How to add SAN(subject alternative name) value to the SSL certificate while creating a CSR in IHS7

In IHS7, we don't get the option to add a SAN (subject alternative name) value while creating the csr from ikeyman gui tool. However, If you are using a old version and you still want to add this value, use the following command.

/home/IHS7/bin/gsk7cmd -certreq -create -db key.kdb -pw pass -label lable_name -dn "cn=commonname,OU=organization_unit_name,O=Organisation_name,C=Country_name" -san_dnsname sandnsname -size 2048 -sig_alg SHA2WithRSA -file test.csr


NOTE: In general we use the common name same as the san_dnsname.

Read More

Connection timed out: proxy: HTTP: attempt to connect to

Following error is displayed when you are trying to configure proxy balancer cluster by adding the back end servers as cluster members in apache.

[error] (110)Connection timed out: proxy: HTTP: attempt to connect to hostname:portname (nodename) failed
[error] ap_proxy_connect_backend disabling worker for (nodename)
[error] proxy: BALANCER: (balancer://). All workers are in error state
[error] (110)Connection timed out: proxy: HTTP: attempt to connect to hostname:portname (nodename) failed


Trouble shooting steps:

-> Since the error says connection timed out, either the port is not listening or it is blocked at firewall end.

-> do a telenet to the backend host that you have added as balancer member from your webserver host.

telnet hostname portname

-> If you are unable to telnet, Then you have to get the port open from webserver to application server at firewall level.

-> If the telnet is successful, Then the tomcat or the backend should be down (or not running). Need to check access logs for further troubleshooting.

Read More

Configure custom keystores and truststores in websphere application server at cluster level

This post will guide you on how to create and configure custom keystores and truststores instead of using the default keystores and truststores that are created during the profile creation.

Imagine if you have two or more applications running on the same application server profile, Then we can use this feature if any application needs specific certificates. The keystores and truststores can be configured at server/cluster level.

-> Default Keystores and Truststores are created and configured by default at cell level during the profile creation.

-> Custom Keystores and Truststores can be created and configured for at server/application/cluster/node level. This will ensure the keystores are independent of other applications.

Incase of the following error:

Connection has been shutdown: javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure 

The following steps can be used to fix this error.

Creation of Keystore and Truststores from console:

Step 1:  Navigate to Security >SSL certificate and key management > Manage endpoint security configurations > Inbound > NodeName > ServerName >  Key stores and certificates > New

Step 2: Fill the relevant fields.

Name : CustomKeystore
Description : Keystore specific to an application
Management scope: This is grayed out, This shows the scope it is currently in, (Cell)(Node)(Server) -> It belongs to server scope.
Path : The Path Where you want the keystore.p12 to be created.
Password : Defualt will be WebAS
Type : I have choosen p12, You can choose what ever you want to use.
Remotely Managed : In case if the path of the key file is present in a remote server, You have to check this option and provide the alias name of that server which is present in serverindex.xml or else error will be displayed.

Step 3: Once you click on apply, a file with the name that you have given in the path will be created.

Step 4: The same process can be followed to create a trust store.

With the above steps, The keystore and truststores are created.

Now to configure the websphere application server to identify these keystores and truststores and override the default keystore and truststore properties, The following steps are required to be followed.

Step 1: Login to the websphere application server console,

Step 2: Navigate to Servers > Server Types > WebSphere application Servers > Server (Select the server that you want these customized keystores to be used) > Java and Process Management > Process Definition > Java Virtual Machine

Step 3:  Add these following properties to the Generic arguments.

-server -Djavax.net.ssl.trustStore=Path to truststore/trust.p12 -Djavax.net.ssl.trustStorePassword=WebAS -Djavax.net.ssl.trustStoreType=PKCS12 -Djavax.net.ssl.keyStore=Path to Keystore/key.p12 -Djavax.net.ssl.keyStorePassword=WebAS -Djavax.net.ssl.keyStoreType=PKCS12

Step 4:  Apply the settings and restart the JVM and check the process information

ps -eaf | grep java | grep <servername>

This should reflect the parameters added in the Generic arguments.

That's it. You are now using the customized keystores and certificates. 

Read More

SSL0223E: SSL Handshake Failed, No certificate.

Error: 

[Date and Time stamp] [error] [client ip] [ds0] [789] SSL0223E: SSL Handshake Failed, No certificate. 

The above error is seen when the imported server certificate is not made default or if the server certificate is missing. 

Solution: 

-> If the certificate is missing you have to create the certificate and import the certificate using the step6 instruction in the following url.

http://serversideposts.blogspot.in/2015/01/install-ssl-certificates-on-ihs-using.html

-> Then use the following command to display the chain of certificates imported in the kdb. You can see the certificate that you have imported in the kdb. This should display the new certificate imported to the kdb.

./gskcmd -cert -list -db /opt/IHS/SSL/key.kdb

-> Even after this you see the error, Make the certificate as default using the following command.

 

gskcmd -cert -setdefault -label servercertificate -db /opt/IBM/HTTPServer/SSL/key.kdb

Now a quick restart of the apache server should resolve the issue.

Read More

Install SSL Certificates on IHS using gskcmd command line utility in solaris, unix and linux

The following instructions will guide you to create csr and import the signed crt in the default kdb of IHS.

Step 1: Finding the Kdb

The default Kdb will be present in the IHS installation path. Find the key.kdb and take a back up before executing the commands.

Step 2: Creation of Csr

Use the following command to create the csr.

gskcmd will be present in the bin folder of IHS. gsk7cmd can be used based on the version of IHS.

./gskcmd -certreq -create -db /opt/IHS/SSL/key.kdb -pw WebAS -label lablename -dn "CN=hostname, OU=ou name, O=organization, L=Location, ST=state, C=country code" -size 2048 -file filename.csr

-db is the key.kdb path

-pw is the kdb password, The defualt password is WebAS

-label is any name that you choose the certificated to be labled.

-dn is the domain information

CN = Common name (dns name of the name with which you are trying to use https://hotname protocol)

OU = Organization unit name (ex: IT services)

O = Organization that you are working in, or to whom you are configuring the certificate.

L = Location (ex: Germany)

C = 2 digit country code (ex: GE)

This command will create a filename.csr with the information that you have provided.

Step 3: Certificate request

The csr has to be sent to the certificate signing authorities like verisign, Thwate or Geotrust. They will create a crt file and send the server certificate along with the root and intermediate certificates.

Step 4: Importing the server certificate

Following command will import the server certificate to the kdb file.

Save the certificate file received from the signing authority as server.crt and execute the following command.

gskcmd -cert -receive -file server.crt -db /opt/IHS/SSL/key.kdb -pw WebAS -label servercertificate -format ascii

This command will import the server certificate.

Step 5: Set the server certificate to default

 Following command will make the server certificate as default. When you access the https protocol of the website, The default certificate will be choosen.

gskcmd -cert -setdefault -label servercertificate -db /opt/IBM/HTTPServer/SSL/key.kdb

Step  6: Importing the CA/Intermediate certificate

Along with the server certificate, The signing authority will send the intermediate certificate, This certificate has to be imported to prevent the ssl handshake errors.

Save the Intermediate certificate as rootCAcertificate.crt and execute the following command.

gskcmd -cert -add -file rootCAcertificate.crt -db /opt/IHS/SSL/key.kdb -label primaryCA -pw WebAS -format ascii

Step 7: Populate the certificates

gskcmd -cert -populate -db /opt/IHS/SSL/key.kdb -pw WebAS

 

Now add the kdb path in the httpd.conf in ssl module tags and restart the apache server with -DSSL option.

Basic commands of gskcmd to check the certificates:

List the certificates : ./gskcmd -cert -list -db /opt/IHS/SSL/key.kdb 

Check the details of the certificates:  

./gskcmd -certreq -details -label labelname -db /opt/IHS/SSL/key.kdb
./gskcmd -cert -details -label labelname -db /opt/IHS/SSL/key.kdb

Delete a certificate : ./gskcmd -cert -delete -label labelname -db /opt/IHS/SSL/key.kdb

Extract a certificate : ./gskcmd -cert -extract -db certificate.jks -label labelname -target test_myne.cer -type jks

Read More

SSL0166E: Failure attempting to load GSK library (libgsk7ssl.so) Configuration Failed

The following error will be displayed in the error_log while starting the Apache webserver after enabling the SSL module.

Error: [Tue Dec 09 00:00:18 2014] [notice] (2019)DSO load failed: SSL0166E: Failure attempting to load GSK library (libgsk7ssl.so) Configuration Failed

OS - Linux

SSL0166E: Failure attempting to load GSK library (libgsk7ssl.so) Configuration Failed

 To check if the GSK library or the Key kdb file is corrupted, Use the following commands.

/opt/HTTPServer/bin/gsk7capicmd -cert -list -db key.kdb

If the following error is seen, Then it is due to the bit conflict issue between the server and the OS.

error while loading shared libraries: libstdc++.so.5: cannot open shared object file: No such file or directory

ie, If you have a 32-bit IHS installed and you don't have the supportive libraries installed in the os 32 bit libraries, (/usr/lib). The above error is seen.

To check the bit of IHS, Use the following command:

/opt/HTTPServer/bin/httpd -V

Solution: To resolve this issue, You have to find out the missing library using the following command.

yum whatprovides libstdc++.so.5

Command's output:

Loaded plugins: product-id, refresh-packagekit, rhnplugin, security, subscription-manager
This system is receiving updates from RHN Classic or RHN Satellite.
compat-libstdc++-33-3.2.3-69.el6.i686 : Compatibility standard C++ libraries

Now install the library that is required for libstdc++.so.5.

yum install compat-libstdc++-33-3.2.3-69.el6.i686

check the /usr/lib folder, The libstdc++.so.5 is listed.

Restart the IHS server, The ssl issue will be resolved.

Read More

How to enable ssl communication between IHS plugin and WAS base servers in a clustered environment

This post will guide you to enable the ssl communication between the IHS plugin and Websphere application server (BASE) in a clustered environment. The same can be used in for non clustered environment as well.

Architecture:

The architecture includes 2 WAS Base installations in different nodes(physical hosts) and an IHS installation on one of the physical node (Shares the Base server physical host)

After following these steps and creating a cluster in by previous post, If you want to enable the https protocol at IHS level to access the application, The following steps have to be followed.

Error: This error will be seen in the logs, if you are trying to access the application  on node2 using https protocol.

[01/2014:05:00:10.44085] 0000 - ERROR: lib_stream: openStream: Failed in r_gsk_secure_soc_init: GSK_ERROR_BAD_CERT(gsk rc = 414) PARTNER CERTIFICATE DN=CN=hostname,OU=hostNode02Cell,OU=hostNode01,O=IBM,C=US, Serial=04:6f:ec:5e:84:05:56
[01/Dec/2014:05:00:10.44092] 0000510d c57fb700 - ERROR: ws_common: websphereGetStream: Could not open stream
[01/Dec/2014:05:00:10.44097] 0000510d c57fb700 - ERROR: ws_common: websphereExecute: Failed to create the stream

This error is seen as the plugin-cfg.kdb that is defined in the ihs configuration file does not have the node02 certificate installed.

Step1: Login to a WAS console,

Step2: Navigate to Servers -> ServerTypes -> Webservers -> webserver1 -> Plug-in properties


Step3: Click on Manage Keys and Certificates -> CMSKeyStore -> Signer Certificates

Step4:  Click on Retrieve from port and provide the hostname and port of the base server.

ex: localhost(node2), Port (9043)

This will extract the certificate installed on the node2 and add that to the plugin kdb file.

Step5: After saving the certificate, Navigate back to Plugin properties and click on copy to webserver keystore directory.

This will create a new set of plugin-key.kdb and plugin-key.sth.

Step6: Now check the plugin-cfg.xml for the kdb and sth path and copy them to the designated paths and restart the IHS.

Step7: Test the application by accessing it with https protocol.

Read More

configure: error: APR not found / configure: error: Bundled APR-Util requested but not found

These errors can be seen while installing Apache.

configure: error: APR not found.  Please read the documentation.

configure: error: Bundled APR-Util requested but not found at ./srclib/. Download and unpack the corresponding apr and apr-util packages to ./srclib/ 

Following steps will resolve the issue: 

- Download Apr and Apr-util from http://apr.apache.org

- while running the config command include --with-included-apr flag

Read More

How to integrate IHS with Websphere application server ND - Generate and Propagate IHS plugin

Using script : With the IHS installation, The configurewebserver1.bat is created in the plugin bin folder of the IHS installation. Copy the script to the remote server deployment manager bin and run the script. This script will create the webserver1 configuration. Once the script is run, Restart the DMGR and access the console, You should be able to see the webserver1 definition created.

Manual Creation:

Login to the WebSphere Application server console and navigate to the webservers section.

Click on new -> Choose the server node and add a server name -> I have given webserver1 -> Type is IBM HTTP Server -> Next

Next

Enter the IHS server details

Finish

IHS and WAS on same Server: (Standalone Node)

Now click on the check box of the webserver1, Generate Plugin and Propagate Plugin. This is copy the plugin.xml to the webserver. Now the communication between the websphere application server and the webserver is successful.

IHS on remote server: (Remote Node)

When you have the IHS and WAS on different server, Then remote server management comes into picture. Ensure the firewall port is open between the two servers so that the communication doesn't break during the generation and propagation of plugin.  Click on remote server management and specify the userid and password for the IHS. These credentials were specified when you are installing the IHS webserver.

Test:

Access any of the sample deployed applications via IHS url

ex: WAS URL : http://localhost:9080/PlantsByWebsphere

Now IHS URL : http://localhost/PlantsByWebsphere - Here you are able to access the application via IHS.

                                 (: Happy learning :)

Read More

Install and Configure IBM HTTP web server(IHS) with websphere application server ND

Following steps will guide you to Install and integrate the IHS webserver with Websphere Application server ND.

Extract the installable and run install.exe

Click on Next >> Accept the terms and conditions and click on Next >>

Warning: A supported operating system was not detected.

 Don't worry about the above error, Support for your operating system might have been added after the release of the product. See the WebSphere Application Server detailed system requirements Web pages for more information about supported operating systems. You can continue with the installation.

Enter the installation directory, This directory will hold all the installation configuration files.

80 and 8008 are default ports for IHS and admin server. In case if you want to choose any port other than 80 you can change the ports here. In case if you want to change the ports after installation that can be done in httpd.conf file.

In-case if you don't want to add the IHS as windows server un check the two options and proceed. However, You can add the windows password or local user password if you want to run the webserver as a windows service.

Next comes the admin server credentials, If you select the option to provide the authentication, These credentials will be used during the plugin propagation from WebSphere application server. Note down the user and password provided here. The credentials will be stored in admin.passwd file with the password encrypted.

Next comes the plugin installation, Provide the Ip address or the host name of the application server.

After going through the summary, Click on Install. This will successfully install IHS and plugin configuration.

Now navigate to C:\HTTPServer1

Ensure that the httpd.conf has the correct host name and the port number.

Admin privileges are required to start the process running on port 80. Navigate to the bin folder

C:\HTTPServer1\bin\httpd.exe -k start ( IHS process will start running)

Check if the port is listening.

Access the url : http://localhost:80, The following welcome page will be displayed.

To Integrate the Webserver with the Websphere Application Server click here

                                 (: Happy learning :)

Read More