App Connect

App Connect

Join this online user group to communicate across IBM product users and experts by sharing advice and best practices with peers and staying up to date regarding product enhancements.

 View Only
Back to discussions
Expand all | Collapse all

App ssl issue while connect to an external web service

  • 1.  App ssl issue while connect to an external web service

    Posted Wed February 19, 2025 01:34 PM

    Hello Team,
    I am trying to reach a web service  from a SOAP request node  but facing the below issue

    HTTP Response Error, send to alternate: Node throwing exception / Error occurred in ImbSOAPRequestHelper::makeSOAPRequest() / WebService Request Exception / A Web Service request has detected a SOCKET error whilst invoking a web service located at host &1, on port &2, on path &3. RecoverableException<com.ibm.broker.plugin.MbRecoverableException class:SecurityUtils method:loadKeystore source:BIPmsgs key:3537 >
    the BIP messages refers to "unable to open keystore due to error "
    The jks file is placed in home/aceuser/ace-server/xxx.jks and the integration server server.conf.yaml has been updated for

       keystoreType: 'JKS'
        keystoreFile: 'home/aceuser/keystores/xxx.jks'
        keystorePass: 'password'
        truststoreType: 'JKS'
        truststoreFile: 'home/aceuser/keystores/xxx.jks'
        truststorePass: 'password'

    Things I checked
    1.the keystore has the correct permission
    2.Used the keytool list to find the expiry and the keystore type-all good 
    Please let me know if you need more info
    Thanks a lot



    ------------------------------
    madhu ram
    ------------------------------


  • 2.  RE: App ssl issue while connect to an external web service

    Posted Thu February 20, 2025 08:39 AM

    The location you advertized in the yaml file does not match the location you say you put the file in ...



    ------------------------------
    Francois Brandelik
    ------------------------------

    Original Message


  • 3.  RE: App ssl issue while connect to an external web service

    Posted Thu February 20, 2025 12:35 PM
    Edited by Rogerio Silva de Almeida Thu February 20, 2025 12:35 PM

    Hi madhu ram,

    This is a example of server.conf.yaml:
        truststoreType: 'JKS'
        truststoreFile: '/var/mqsi/components/BrokerTrustStore.jks'
        truststorePass: 'is1TrustStore::password'
    Take note of the is1TrustStore::password value in the second command. This should be identical with your integration server name, mine being is1.
    Following command will set the password value given above.
    mqsisetdbparms ACE1 -n is1TrustStore::password -u ignore -p abc@123
    More details on 
    https://ayasothar.medium.com/ibm-app-connect-enterprise-ace-tls-configuration-6137571fbff9
    https://www.ibm.com/docs/en/app-connect/12.0?topic=commands-mqsireportdbparms-command
    https://www.ibm.com/docs/en/app-connect/12.0?topic=commands-mqsisetdbparms-command

    i hope help you.


    ------------------------------
    Rogerio Silva de Almeida
    ------------------------------

    Original Message


  • 4.  RE: App ssl issue while connect to an external web service

    Posted Thu February 20, 2025 12:44 PM

    @madhu ram Can you try with path  keystoreFile: '/home/aceuser/keystores/xxx.jks' and see if that works.



    ------------------------------
    Prosanta Saha
    ------------------------------

    Original Message


  • 5.  RE: App ssl issue while connect to an external web service

    Posted Thu February 20, 2025 12:45 PM
    Hi,
     
    Some questions:
    The service that you are calling using the SOAP request node.Does it require to have mutual-tls or just server-side tls?
    If it doesn't require mutual-tls, then you don't need the keyStore* config in your server-conf.yaml. 
    Does your keystore contain a valid private/public keypair?
    Did you try to have seperate xxx.jks files, one for the truststore and one for the keystore seperate?
    Is the password set in the vault/setdbparms correctly set?
     
    Steps that I would take:
    - check if the keystore config is required, if not disable the keystore* config.
    - if it is required. split the keystore and trustore into 2 seperate jks files.
    - load the private/public key into the keystore with the correct password.
    - check the password with mqsreportdbparms or with mqsicredentials.
     
    Hope this helps


    ------------------------------
    Kim Meynendonckx
    ------------------------------

    Original Message


  • 6.  RE: App ssl issue while connect to an external web service

    Posted Fri February 21, 2025 08:42 AM

    Hello Kim,

    Answering your questions below 

    • Yes the service I am  calling with soap request is using mtls.
    • I made a mistake in the beginning, now I have a keystore and trust store separated.
    • Yes, my key store contains a valid private/public key pair
    • What pwd should I set in vault? The gateway uses mtls for connection ( correct me if I need to set one 
    • As it's an Mtls, keystore config  is required
    • I am facing g an error client TLS cert missing

    Question

    Should I configure the property ssl client key alias in the soap request node

    I tried setting it to the key alias name , but did not work

    Need Inputs 

    Thanks

    Madhu



    ------------------------------
    madhu ram
    ------------------------------

    Original Message


  • 7.  RE: App ssl issue while connect to an external web service

    Posted Mon February 24, 2025 03:55 AM
    Hi Madhu,
     
    You need to set the password of the keystore in the vault or setdbparms like explained by @Rogerio Silva de Almeida
    Make sure that if you have set a decryption/encryption key on your private key that it's the same as your keystore password.
     
    If your keystore only conatians 1 private/publuc key pair then you don't need to specifiy the alias.
     
    Also double check that the path is correct like said by @Francois Brandelik
     
    Normally that should do the trick.
    Double check your keystore. You can install your keystore in your browser or postman and initiate the mtls step.
    If the mtls works then you should get back another soap or functional error(e.g no GET allowed).
     
    What is the error that you currently have?


    ------------------------------
    Kim Meynendonckx
    ------------------------------

    Original Message


  • 8.  RE: App ssl issue while connect to an external web service

    Posted Mon February 24, 2025 05:35 AM

    Hello  Kim

    Thanks for the reply

    I tried to  set up mtls with postman

    And get the error

    Client TLS cert is required.



    ------------------------------
    madhu ram
    ------------------------------

    Original Message


  • 9.  RE: App ssl issue while connect to an external web service

    Posted Mon February 24, 2025 05:40 AM

    Also do we need the vault if the keystore is using default pwd . Pardon my ignorance .



    ------------------------------
    madhu ram
    ------------------------------

    Original Message


  • 10.  RE: App ssl issue while connect to an external web service

    Posted Mon February 24, 2025 08:14 AM

    Looks like you have a Key infrastructure error.

    Make sure that you have

    • a client key define in the keystore
    • the client signer chain available in the keystore
    • the client root cert in the destination's truststore
    • the destination server chain in the truststore
    • a password defined on each of the stores set either with set dbparms or in the vault

    Hope it helps



    ------------------------------
    Francois Brandelik
    ------------------------------

    Original Message


  • 11.  RE: App ssl issue while connect to an external web service

    Posted Mon February 24, 2025 08:30 AM

    Thank you so much. Will try  the above  and update.



    ------------------------------
    madhu ram
    ------------------------------

    Original Message


  • 12.  RE: App ssl issue while connect to an external web service

    Posted Thu February 27, 2025 02:29 AM
    Edited by madhu ram Thu February 27, 2025 02:30 AM

    Thanks everyone

    Now The cert issue is resolved , I am am get a sucessful repsonse from API using thepostman as client
    But my app connect broker app gives me 403  forbidden error as the client cert is getting provided to the server for Mutual authentication.

    Things I tried 

    1. truststore in server.conf.yaml updated with the server cert
    2. keystore-here is where the problem is. I have created pem file of client certificate  and using keytool to create a jks  and update the keystore with the keystore.jks file but it fails .I tried creating a pkcs12 type with .p12 extension from the pem but it also does not work 
      Please help



    ------------------------------
    madhu ram
    ------------------------------

    Original Message


  • 13.  RE: App ssl issue while connect to an external web service

    Posted Thu February 27, 2025 07:49 AM

    That's because most likely your keystore only contains the public cert and does not contain the corresponding private key.

    You can check that using the pkcs12 format and openssl (google it).



    ------------------------------
    Francois Brandelik
    ------------------------------

    Original Message


  • 14.  RE: App ssl issue while connect to an external web service

    Posted Fri February 28, 2025 02:01 AM

    Hi ,

    Like @Francois Brandelik said it's probably related to an incorrect keystore. I often use Keystore explorer(free tool).

    A good keystore should look like this.

    mvg


    ------------------------------
    Kim Meynendonckx
    ------------------------------

    Original Message


  • 15.  RE: App ssl issue while connect to an external web service

    Posted Fri February 28, 2025 06:05 AM

    Thanks all. The keystore looks valid. Please pardon my ignorance  for asking this, how will the broker app using soap request node understand that  it should use mtls. Is it from the server.conf.yaml fields JVM : keystore, trustore or should I configure any properties in the soap request node .



    ------------------------------
    madhu ram
    ------------------------------

    Original Message


  • 16.  RE: App ssl issue while connect to an external web service

    Posted Fri February 28, 2025 08:54 AM

    mTLS is configured on the service being connected to, and the SSL/TLS handshake enforces this security mechanism. During the handshake, if the request node receives a client certificate request, it provides the client certificate configured on the integration server or node.
    If none is found then the SSL handshake terminates with client certificate issue as reason.



    ------------------------------
    Kim Meynendonckx
    ------------------------------

    Original Message


  • 17.  RE: App ssl issue while connect to an external web service

    Posted Sun March 02, 2025 09:48 PM
    Edited by madhu ram Thu March 06, 2025 04:35 AM

    Thanks a lot all,
    I was able to proceed a bit.
    Scenario: I convert PEM  to PKCS12 using openssl and to JKS using key tool command
    .The Server.conf.yaml has been updated with the keystore ,trustore and the pwd to use 
    in the JVM section. But somehow I get the error
    setSSLOptions / java.lang.IllegalArgumentException: password can't be null ]
    while opening the keystore.

    If I manually set the password using the System.setProperty("javax.net.ssl.keyStorePassword", "xxxxx")in my app connect flow., I am able to succeed.
    Please note that I am using an independent integration server and followed the instructions below

    https://www.ibm.com/docs/en/app-connect/11.0.0?topic=ps-viewing-setting-keystore-truststore-runtime-properties-integration-server-level

    Right now I am not using vault.

    Update :The issue is resolved by using vault

    Thanks

    Madhu



    ------------------------------
    madhu ram
    ------------------------------

    Original Message


  • 18.  RE: App ssl issue while connect to an external web service

    Posted Thu February 20, 2025 12:45 PM

    You say you placed the jks files in 

    home/aceuser/ace-server/xxx.jks

    But your yaml gives a different directory: 

    keystoreFile: 'home/aceuser/keystores/xxx.jks'
truststoreFile: 'home/aceuser/keystores/xxx.jks'

    Could it be that it is that simple?



    ------------------------------
    Francois Brandelik
    ------------------------------

    Original Message