Websphere SSL - invalid certificate, key identifier is missing from authority key identifier extension

when you tried to access to secured WebService from your Websphere application , and get such error ":org.apache.axis2.AxisFault: 
javax.net.ssl.SSLHandshakeException: com.ibm.jsse2.util.g:PKIX path building failed: java.security.cert.CertPathBuilderException: invalid certificate, key identifier is missing from authority key identifier extension"

you probably need to install the certificate in your web sphere

To establish trusted server-to-server communication for IBM Connections, import signer certificates from IBM HTTP Server into the WebSphere Application Server default trust store.

There are different types of certificates that you can use. This procedure describes how to import a self-signed certificate. You can also import a certificate that you purchased from a third-party Certificate Authority. To help decide a key file strategy for your environment, go the IBM HTTP Server knowledge center.

To import a public certificate from IBM HTTP Server to the default trust store in IBM WebSphere Application Server, complete the following steps:

Procedure

1. Log into the IBM WebSphere Application Server Integrated Solutions Console and select Security > SSL Certificate and key management > Key stores and certificates.
2. Click CellDefaultTrustStore.
3. Click Signer Certificates.
4. Click Retrieve from port.
5. Enter the Host name, SSL Port, and Alias of the web server. The Alias is typically an arbitrary string that will become the name of the credentials.
6. Click Retrieve Signer Information and then click OK. The root certificate is added to the list of signer certificates.
7. If using Tivoli® Access Manager or other proxies, also repeat steps 4-6 for your Tivoli Access Manager or other proxy servers.
8. restart server.

the above is from Adding certificates to the WebSphere trust store

there is another way :

Procedure

export the certificate :

navigate to the url via browser , in the browser click on the certificate , and export it in DER format or base64 format.

save it in accessible path.

1. Log into the IBM WebSphere Application Server Integrated Solutions Console and select Security > SSL Certificate and key management > Key stores and certificates.
2. Click NodeDefaultTrustStore.
3. Click Signer Certificates.
4. Click Add.
5. Enter the Alias of the web server. The Alias is typically an arbitrary string that will become the name of the credentials, and the exported certificate location- described above, choose the right dataType  (DER format or Base64).
6. Then click OK. The root certificate is added to the list of signer certificates.
7. restart server.

Everything you ever wanted to know about SSL

Everything you ever wanted to know about SSL (but were afraid to ask) - The Boy Wonders:

WebSphere "IBM End user tried to act as a CA"

When i tried to access a secured web services i get the next error:

org.apache.axis2.AxisFault: Connection has been shutdown: javax.net.ssl.SSLHandshakeException: com.ibm.jsse2.util.h: End user tried to act as a CA

at org.apache.axis2.AxisFault.makeFault(AxisFault.java:430)

at org.apache.axis2.transport.http.SOAPMessageFormatter.writeTo(SOAPMessageFormatter.java:83)

at org.apache.axis2.transport.http.AxisRequestEntity.writeRequest(AxisRequestEntity.java:84)

at org.apache.commons.httpclient.methods.EntityEnclosingMethod.writeRequestBody(EntityEnclosingMethod.java:499)

the CA in this case is Entrust company.

after some hours , i found the next article that helped me to solved it out , and this way i understood i am not alone here.

the fix is described here:

IBM End user tried to act as a CA - United States.

summery:

update the java.security file , set the

ssl.TrustManagerFactory.algorithm to use IbmPKIX insteaf of IbmX509 .

this article gave me the clue that its somthing with entrust CA as well

http://academicwritingtips.org/component/k2/item/899-entrust.html

and restart your server.

enjoy

Yaniv Tzanany

Create self signed Certificate for IIS via OpenSSL

hello
i follow the instruction at Creating a Self-Signed Certificate using OpenSSL for use with Microsoft Internet Information Services (IIS) and its works just fine with my IIS 5.1 on my XP sp2 laptop.

this article is very good and simple & clear.

Enjoy
Yaniv

Setting SSL for Tomcat

Setting up SSL on Tomcat is easy and you don’t have to do much for converting your web application to work with the Https protocol.
in the next article i found you will find the three simple steps you need to follow.
i can confirm that its working well !

setting-up-ssl-on-tomcat-in-3-easy-steps

enjoy
Yaniv