Happy New Week! :)Thanks the advices, unfortunately something's still missing.The CA cert was already in place.I have imported the CA by hand, since update-ca-certificates did nothing at all:keytool -v -keystore /usr/lib/jvm/j2sdk1.6-oracle/jre/lib/security/jssecacerts -import -file /etc/ssl/certs/NetLock_Express_\=Class_C\=_Root.pem -alias NetLock_Express_\=Class_C\=_Rootkeystore has a password... is it important?After this commend, the cert is really in the keystore:root@ct-node2:/opt/rhq-agent/logs# keytool -v -keystore /usr/lib/jvm/j2sdk1.6-oracle/jre/lib/security/jssecacerts -list|lessOwner: CN=NetLock Expressz (Class C) Tanusitvanykiado, OU=Tanusitvanykiadok, O=NetLock Halozatbiztonsagi Kft., L=Budapest, C=HUIssuer: CN=NetLock Expressz (Class C) Tanusitvanykiado, OU=Tanusitvanykiadok, O=NetLock Halozatbiztonsagi Kft., L=Budapest, C=HUSerial number: 68Valid from: Thu Feb 25 15:08:11 CET 1999 until: Wed Feb 20 15:08:11 CET 2019Certificate fingerprints:MD5: 4F:EB:F1:F0:70:C2:80:63:5D:58:9F:DA:12:3C:A9:C4SHA1: E3:92:51:2F:0A:CF:F5:05:DF:F6:DE:06:7F:75:37:E1:65:EA:57:4BSHA256: 0B:5E:ED:4E:84:64:03:CF:55:E0:65:84:84:40:ED:2A:82:75:8B:F5:B9:AA:1F:25:3D:46:13:CF:A0:80:FF:3FSignature algorithm name: MD5withRSAVersion: 3...But the error message in the agent.log is still the same:2014-01-13 09:59:34,000 ERROR [ResourceContainer.invoker.daemon-2] (org.rhq.plugins.netservices.HTTPNetServiceComponent)- javax.net.ssl.SSLPeerUnverifiedException: peer not authenticatedViewing the relevant page from a browser, The sec info shows different fingerprints, but that're the server cert, not the CA cert.Any idea how to go fwd?
Thanks for reading!regards,Attila2014/1/10 Thomas Segismont <tsegismo@redhat.com>
Le 10/01/2014 15:56, Attila Heidrich a écrit :
I have found the clues I guess... keystore stuff should be in<mailto:attila.heidrich@gmail.com>>
<agent-dir>/conf according to the java default prefs
<entry key="rhq.agent.client.security.keystore.file"
value="/opt/rhq-agent/conf/keystore.dat"/>
<entry key="rhq.agent.client.security.truststore.file"
value="/opt/rhq-agent/conf/truststore.dat"/>
but no such entries in the current config, and the whole section is
commented in the agent-configuration.xml.
A
2014/1/10 Attila Heidrich <attila.heidrich@gmail.com
No error message, at least not in agent.log.
^^ that's weird, HTTPNetServiceComponent logs exceptions at error level
https://git.fedorahosted.org/cgit/rhq/rhq.git/tree/modules/plugins/netservices/src/main/java/org/rhq/plugins/netservices/HTTPNetServiceComponent.java#n212You're running a Debian bases system IIRC? Do you use OpenJDK or did you correctly setup OracleJDK as an alternative? If you did, then I recommend you follow this method:
I also think it should be related to the SSL communication, like the
CAs key is not in the Java/Jboss keystore. Unfortunately, I do not
know, how to install it, and can not find a howto either.
http://blog.chmouel.com/2010/06/03/connecting-to-self-signed-ssl-certificate-from-java-on-debian-ubuntu/
The idea is basically to install your CA certificate in the system folder for certificates ("/etc/ssl/certs") and then to run "update-ca-certificates". Then all systems tools (curl and friends) and the JVM will recognize your CA.
Thomas
_______________________________________________
rhq-users mailing list
rhq-users@lists.fedorahosted.org
https://lists.fedorahosted.org/mailman/listinfo/rhq-users