SSL issue - plugin certificate problem

[c***@wipro.com]

Below are the steps we followed for SSL implementation :


1) Installed SSL certificate supplied by Verisign

2) Created a new virtual host in httpd.conf for port number 443

Listen hostname:443



DocumentRoot "///"

ServerName hostname

SSLEnable

KeyFile "D:\Program Files\IBM\HTTPServer\key.kdb"

SSLServerCert certificatename

SSLStashFile "D:\Program Files\IBM\HTTPServer\key.sth"

SSLV2Timeout 100

SSLV3Timeout 1000

ports. It was already present.

4) Regenerated the webserver plugin and propagated it.

5) Restarted HTTP Server

6) Tested https://www.website.com . Verisign certificate was displaying on the bottom

7) Tried accessing https://www.website.com/snoop . A 500 internal server was displayed.

8) Checked http_plugin.log below errors were thrown



[Fri Apr 24 11:17:40 2009] 0000084c 000008e0 - ERROR: lib_stream: openStream: Failed in r_gsk_secure_soc_init: GSK_ERROR_BAD_CERT(gsk rc = 414)
[Fri Apr 24 11:17:40 2009] 0000084c 000008e0 - ERROR: ws_common: websphereGetStream: Could not open stream
[Fri Apr 24 11:17:40 2009] 0000084c 000008e0 - ERROR: ws_common: websphereExecute: Failed to create the stream
[Fri Apr 24 11:17:40 2009] 0000084c 000008e0 - ERROR: ws_common: websphereHandleRequest: Failed to execute the transaction to 'serverNode01_server1'on host ‘Servername’; will try another one
[Fri Apr 24 11:17:40 2009] 0000084c 000008e0 - ERROR: ws_common: websphereWriteRequestReadResponse: Failed to find an app server to handle this request
[Fri Apr 24 11:17:40 2009] 0000084c 000008e0 - ERROR: ESI: getResponse: failed to get response: rc = 2
[Fri Apr 24 11:17:40 2009] 0000084c 000008e0 - ERROR: ws_common: websphereHandleRequest: Failed to handle request


I have checked the plugin-key.kdb in Plugin-root/config/webserver1. The default certificate has expired.

Is this the issue? If so what is the procedure for creating a new certificate and what are the areas in the WAS I have to do the changes.

Please advise me the way forward.


Regards,
Chandrakanth

[Brian S Paskin]

Hi, Did you use the ikeyman tool to install the new certificate?

Regards,
Brian

[c***@wipro.com]

Yes I have used IKeyman for installation Verisign certificate. Verisign certificate is showing up fine in right-bottom corner of the browser.


Regards,
Chandrakanth

[Brian S Paskin]

Hi, did you read this [http://www-01.ibm.com/support/docview.wss?rs=180&uid=swg21264477]

Regards,
Brian

[c***@wipro.com]

Hi Brian,

I have gone through this article and when I was cross checking the steps. I found out that the "default" personal certificate in plugin-key.kdb has expired.
If I follow the steps in the article you have specified. Does it solve my problem?
Or I have to generate a new certificate in the plugin-key.kdb ?

Please advise me this is the first time iam using WAS.

Regards,
Chandrakanth

[Brian S Paskin]

Hi, I cannot guarantee that this will fix your issue. However, you do need to fix errors. Afterward, you can turn on tracing to see where the issue resides.

Regards,
Brian

[c***@wipro.com]

Hi,

The problem got solved now by following the steps in the above article.

Regards,
Chandrakanth