Happy New Week! :)
Thanks the advices, unfortunately something's still missing.
The CA cert was already in place.
I have imported the CA by hand, since update-ca-certificates did nothing at all:
keytool -v -keystore /usr/lib/jvm/j2sdk1.6-oracle/jre/lib/security/jssecacerts -import -file /etc/ssl/certs/NetLock_Express_\=Class_C\=_Root.pem -alias NetLock_Express_\=Class_C\=_Root
keystore has a password... is it important?
After this commend, the cert is really in the keystore:
root@ct-node2:/opt/rhq-agent/logs# keytool -v -keystore /usr/lib/jvm/j2sdk1.6-oracle/jre/lib/security/jssecacerts -list|less
Owner: CN=NetLock Expressz (Class C) Tanusitvanykiado, OU=Tanusitvanykiadok, O=NetLock Halozatbiztonsagi Kft., L=Budapest, C=HU
Issuer: CN=NetLock Expressz (Class C) Tanusitvanykiado, OU=Tanusitvanykiadok, O=NetLock Halozatbiztonsagi Kft., L=Budapest, C=HU
Serial number: 68
Valid from: Thu Feb 25 15:08:11 CET 1999 until: Wed Feb 20 15:08:11 CET 2019
Certificate fingerprints:
MD5: 4F:EB:F1:F0:70:C2:80:63:5D:58:9F:DA:12:3C:A9:C4
SHA1: E3:92:51:2F:0A:CF:F5:05:DF:F6:DE:06:7F:75:37:E1:65:EA:57:4B
SHA256: 0B:5E:ED:4E:84:64:03:CF:55:E0:65:84:84:40:ED:2A:82:75:8B:F5:B9:AA:1F:25:3D:46:13:CF:A0:80:FF:3F
Signature algorithm name: MD5withRSA
Version: 3
...
But the error message in the agent.log is still the same:
2014-01-13 09:59:34,000 ERROR [ResourceContainer.invoker.daemon-2] (org.rhq.plugins.netservices.HTTPNetServiceComponent)- javax.net.ssl.SSLPeerUnverifiedException: peer not authenticated
Viewing the relevant page from a browser, The sec info shows different fingerprints, but that're the server cert, not the CA cert.
Any idea how to go fwd?
Thanks for reading!
regards,
Attila