteConnector"
          minProcessors="5"
sslProtocol="TLS">
</Connector>
. However , when i switch- 'on' the client-Authetication parameter i.e.clientAuth="true" in the server.xml for 2 way trust, I get the following error :-
javax.net.ssl.SSLHandshakeException: Received fatal alert: bad_certificate
     at com.sun.net.ssl.internal.ssl.Alerts.getSSLException(Alerts.java:150)
     at com.sun.net.ssl.internal.ssl.Alerts.getSSLException(Alerts.java:117)
     at com.sun.net.ssl.internal.ssl.SSLSocketImpl.recvAlert(SSLSocketImpl.java:1584)
     at com.sun.net.ssl.internal.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:866)
     at com.sun.net.ssl.internal.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1030)
     at com.sun.net.ssl.internal.ssl.SSLSocketImpl.writeRecord(SSLSocketImpl.java:622)
     at com.sun.net.ssl.internal.ssl.AppOutputStream.write(AppOutputStream.java:59)
     at java.io.BufferedOutputStream.flushBuffer(BufferedOutputStream.java:65)
     at java.io.BufferedOutputStream.flush(BufferedOutputStream.java:123)
     at org.apache.commons.httpclient.HttpConnection.flushRequestOutputStream(HttpConnection.java:827)
     at org.apache.commons.httpclient.HttpMethodBase.writeRequest(HttpMethodBase.java:1975)
     at org.apache.commons.httpclient.HttpMethodBase.execute(HttpMethodBase.java:993)
     at org.apache.commons.httpclient.HttpMethodDirector.executeWithRetry(HttpMethodDirector.java:397)
     at org.apache.commons.httpclient.HttpMethodDirector.executeMethod(HttpMethodDirector.java:170)
     at org.apache.commons.httpclient.HttpClient.executeMethod(HttpClient.java:396)
     at org.apache.commons.httpclient.HttpClient.executeMethod(HttpClient.java:324)
Can any body please guide me?

The server's truststore doesn't trust or possibly even recognize the client's certificate which came from the client's keystore.

Client Authentication - Received fatal alert: bad_certificate

I am making a "secure" chat server that has some simple functionality.
For the server cert, I sent off the CSR to Thawte and set up the trust chain. That keystore seems to be fine:
Keystore type: jks
Keystore provider: SUN
Your keystore contains 2 entries
Alias name: verisigntestroot
Creation date: Nov 10, 2006
Entry type: trustedCertEntry
Owner: CN=Thawte Test CA Root, OU=TEST TEST TEST, O=Thawte Certification, ST=FOR TESTING PURPOSES ONLY, C=ZA
Issuer: CN=Thawte Test CA Root, OU=TEST TEST TEST, O=Thawte Certification, ST=FOR TESTING PURPOSES ONLY, C=ZA
Serial number: 0
Valid from: Wed Jul 31 20:00:00 EDT 1996 until: Thu Dec 31 16:59:59 EST 2020
Certificate fingerprints:
MD5: 5E:E0:0E:1D:17:B7:CA:A5:7D:36:D6:02:DF:4D:26:A4
SHA1: 39:C6:9D:27:AF:DC:EB:47:D6:33:36:6A:B2:05:F1:47:A9:B4:DA:EA
Alias name: server
Creation date: Nov 10, 2006
Entry type: keyEntry
Certificate chain length: 2
Certificate[1]:
Owner: CN=TestServer, OU=Thawte SSL123 certificate, OU=Go to https://www.thawte.com/repository/index.html, OU=Domain Validated, O=TestServer
Issuer: CN=Thawte Test CA Root, OU=TEST TEST TEST, O=Thawte Certification, ST=FOR TESTING PURPOSES ONLY, C=ZA
Serial number: 76369fba895ca9f8f5b44dd1f28307ad
Valid from: Fri Nov 10 15:29:22 EST 2006 until: Fri Dec 01 15:29:22 EST 2006
Certificate fingerprints:
MD5: 5B:7D:EE:B3:0A:CC:7B:B8:A2:73:D3:96:FB:D3:43:ED
SHA1: E2:FD:31:00:D7:9D:F5:93:4E:99:D9:8B:C3:70:87:D9:CF:83:EC:36
Certificate[2]:
Owner: CN=Thawte Test CA Root, OU=TEST TEST TEST, O=Thawte Certification, ST=FOR TESTING PURPOSES ONLY, C=ZA
Issuer: CN=Thawte Test CA Root, OU=TEST TEST TEST, O=Thawte Certification, ST=FOR TESTING PURPOSES ONLY, C=ZA
Serial number: 0
Valid from: Wed Jul 31 20:00:00 EDT 1996 until: Thu Dec 31 16:59:59 EST 2020
Certificate fingerprints:
MD5: 5E:E0:0E:1D:17:B7:CA:A5:7D:36:D6:02:DF:4D:26:A4
SHA1: 39:C6:9D:27:AF:DC:EB:47:D6:33:36:6A:B2:05:F1:47:A9:B4:DA:EA
So next I want to set up my client. The professor said that it's fine to just give the clients all self-signed certs, so I ran:
keytool -genkey -alias client1 -keyalg RSA -keystore c1keystore -storepass client1 -keypass client1 -dname "o=jhu, cn=Client 1"
I assumed that I need to add the Thawte Root CA Cert to this keystore as well since I'm doing client authentication:
keytool -import -v -file ../server/thawtecert.txt -trustcacerts -keystore c1keystore -storepass client1
I start up the server, and then I attempt to connect with the client with these options:
-Djavax.net.ssl.trustStore=server/serverstore
-Djavax.net.ssl.keyStore=client/c1keystore
-Djavax.net.ssl.keyStorePassword=client1
Now when I attempt to connect to the server and write to the buffer, I get this error on the client side:
javax.net.ssl.SSLHandshakeException: Received fatal alert: bad_certificate
And this error on the server side:
javax.net.ssl.SSLException: Connection has been shutdown: javax.net.ssl.SSLHandshakeException: null cert chain
If I connect to the server with these options, I connect fine:
-Djavax.net.ssl.trustStore=server/serverstore
-Djavax.net.ssl.keyStore=server/serverstore
-Djavax.net.ssl.keyStorePassword=server
I assume this means that I have done something very wrong creating the client's keystore. Does anyone know how I'm supposed to create it?

Hi ,
Even i get the same error . Although ,I imported the contents of my self-signed certificate into the truststore of tomcat i.e.cacerts file of jre/lib/security (in tomcat) , I get the following error:-
Tomcat does not seem to accept the client's certitficate.
Also , Incase if i use a standalone Java application to connect to a tomcat application , I get the same error? Any idea as to how does tomcat server authenticate the client from a standalone Java application .
javax.net.ssl.SSLHandshakeException: Received fatal alert: bad_certificate
     at com.sun.net.ssl.internal.ssl.Alerts.getSSLException(Alerts.java:150)
     at com.sun.net.ssl.internal.ssl.Alerts.getSSLException(Alerts.java:117)
     at com.sun.net.ssl.internal.ssl.SSLSocketImpl.recvAlert(SSLSocketImpl.java:1584)
     at com.sun.net.ssl.internal.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:866)
     at com.sun.net.ssl.internal.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1030)
     at com.sun.net.ssl.internal.ssl.SSLSocketImpl.writeRecord(SSLSocketImpl.java:622)
     at com.sun.net.ssl.internal.ssl.AppOutputStream.write(AppOutputStream.java:59)
     at java.io.BufferedOutputStream.flushBuffer(BufferedOutputStream.java:65)
     at java.io.BufferedOutputStream.flush(BufferedOutputStream.java:123)
     at org.apache.commons.httpclient.HttpConnection.flushRequestOutputStream(HttpConnection.java:827)
     at org.apache.commons.httpclient.HttpMethodBase.writeRequest(HttpMethodBase.java:1975)
     at org.apache.commons.httpclient.HttpMethodBase.execute(HttpMethodBase.java:993)
     at org.apache.commons.httpclient.HttpMethodDirector.executeWithRetry(HttpMethodDirector.java:397)
     at org.apache.commons.httpclient.HttpMethodDirector.executeMethod(HttpMethodDirector.java:170)
     at org.apache.commons.httpclient.HttpClient.executeMethod(HttpClient.java:396)
     at org.apache.commons.httpclient.HttpClient.executeMethod(HttpClient.java:324)

I always get FATAL ALERT: Fatal Exception everytime i try to hot sync

i am trying to sync my tungsten E2 which i just bought refurbished. i installed my own software since my last tungsten E2 went kaput ( so i previously owned a tungsten E2 ). i always get FATAL ALERT: Fatal Exception everytime i try to hot sync. what is wrong? thank you.
Post relates to: Tungsten E2

As with most problems that occur on a Palm PDA, it is either software or hardware related and we have to determine which one.
If your device is not locked up, the best method is to first make a complete backup of your unit to your SD card using the free "NVBackup" (available from http://www.freewarepalm.com) After the backup is complete, Hard Reset the unit, then test to see if full functionality returns.
To perform a Hard Reset:
While pressing and holding the Power button down, tap and release the Reset button in back and continue to hold the Power button down. When the grey Palm logo appears, you can release the Power button.
You should now see the warning page in about 5 languages. Press the UP direction on the 5-way pad to complete the task. Your Palm will reset itself several times as it re-installs the original programs and erases all your previous data.
DO NOT HOTSYNC YET! Test the unit before reinstalling any software. If the unit works correctly, your problem is being caused by a "drug interaction" of software - maybe one rogue program, or a combination of several. You'll have to reinstall the third-party programs one or a few at a time to find the problem one. To avoid re-installing a software issue, rename your /Backup directory in your Palm folder (on a PC it's found here: C/Program Files/Palm(One)/"your HotSync ID name truncated"/Backup) to something like "/BackupOLD". Now perform the HotSync, choose your HotSync name you've been using, and all your PIM data will return, but not the third-party programs. Test for functionality again. If all is good, start installing the old programs from your /BackupOLD directory one (or a few if brave) at a time.
If the unit does not work after a Hard Reset is performed correctly, then it may be Hardware-related. (If it's a connection problem via either BlueTooth or Wifi, be sure nothing has changed on the unit you're trying to connect to!)
Hope this has helped,
Wyrenut
I am a Volunteer here, not employed by HP.
You too can become an HP Expert! Details HERE!
If my post has helped you, click the Kudos Thumbs up!
If it solved your issue, Click the "Accept as Solution" button so others can benefit from the question you asked!

WLS 10.3.3 (OSB) Exception faced : General runtime error: FATAL Alert:BAD_CERTIFICATE - A corrupt or unuseable certificate was received.

WLS 10.3.3 not supporting SHA2 cert at provider end . (wild card certificate cannot be imported to trusted certs)
During integration from OSB 11g we face below exception :
General runtime error: FATAL Alert:BAD_CERTIFICATE - A corrupt or unuseable certificate was received
Regards,
Anitha

Enable -Dssl.debug=true java option and capture the logs.
You might find this userful
http://weblogic-wonders.com/weblogic/2010/01/28/troubleshooting-ssl-issues/

Getting "Fatal Alert PUtils.h, Line 74, Invalid counter...

I have not clue what is going on. I have a Palm m515. I tried to contact the support over the phone but their accent is a lot worse than mine; I could not understand anything.
I have backed up the information, done a hard reset and still getting those messages.
I was planning to get another device, I would like to get the Palm Treo Pro, but I am very disappointed w/ the customer support that Palm has; probably the worse I ever seen.
I would very much appreciate any information you can give me about this. I heard there is a software that repairs corrupted files, or something like that. Let me know please. I really need my PDA!!
Thanks
Post relates to: Palm m515

I spent several hours today working on this deal. I did a hard reset. No problems.
Then I went to the address that you indicated. No back up folder.
I realized that the Palm folder stands alone as part of the "Presario" in the C: drive. After opening "Palm" several files opened:
PqiTemp, Add-on, components, helpnote, image Library, "Juan", etc., addcn30.dl, AlarmApp,e..., etc., Currency,ini....
There is one called "BAKCN20.DLL".. The last one on that group es zlib.dll
I opened each one, and in the "Juan" there are several others: address, archive, Backup, datebook, expense, install, mail, memopad, etc.
I opened the Backup, and has large number of files: Archimedes, Emer drugs, mathlib.prc, Med alert, etc.
Is this the one I have to rename? I want to make sure because there is another one in this group called "BackupBuddyVFS.PRC" I believed this is the one I bought following the recommendation of the company that produces one of the applications to back up all the files when I did the hard reset; so I would not lose any information...
I freaked out when I saw my empty Palm, so, I went to my external drive "E Book" that I bought also following recommendations of another software manufacturer and did not have problems in recovering the whole thing again, including the
ocassional "Fatal Alert PUtils., Line 74, invalid counter"... but at least I have all my bank accounts, and private information back on the PDA.
My questions are: Once I change the name of the back up folder to "backup.old". When I do a sync it will not recognize it any more?
I start downloading again all my programs one by one...the minute I get the Fatal Alert...that's it?
Can I delete the file that produced it, and the problem will be solved?
Worse case scenario? Do I have to get another PDA?
If I get a Palm Treo Pro, and I start loading my applications, how do I know I am not going to have the same problem? What do I do next?
I hope the questions are not to stupid but computers are not my thing. I really appreciate your help though!
Juan

Webcenter Spaces Events Service configuration: FATAL Alert BAD CERTIFICATE

Hello,
I have a simple requirement to connect the events taskflow from an exchange server that is https and has a confirmed security certificate. I use the wsdl path for the events service and add it to my webcenter spaces service configuration -> Personal Events configuration.
Then I ran into this error.
javax.net.ssl.SSLKeyException: FATAL Alert:BAD_CERTIFICATE - A corrupt or unuseable certificate was received.
So, I downloaded the .crt file from Chrome (in per format) and used the keytool to upload the certificate exception into the cacerts file inside jdk and jrocket folders. I restart the managed server running WebCenter Spaces. This had no effect on the error.
Is there anything else that I should do?
Thanks,
Pradyumna

I have the same problem. Did You resolve it?

Fatal Alert memorymgr.c, line:3751,free handle after hotsync

I have just reloaded my palm software and now I keep getting fatal alert memorymgr.c, line:3751,free handle after I hotsync. which is causing me to soft reset after hotsyncing.
I deleted add-it and reloaded, did the same with documents to go and yet I'm still having the error - Any ideas????!!!
Thanks....
Post relates to: Tungsten E2

- try to do a hard reset on the hh..
- look for your BACKUP folder and rename it to lets say, BACKUP1...backup folder is located at C: <program files <palm < USERNAME <backup....
- hotsync again..
hope it will solve your problem...

Why do I not get any alerts on my phone but I get them on my iPad?

I recently got an iPad today and was syncing all my apps onto my iPad that I have on my iPhone 4s. But now I don't get any notifications or alerts on my phone, they all go straight to my iPad. How do I get the alerts back onto my phone.

I figured it out lol. the "headphones" was the giveaway. the headphones plug was full of lint. so I cleaned it up and it seems to be working fine. Thanks for the replys!

I got warning in audit log but I don't get any alerts...

Hello,
I have File Adapter sender with FCC.
Because I was curious how FCC will behave when invalid file is used as a source file.
I deleted much of the contents in the source file and the File adpater with FCC read it.
In communication channel monitoring in RWB, I got this message in Audit log.
"Empty document found - proceed without sending message".
However, I cannot find this message anywhere else... Either in Message Monitoring (RWB) or SXMB_MONI (SAPGUI).
Also, I don't get any alerts.
How do I get alerts when file is not processed by file adapter?
Also, how do I view alert view for this kind of error?
Thank you.
-Won

Hi Won,
I suppose that you have checked alredy that your alerts are setup correctly and rules are defined for it.
First, you might set the log level of the file adapter to debug - you should see the issue in the NWA log.
Should PI try to generate an alert but fails, you would also see it here and locate your problem.
But, my opinon is that your chances are not very good to get an alert in such case. SAP decided for which issue they issue an alert and for which not.
When you have an empty file in the file adapter, it seems that SAP thiks that this is not to critical and therefore they don't issue an alert.
The reason why you dont see it anywhere else is, that the adapter generates a message id only when there is something to make a message. Empty file means no message and you can not see it in the monitoring tools.
best regards,
Markus

Why get "fatal alert: bad_certificate" but "certificate_expired"

Similar Messages

Maybe you are looking for