Thank you so much. Will try the above and update.
Original Message:
Sent: Mon February 24, 2025 08:13 AM
From: Francois Brandelik
Subject: App ssl issue while connect to an external web service
Looks like you have a Key infrastructure error.
Make sure that you have
- a client key define in the keystore
- the client signer chain available in the keystore
- the client root cert in the destination's truststore
- the destination server chain in the truststore
- a password defined on each of the stores set either with set dbparms or in the vault
Hope it helps
------------------------------
Francois Brandelik
Original Message:
Sent: Mon February 24, 2025 05:39 AM
From: madhu ram
Subject: App ssl issue while connect to an external web service
Also do we need the vault if the keystore is using default pwd . Pardon my ignorance .
------------------------------
madhu ram
Original Message:
Sent: Mon February 24, 2025 05:35 AM
From: madhu ram
Subject: App ssl issue while connect to an external web service
Hello Kim
Thanks for the reply
I tried to set up mtls with postman
And get the error
Client TLS cert is required.
------------------------------
madhu ram
Original Message:
Sent: Mon February 24, 2025 03:54 AM
From: Kim Meynendonckx
Subject: App ssl issue while connect to an external web service
Hi Madhu,
Make sure that if you have set a decryption/encryption key on your private key that it's the same as your keystore password.
If your keystore only conatians 1 private/publuc key pair then you don't need to specifiy the alias.
Normally that should do the trick.
Double check your keystore. You can install your keystore in your browser or postman and initiate the mtls step.
If the mtls works then you should get back another soap or functional error(e.g no GET allowed).
What is the error that you currently have?
------------------------------
Kim Meynendonckx
Original Message:
Sent: Fri February 21, 2025 08:41 AM
From: madhu ram
Subject: App ssl issue while connect to an external web service
Hello Kim,
Answering your questions below
- Yes the service I am calling with soap request is using mtls.
- I made a mistake in the beginning, now I have a keystore and trust store separated.
- Yes, my key store contains a valid private/public key pair
- What pwd should I set in vault? The gateway uses mtls for connection ( correct me if I need to set one
- As it's an Mtls, keystore config is required
- I am facing g an error client TLS cert missing
Question
Should I configure the property ssl client key alias in the soap request node
I tried setting it to the key alias name , but did not work
Need Inputs
Thanks
Madhu
------------------------------
madhu ram
Original Message:
Sent: Thu February 20, 2025 03:09 AM
From: Kim Meynendonckx
Subject: App ssl issue while connect to an external web service
Hi,
Some questions:
The service that you are calling using the SOAP request node.Does it require to have mutual-tls or just server-side tls?
If it doesn't require mutual-tls, then you don't need the keyStore* config in your server-conf.yaml.
Does your keystore contain a valid private/public keypair?
Did you try to have seperate xxx.jks files, one for the truststore and one for the keystore seperate?
Is the password set in the vault/setdbparms correctly set?
Steps that I would take:
- check if the keystore config is required, if not disable the keystore* config.
- if it is required. split the keystore and trustore into 2 seperate jks files.
- load the private/public key into the keystore with the correct password.
- check the password with mqsreportdbparms or with mqsicredentials.
Hope this helps
------------------------------
Kim Meynendonckx
Original Message:
Sent: Wed February 19, 2025 04:12 AM
From: madhu ram
Subject: App ssl issue while connect to an external web service
Hello Team,
I am trying to reach a web service from a SOAP request node but facing the below issue
HTTP Response Error, send to alternate: Node throwing exception / Error occurred in ImbSOAPRequestHelper::makeSOAPRequest() / WebService Request Exception / A Web Service request has detected a SOCKET error whilst invoking a web service located at host &1, on port &2, on path &3. RecoverableException<com.ibm.broker.plugin.MbRecoverableException class:SecurityUtils method:loadKeystore source:BIPmsgs key:3537 >
the BIP messages refers to "unable to open keystore due to error "
The jks file is placed in home/aceuser/ace-server/xxx.jks and the integration server server.conf.yaml has been updated for
keystoreType: 'JKS'
keystoreFile: 'home/aceuser/keystores/xxx.jks'
keystorePass: 'password'
truststoreType: 'JKS'
truststoreFile: 'home/aceuser/keystores/xxx.jks'
truststorePass: 'password'
Things I checked
1.the keystore has the correct permission
2.Used the keytool list to find the expiry and the keystore type-all good
Please let me know if you need more info
Thanks a lot
------------------------------
madhu ram
------------------------------