webMethods

Product/components used and version/fix level:

webMethods microservices runtime 10.11
webMethods API Gateway 10.11
Fix Updates
IS_10.11_Core_Fix4
IS_10.11_WmCloud_Fix2

Detailed explanation of the problem:

I am trying to expose webSocket API to our frontend application team via SAG API gateway. We are able to call IS webSocket API from postman and but when called from API gateway, we are getting below error. We verified the logs and we see that are able to call API gateway webSocket API but when API gateway call IS URL, it is failing. Error seems to be with cert but we installed all the truststore but still getting same error. Also I tried calling normal HTTPS API from API gateway to IS and it works perfectly. So we concluded the issue is with only webSocket API.

Error messages / full error message screenshot / log file:

GMT [YAI.0700.8887E] (tid=2246) [default][apigateway-744f5bc67b-6f9f7] Debug: {1} javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target"

Question related to a free trial, or to a production (customer) instance?

Free trial
Server log (20.0 KB)

Hi Prasad,

please share some screenshots from your API Gateway hosting IS from the pages Security → Certificates and Security → Keystores as well as from the HTTPS -Port you are connecting to.

When using uncommon CAs, the webSocket API might not be able to verify the certificate presented by the API Gateway (or vice versa).
Can you describe in detail in which direction the call works and in which not?

Regards,
Holger

Hello @Holger_von_Thomsen,
Thank you for reply,

I have added some screenshot for your reference. we are calling websocket URL of API gateway and it throws an error while connecting to websocket URL of IS where websocket server configuration are available. The error logs i have shared is from API Gateway of hosting IS.

IS websocket URL works fine from postman separately. but API gateway throws an error when integrated with API gateway.

Screenshot from API gateway hosting IS
Certificate →

https://higherlogicdownload.s3.amazonaws.com/IMWUC/webMethods/Files3/8202cc7e60029734e48c56fb84d5e30825b65d03_2_1035x645.png 1.5x, https://higherlogicdownload.s3.amazonaws.com/IMWUC/webMethods/Files/8202cc7e60029734e48c56fb84d5e30825b65d03.png 2x" data-dominant-color="F5F5F5">

certificate_screenshot1152×719 25.1 KB

https://higherlogicdownload.s3.amazonaws.com/IMWUC/webMethods/Files3/7c79693a4cbce2d15a4ee1d478012f63858a8601_2_1035x405.png 1.5x, https://higherlogicdownload.s3.amazonaws.com/IMWUC/webMethods/Files3/7c79693a4cbce2d15a4ee1d478012f63858a8601_2_1380x540.png 2x" data-dominant-color="EEEEEE">

keystore_screenshot1652×648 36.1 KB

https://higherlogicdownload.s3.amazonaws.com/IMWUC/webMethods/Files3/1880d01952be1d739c330c4e6a2bdb757f3e1cfb_2_1035x592.png 1.5x, https://higherlogicdownload.s3.amazonaws.com/IMWUC/webMethods/Files/1880d01952be1d739c330c4e6a2bdb757f3e1cfb.png 2x" data-dominant-color="F6F6F6">

port_screenshot1152×661 26.2 KB

https://higherlogicdownload.s3.amazonaws.com/IMWUC/webMethods/Files3/e2a102fd156dcf66a383f74616cfe03d6dc2bbf8_2_1035x426.png 1.5x, https://higherlogicdownload.s3.amazonaws.com/IMWUC/webMethods/Files3/e2a102fd156dcf66a383f74616cfe03d6dc2bbf8_2_1380x568.png 2x" data-dominant-color="F7F7F8">

port 2 screenshot1574×648 25.8 KB

Thanks,
Prasad Kale

Hi,

can you provide a sample URL how you invoke the websocket port, please?

Does it help, when you provide centralized truststore containing all neccessary root and intermediate certificates, which are not present in cacerts file from the JVM, as IS Truststore alias and restart IS afterwards?

I have never worked with websockets ports (only regular HTTPS ports), so I am not quite sure where to look at.

Regards,
Holger

Hello @Holger_von_Thomsen ,

I tested IS webSocket URL from postman and its working, Here is the screenshot.
IS webSocket →

https://higherlogicdownload.s3.amazonaws.com/IMWUC/webMethods/Files3/70be3525ffe5eb0d9e018dbf56f4678375e125f6_2_1035x334.png 1.5x, https://higherlogicdownload.s3.amazonaws.com/IMWUC/webMethods/Files/70be3525ffe5eb0d9e018dbf56f4678375e125f6.png 2x" data-dominant-color="E5E6E7">

postmanIS URL1189×385 21 KB

Sample URL we created for POC → ws://localhost:8080/echo/com

But We are calling API gateway webSocket URL from frontend application and postman, but it fails from both. Here us screenshot->

https://higherlogicdownload.s3.amazonaws.com/IMWUC/webMethods/Files3/142b6ef7f324df6f8da446cfe14da121a1ace97a_2_1033x319.png 1.5x, https://higherlogicdownload.s3.amazonaws.com/IMWUC/webMethods/Files/142b6ef7f324df6f8da446cfe14da121a1ace97a.png 2x" data-dominant-color="EFF0F0">

postmanAPI URL1181×365 24.6 KB

to answer other question → We added truststore and tested without restart but it failed with same error. Does it require server restart after uploading truststore ?

Thanks,
Prasad Kale

Hi Prasad,

when adding or updating certificates for the IS it is required to restart the IS as reloading the stores is not sufficient in this case.
Otherwise the certificates wont be activated for IS.

Regards,
Holger

Hi @Holger_von_Thomsen ,

We did API Gateway server restart but still same issue.

Thanks,
Prasad Kale

Hello @Holger_von_Thomsen , Thanks for your inputs on the issue.

It seems, there is product limitation where API gateway does not support secure websocket connection(It cannot listen on secure port for websocket and cannot make call to secure websocket API, we can use API GW with non secure webSocket API).

Thanks,
Prasad Kale