SSL on Weblogic Made Simple – PART3 (TroubleShooting)

SSL on Weblogic Made Simple – PART3

We come cross lot SSL related issues in our day to day middleware activities; I will talk about different ways of troubleshooting SSL related issues.

      1)      The first and foremost thing we need to look as soon as we start looking into a SSL issue is the validity of the SSL certificate.

              

      2)      Enable Debugging on the weblogic servers to see the ssl traces and dumps

          

     

 

         To see the debug messages you need to enable server severity level to debug

           

        

 

    

     3)      You can also enable  debugging in the setDomainEnv.sh File ( command line parameters)

This will write all SLL debug information in server logs.

-Dweblogic.log.RedirectStdoutToServerLogEnabled=true

-Dweblogic.StdoutDebugEnabled=TRUE

 -Djavax.net.debug=ssl,handshake,verbose

-Dweblogic.log.RedirectStdoutToServerLogEnabled=true

 -Dssl.debug=true

Run the command to find the debug flags enabled or disabled

java weblogic.Admin -username weblogic -password weblogic -url localhost:7001 GET -type ServerDebug -pretty

or 

java  -cp .:$WL_HOME/wlserver_10.3/server/lib/weblogic.jar weblogic.Admin -username weblogic -password weblogic -url localhost:7001 GET -type ServerDebug –pretty

 

     4 )      Testing with a JAVA Client to test the SSL Connectivity.

  

   Here is Java Code , Name it as  SSL_Test.java

 
import java.io.*;
import java.net.*;
import javax.net.ssl.*;
import java.util.*;
import java.security.Permission;
import java.security.cert.Certificate;

public class SSL_Test {
    
    //Usage ::
    // java_home/bin/java -Djavax.net.debug=ssl,handshake,verbose -XX:+PrintCommandLineFlags -Djavax.net.ssl.trustStore=TurstStore .jks SSL_Test
    public static void main(String[] args) throws Exception {
        
        
        //Disabling the Host Name verification of the certificate
        HostnameVerifier allHostsValid = new HostnameVerifier() {
            public boolean verify(String hostname, SSLSession session) {
                return true;
            }
        };
        HttpsURLConnection.setDefaultHostnameVerifier(allHostsValid);
        
        // Replace WS URL with the actual URL
        URL url =
            new URL("https:///context");
        System.out.println("Opening URL: " + url.toString());
        
        // SSL handShake with the below method
        HttpsURLConnection con = (HttpsURLConnection)url.openConnection();
        System.out.println("===================================== HandShake Successfull !!!");
        System.out.println("===================================== SSL Connection Successfull !!!");
        System.out.println("got the connection Object.....!");
        System.out.println("TRUST STORE :::::::::javax.net.ssl.trustStore::" +
                           System.getProperty("javax.net.ssl.trustStore"));
        
        
        System.out.println("%%%%%%%%%% P R I N T I N G    C O N N E C T I O N    I N F O R M A T I O N %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%");
        //print_https_cert(con);
        System.out.println(" %%%%%%%%%%            E     N   D   %%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%%           ");
        
        
        System.out.println("################## P R I N T I N G    J  A V A    E N V I R O N M E N T  ################## ");
        //print_java_classpath();
        System.out.println(" ##################            E     N   D   ##################  ");


        System.out.println("===================================== PRINTING THE CONTENT OF THE URL  ======================================================");

        BufferedReader in =
            new BufferedReader(new InputStreamReader(url.openStream()));

        String inputLine;
        while ((inputLine = in.readLine()) != null)
            System.out.println(inputLine);
        in.close();

    }

    private static void print_https_cert(HttpsURLConnection con) {

        if (con != null) {
            try {
                //System.out.println("PeerPrincipal : " + con.getPeerPrincipal());
                //System.out.println("LocalPrincipal : " + con.getLocalPrincipal());
                System.out.println("HostnameVerifier : " +
                                   con.getHostnameVerifier());
                System.out.println("DefaultVerifier : " +
                                   con.getDefaultHostnameVerifier());
                System.out.println("Response Code : " + con.getResponseCode());
                System.out.println("Cipher Suite : " + con.getCipherSuite());
                System.out.println("ErrorStream : " + con.getErrorStream());
                System.out.println("ResponseMessage : " +
                                   con.getResponseMessage());
                System.out.println("RequestMethod : " +
                                   con.getRequestMethod());
                Permission sp = con.getPermission();
                System.out.println("Permission : " + sp.toString());
                System.out.println("Permission : " + sp.getName());
                System.out.println("Permission : " + sp.getActions());
                Map> lst = con.getHeaderFields();

                for (Map.Entry> me : lst.entrySet()) {
                    String key = me.getKey();
                    List valueList = me.getValue();
                    System.out.println("Key: " + key);
                    System.out.print("Values: ");
                    for (String s : valueList) {
                        System.out.print(s + " ");
                    }
                }
                System.out.println("\n");
            } catch (SSLPeerUnverifiedException e) {
                e.printStackTrace();
            } catch (IOException e) {
                e.printStackTrace();
            }

        }

    }
     private static void print_java_classpath() {
        ClassLoader cl = ClassLoader.getSystemClassLoader();

        URL[] urls = ((URLClassLoader)cl).getURLs();

        for (URL url1 : urls) {
            System.out.println(url1.getFile());
        }
        Properties p = System.getProperties();
        Enumeration keys = p.keys();
        while (keys.hasMoreElements()) {
            String key = (String)keys.nextElement();
            String value = (String)p.get(key);
            System.out.println(key + ": " + value);
        }
    }
   
} 

You need to update the URL with the required string in the code

Compile the Code :
[JAVA_HOME]/jdk160_31/bin/javac SSL_Test.java

Execute the Code :
<JAVA_HOME>/jdk160_31/bin/java -Djavax.net.debug=ssl,handshake,verbose -XX:+PrintCommandLineFlags -Djavax.net.ssl.trustStore=/tmp/truststore.jks SSL_Test

Note: This code is used to test the SSL handshake and also verify whether you are passing right
          Trust store which has the appropriate CA's
          We need to make sure /tmp/truststore.jks has all the Trusted and Root CA's of the calling system

if you don't pass -Djavax.net.ssl.trustStore=/tmp/truststore.jks then SSL handshake will fail