웹스피어 ssl 관련 질문드립니다! 간절합니다..

Question

안녕하세요 밑에서 계속 질문 올렸었습니다.어느정도 답을 향해 가고있는것 같습니다.웹서버 : IHSWAS : 웹스피어자바+스프링+오라클IHS(웹서버) 쪽에 SSL 갱신(.sth, .kdb) 을 한 뒤에 재기동을 하면특정 db 데이터 들을 땡겨오지 못합니다. 아마 컨트롤러 단에서 나는 오류 때문인 것 같습니다[ 20:41:43:313 KST] 00000170 SystemErr R Caused by: com.ibm.jsse2.util.n: PKIX path building failed: java.security.cert.CertPathBuilderException: PKIXCertPathBuilderImpl could not build a valid CertPath.; internal cause is: java.security.cert.CertPathValidatorException: The certificate issued by CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US is not trusted; internal cause is: java.security.cert.CertPathValidatorException: Certificate chaining error[ 20:41:43:314 KST] 00000170 SystemErr R at com.ibm.jsse2.util.l.a(l.java:65)[ 20:41:43:314 KST] 00000170 SystemErr R at com.ibm.jsse2.util.l.b(l.java:92)[ 20:41:43:314 KST] 00000170 SystemErr R at com.ibm.jsse2.util.k.a(k.java:5)[ 20:41:43:314 KST] 00000170 SystemErr R at com.ibm.jsse2.rc.a(rc.java:91)[ 20:41:43:314 KST] 00000170 SystemErr R at com.ibm.jsse2.rc.a(rc.java:69)[ 20:41:43:314 KST] 00000170 SystemErr R at com.ibm.jsse2.rc.checkServerTrusted(rc.java:6)[ 20:41:43:314 KST] 00000170 SystemErr R at com.ibm.ws.ssl.core.WSX509TrustManager.checkServerTrusted(WSX509TrustManager.java:373)[ 20:41:43:314 KST] 00000170 SystemErr R at com.ibm.jsse2.mb.a(mb.java:251)[ 20:41:43:314 KST] 00000170 SystemErr R ... 110 more[ 20:41:43:314 KST] 00000170 SystemErr R Caused by: java.security.cert.CertPathBuilderException: PKIXCertPathBuilderImpl could not build a valid CertPath.; internal cause is: java.security.cert.CertPathValidatorException: The certificate issued by CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US is not trusted; internal cause is: java.security.cert.CertPathValidatorException: Certificate chaining error[ 20:41:43:315 KST] 00000170 SystemErr R at com.ibm.security.cert.PKIXCertPathBuilderImpl.engineBuild(PKIXCertPathBuilderImpl.java:411)[ 20:41:43:315 KST] 00000170 SystemErr R at java.security.cert.CertPathBuilder.build(CertPathBuilder.java:258)[ 20:41:43:315 KST] 00000170 SystemErr R at com.ibm.jsse2.util.l.a(l.java:137)[ 20:41:43:315 KST] 00000170 SystemErr R ... 117 more[ 20:41:43:315 KST] 00000170 SystemErr R Caused by: java.security.cert.CertPathValidatorException: The certificate issued by CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US is not trusted; internal cause is: java.security.cert.CertPathValidatorException: Certificate chaining error[ 20:41:43:315 KST] 00000170 SystemErr R at com.ibm.security.cert.BasicChecker.(BasicChecker.java:111)[ 20:41:43:315 KST] 00000170 SystemErr R at com.ibm.security.cert.PKIXCertPathValidatorImpl.engineValidate(PKIXCertPathValidatorImpl.java:180)[ 20:41:43:315 KST] 00000170 SystemErr R at com.ibm.security.cert.PKIXCertPathBuilderImpl.myValidator(PKIXCertPathBuilderImpl.java:737)[ 20:41:43:315 KST] 00000170 SystemErr R at com.ibm.security.cert.PKIXCertPathBuilderImpl.buildCertPath(PKIXCertPathBuilderImpl.java:649)[ 20:41:43:315 KST] 00000170 SystemErr R at com.ibm.security.cert.PKIXCertPathBuilderImpl.buildCertPath(PKIXCertPathBuilderImpl.java:595)[ 20:41:43:316 KST] 00000170 SystemErr R at com.ibm.security.cert.PKIXCertPathBuilderImpl.buildCertPath(PKIXCertPathBuilderImpl.java:595)[ 20:41:43:316 KST] 00000170 SystemErr R at com.ibm.security.cert.PKIXCertPathBuilderImpl.engineBuild(PKIXCertPathBuilderImpl.java:357)[ 20:41:43:316 KST] 00000170 SystemErr R ... 119 more[ 20:41:43:316 KST] 00000170 SystemErr R Caused by: java.security.cert.CertPathValidatorException: Certificate chaining error[ 20:41:43:316 KST] 00000170 SystemErr R at com.ibm.security.cert.CertPathUtil.findIssuer(CertPathUtil.java:317)[ 20:41:43:316 KST] 00000170 SystemErr R at com.ibm.security.cert.BasicChecker.(BasicChecker.java:108)[ 20:41:43:316 KST] 00000170 SystemErr R ... 125 more[ 20:42:19:557 KST] 00000170 SystemErr R javax.net.ssl.SSLHandshakeException: com.ibm.jsse2.util.n: PKIX path building failed: java.security.cert.CertPathBuilderException: PKIXCertPathBuilderImpl could not build a valid CertPath.; internal cause is: java.security.cert.CertPathValidatorException: The certificate issued by CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US is not trusted; internal cause is: java.security.cert.CertPathValidatorException: Certificate chaining error[ 20:42:19:562 KST] 00000170 SystemErr R at com.ibm.jsse2.p.a(p.java:3)[ 20:42:19:562 KST] 00000170 SystemErr R at com.ibm.jsse2.SSLSocketImpl.a(SSLSocketImpl.java:723)[ 20:42:19:562 KST] 00000170 SystemErr R at com.ibm.jsse2.lb.a(lb.java:467)[ 20:42:19:562 KST] 00000170 SystemErr R at com.ibm.jsse2.lb.a(lb.java:247)[ 20:42:19:562 KST] 00000170 SystemErr R at com.ibm.jsse2.mb.a(mb.java:398)[ 20:42:19:562 KST] 00000170 SystemErr R at com.ibm.jsse2.mb.a(mb.java:378)[ 20:42:19:562 KST] 00000170 SystemErr R at com.ibm.jsse2.lb.t(lb.java:306)[ 20:42:19:562 KST] 00000170 SystemErr R at com.ibm.jsse2.lb.a(lb.java:86)[ 20:42:19:562 KST] 00000170 SystemErr R at com.ibm.jsse2.SSLSocketImpl.a(SSLSocketImpl.java:759)[ 20:42:19:562 KST] 00000170 SystemErr R at com.ibm.jsse2.SSLSocketImpl.h(SSLSocketImpl.java:691)[ 20:42:19:562 KST] 00000170 SystemErr R at com.ibm.jsse2.SSLSocketImpl.a(SSLSocketImpl.java:32)[ 20:42:19:562 KST] 00000170 SystemErr R at com.ibm.jsse2.SSLSocketImpl.startHandshake(SSLSocketImpl.java:307)[ 20:42:19:562 KST] 00000170 SystemErr R at com.ibm.net.ssl.www2.protocol.https.c.afterConnect(c.java:57)[ 20:42:19:562 KST] 00000170 SystemErr R at com.ibm.net.ssl.www2.protocol.https.d.connect(d.java:31)[ 20:42:19:562 KST] 00000170 SystemErr R at com.ibm.net.ssl.www2.protocol.https.b.connect(b.java:16)해당 오류 파악으로was에 ssl 설정이 되어있지 않아 나타나는 오류로 파악되어웹스피어 콘솔 > 보안 > SSL 인증 및 키 관리 > 키 저장소 및 인증에서 사용 노드의 SSL로 잡혀있는 것이 WAS서버 경로의 .p12 확장자로 파악되었습니다..p12 확장자의 ssl 보안서는 어떤 역할을 하는건가요?ssl 갱신 업체에서는 해당 확장자를 주지 않았으며파일의 날짜를 보니 이 전 날짜와는 상관없어보입니다.. 작년 갱신날짜에 맞는것은server.xml 만 수정했다고 나와있는 상태입니다.만약 .p12 확장자의 파일을 교체하지 않는다면 웹서버의 ssl문서가 바뀌었을 때에 어떤설정을 바꿔줘야제대로 작동이 될지 의문입니다..능력있는 개발자 여러분! 한번만 도와주시면 사람 한명 살리는 길입니다.. ㅠㅠㅠㅠㅠㅠㅠ짐작가시는데가 있으면 답변부탁드리겠습니다!

극한초보 · Answer

인증서 검증하는 검증기관 인증서가 제대로 맞는지 부터 확인해야 할거 같습니다.CN&#61;DigiCert Global Root CA, OU&#61;www.digicert.com, O&#61;DigiCert Inc, C&#61;US이 검증기관 인증서가 제대로 존재하고 유효기간이 맞는지 확인해보세요.서버 인증서를 신뢰할수 있게 체인검증을 하는데 저 위에 부분에서 문제생긴거 같네요.즉, 설치한 SSL인증서의 루트CA인 &#34;DigiCert Global Root CA&#34;검증오류라고 생각됩니다.

웹스피어 ssl 관련 질문드립니다! 간절합니다..

1개의 답변

#websphere 목록