我在 Glassfish 3.1 上的应用程序不会执行客户端身份验证
我有一个使用使用传输级身份验证的 SOAP 服务的应用程序。我们正在尝试将应用程序从 Tomcat 迁移到 Glassfish 3.1。不幸的是，Glassfish 似乎不愿执行 SOAP 服务所需的客户端身份验证。 SSL 堆栈跟踪会生成消息“uknown_ca”。
我将 Glassfish 服务器配置为使用密钥库，该密钥库包含身份验证链中的三个委托证书（存储为 -trustcacerts），并且还导入了 SOAP 目标服务器的证书。
我已经尝试了几次从头开始重建我的 Glassfish 服务器，甚至尝试了 tomcat 服务器的密钥库文件，但没有成功。
有谁知道发生了什么事，或者我如何让 Glassfish 为我提供有关握手和涉及的密钥库的更多有用信息（除了 -Djava.net.ssl.debug 标志之外）。
I have application consuming a SOAP service that uses transport-level authentication. We are trying to move the application from Tomcat to Glassfish 3.1. Unfortunately, Glassfish seems reticent to perform the client authentication needed by the SOAP service. The SSL stacktrace results in the message "uknown_ca".
I have my Glassfish server configured to use a keystore that contains each of the three entrust certificates in the auth chain (stored as -trustcacerts) as well as having imported the SOAP destination server's certificate too.
I have tried several from-scratch rebuilds of my Glassfish server and even resorted to trying the tomcat server's keystore file with no luck.
Does anyone know what is going on, or else how do I get Glassfish to provide me more useful information regarding the handshake and keystores involved (beyond the -Djava.net.ssl.debug flag).
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
我的一位同事提出了解决方案。指向安德鲁.
结果目的地向我们发送了
unknown_ca消息，因为它不理解 Glassfish 在身份验证过程中发送的密钥的 CA。删除 JVM 参数
-Dcom.sun.enterprise.security.httpsOutboundKeyAlias=s1as可以解决该问题。人们还可以更改参数以指定首选密钥的别名，而不是让 JVM 确定要使用的密钥。A co-worker of mine came up with the solution. Points to Andrew.
The destination turned out to be sending us the
unknown_camessage, as it did not understand the CA of the key that Glassfish was sending during the authentication process.Removing the JVM argument
-Dcom.sun.enterprise.security.httpsOutboundKeyAlias=s1asresolves the issue. One may also change the argument to specify the alias of the preferred key instead of letting the JVM determine the key to use.SOAP 服务器证书应导入 Glassfish 的信任库，而不是密钥库。
The SOAP server certificate should be imported into Glassfish's truststore, not keystore.