FIM Weblogic throws exception with new SSL cert - java.io.IOException: Cannot convert identity certificate

Originally Published: 2015-04-20

Last Modified: 2023-10-06

Article Number

000055998

Applies To

RSA Product Set: RSA Federated Identity Manager (FIM) 4.1
RSA Product/Service Type: Oracle Weblogic 10.0.1

Issue

After upgrading Weblogic SSL certificate the servers throws the following exception on restart:

java.io.IOException: Cannot convert identity certificate
      at weblogic.server.channels.DynamicSSLListenThread.<init>(DynamicSSLListenThread.java:59)
      at weblogic.server.channels.DynamicListenThreadManager.createListener(DynamicListenThreadManager.java:273)
      at weblogic.server.channels.AdminPortService.bindListeners(AdminPortService.java:76)
      at weblogic.server.channels.EnableAdminListenersService.start(EnableAdminListenersService.java:39)
      at weblogic.t3.srvr.SubsystemRequest.run(SubsystemRequest.java:64)
      at weblogic.work.ExecuteThread.execute(ExecuteThread.java:200)
      at weblogic.work.ExecuteThread.run(ExecuteThread.java:172)
Caused by: java.lang.RuntimeException: Cannot convert identity certificate
      at com.certicom.tls.interfaceimpl.CertificateSupport.addAuthChain(Unknown Source)
      at com.certicom.net.ssl.SSLContext.addAuthChain(Unknown Source)
      at com.bea.sslplus.CerticomSSLContext.addIdentity(Unknown Source)
      at weblogic.security.utils.SSLContextWrapper.addIdentity(SSLContextWrapper.java:77)
      at weblogic.security.utils.SSLContextManager.createServerSSLContext(SSLContextManager.java:286)
      at weblogic.security.utils.SSLContextManager.getChannelSSLContext(SSLContextManager.java:239)
      at weblogic.security.utils.SSLContextManager.getSSLServerSocketFactory(SSLContextManager.java:89)
      at weblogic.server.channels.DynamicSSLListenThread.<init>(DynamicSSLListenThread.java:55)
      ... 6 more

Cause

The new certificate was created using SHA256withRSA, while the old one used SHA1withRSA. Weblogic prior to 10.3.4 cannot use certificates with SHA256withRSA encryption as it uses Certicom SSL implementation.

Resolution

Upgrade the weblogic to a supported version 10.3.4 or greater.

Enable JSSE SSL, which is under the advanced options of the weblogic console found under the SSL tab
Set “Use JSSE SSL” for Admin server after you import the certificate into the trust keystore on admin server. Otherwise, Admin server may fail to communicate with node manager, and you will see “javax.net.ssl.SSLKeyException” error when you check Node Manager Status from weblogic console.

Also modify the file $WL_HOME/server/bin/startNodeManager.sh
to add the following line:
JAVA_OPTIONS="-Dweblogic.security.SSL.enableJSSE=true ${JAVA_OPTIONS}"

Workaround

Use a certificate made with SHA1withRSA algorithm.

Don't see what you're looking for?

Related Articles

Trending Articles