Hello All, Im trying to setup drop-down select w/ web-service to the IGL server itself and I keep getting a connection refused message. If I put that URL in the browser it seems to work fine. But in the form, it throws an error no matter what command I put in there. Any ideas? I've gotten it to work with older versions and different environment's in the past. Is it a firewall issue perhaps? Port being blocked? I've run out of troubleshooting steps.
Hi Daniel,
Please can you confirm which version this is on?
Thanks,
Clive
Hi Clive, I updated to the newest 7.1.1 P09 and im still having the issue.
Connection refused is a standard network error. This means that whatever URL you entered (which is covered in red in the screenshots) is not accessible from the server itself.
Note that it is not your end-user browser that has to call to this URL, but rather the backend server itself. For example, if you are using some sort of revere-proxy or load balancer to get to the IGL server from your own PC/browser, the IGL server itself might not be able to access that same reverse-proxy or load-balancer to load the required info.
I would start by connecting to the Linux server where IGL is installed using SSH (PuTTY), then using openssl (or any command line tool of your preference) to test connectivity to the host:port used in that URL.
For example:
Assuming the URL is: https://my-server.domain.com/aveksa/command.submit?cmd=getLoginInstructions
Then use the following command:
openssl s_client -connect my-server.domain.com:443
Interesting, when I try openssl s_client -connect my-server.domain.com:443 I get back:
socket: Connection refused
connect:errno=111
When I try openssl s_client -connect my-server.domain.com:8443 I get:
Verify return code: 19 (self signed certificate in certificate chain)
And in IGL I see:
Any Ideas???
Good you are one step ahead now So the network issue was resolved using 8443 instead of 443.
Now what you have is a certificate issue. I'm guessing this is a test system with no proper signed certificate installed. This error is basically equivalent to the certificate warning you get in your browser when you open the UI. You can skip that from the browser, but the application will not. So you have two choices here:
Mostafa, you are the man! Step 2 worked perfectly! Error is gone! RSA, give that man a raise! As always, thanks for the help. I have been beating my head on this one for days.
Mostafa,
Looks like I may have spoken too soon. Somehow it looks like step 2 from above broke AFX. Connectors became stuck in the deployed state. I deleted the cert and they started working again. So strange, any ideas??
OK what Mostafa Helmy said.
My guess is that adding the certificate did not break AFX, but likely there are other certificate problems with AFX that are preventing it from working.
If you have certificate issues you likely have more than one.
With modern Java versions there are no shortcuts for certificates. You must use contemporary certificates with all the required attributes. At minimum this requires regenerating certificates, and you may have to patch to a newer version before doing this.
Find out exactly what the AFX failure is and compare against known AFX issues related to certificates.
000038029 - Troubleshooting AFX Connector issues in RSA Identity Governance & Lifecycle
You are correct. My command copied the whole certificate (including the private key) to cacerts which would break AFX since cacerts should only contain trusted certificates and not private keys.
I updated the command above to break it into two steps:
Try these new commands and hopefully this will not have any side effects this time. Sorry for the inconvenience.
Thanks Mostafa, that worked!
Good you are one step ahead now So the network issue was resolved using 8443 instead of 443.
Now what you have is a certificate issue. I'm guessing this is a test system with no proper signed certificate installed. This error is basically equivalent to the certificate warning you get in your browser when you open the UI. You can skip that from the browser, but the application will not. So you have two choices here:
If you choose this approach, then try running these two commands as root:
keytool -exportcert -rfc -keystore /home/oracle/keystore/aveksa.keystore -storepass Av3k5a15num83r0n3 -alias server -file aveksa_ui.cer
keytool -import -file aveksa_ui.cer -alias aveksa_ui -keystore $JAVA_HOME/jre/lib/security/cacerts -storepass changeit
Then afterwards, restart the application for the changes to take effect.