Question

4
Replies
165
Views
Close popover
Nagaraj Ponnurangam (NagarajP0101)
ING Belgium SA NV

ING Belgium SA NV
BE
View Profile
NagarajP0101 Member since 2017 54 posts
ING Belgium SA NV
Posted: April 18, 2018
Last activity: April 18, 2018
Closed

Issue with SSL handshake post oracle 12 upgrade

Hi,

We recently migrated oracle DB for our pega application from version 11g to 12c. Since then, facing below SSL issue with connect rest,

https/allowAllHostnames = true -> peer not authenticated error

https/allowAllHostnames = false -> exception :Caught unhandled exception: javax.net.ssl.SSLException: hostname in certificate didn't match: !=

Certificates from the external systems are completely configured in WAS. pega do not have truststore\Keystore in this case.

Could you please advise what could be missed in this issue?

DevOps Data Integration Security
Close popover
Moderation Team has archived post
Posted: 2 years ago
Close popover
Basavaraj Kadakol (BASAVARAJ)
PEGA
Technical Manager
Pegasystems Inc.
IN
View Profile

Hi Nagaraj,


Have you tried adding a DSS "https/allowAllHostnames" in "Pega-IntegrationEngine" ruleset and setting it to "true"? 


Regards,


Basavaraj

Posted: 2 years ago
Close popover
Nagaraj Ponnurangam (NagarajP0101)
ING Belgium SA NV

ING Belgium SA NV
BE
View Profile

Hi Basavaraj,


Thanks for your reply. when i made this DSS as true, getting the exception "



Caused by: 
javax.net.ssl.SSLPeerUnverifiedException: peer not authenticated
	at com.ibm.jsse2.dc.getPeerCertificates(dc.java:60)
	at com.pega.apache.http.conn.ssl.AbstractVerifier.verify(AbstractVerifier.java:128)
	at com.pega.apache.http.conn.ssl.SSLSocketFactory.connectSocket(SSLSocketFactory.java:398)
	at com.pega.apache.http.conn.ssl.SSLSocketFactory.connectSocket(SSLSocketFactory.java:496)
	at com.pega.apache.http.conn.scheme.SchemeSocketFactoryAdaptor.connectSocket(SchemeSocketFactoryAdaptor.java:62)
	at com.pega.apache.http.impl.conn.DefaultClientConnectionOperator.openConnection(DefaultClientConnectionOperator.java:148)
	at com.pega.apache.http.impl.conn.AbstractPoolEntry.open(AbstractPoolEntry.java:149)
	at com.pega.apache.http.impl.conn.AbstractPooledConnAdapter.open(AbstractPooledConnAdapter.java:121)
	at com.pega.apache.http.impl.client.DefaultRequestDirector.tryConnect(DefaultRequestDirector.java:573)
	at com.pega.apache.http.impl.client.DefaultRequestDirector.execute(DefaultRequestDirector.java:425)
	at com.pega.apache.http.impl.client.AbstractHttpClient.execute(AbstractHttpClient.java:825)
	at com.pega.apache.http.impl.client.AbstractHttpClient.execute(AbstractHttpClient.java:759)
	at com.pegarules.generated.activity.ra_action_pyinvokerestconnector_28ccb2185309b8c9c6d59a05ed51acae.step5_circum0(ra_action_pyinvokerestconnector_28ccb2185309b8c9c6d59a05ed51acae.java:1185)


Could you please advise what could be the issue here?

Posted: 2 years ago
Close popover
Jeff Houle (HOULJ)
PEGA
Senior Software Engineer
Pegasystems Inc.
US
View Profile

This is DSS a DEBUG-TIME-ONLY setting, and should NOT be used in production environments. The inherent security risks are too great.

Posted: 2 years ago
Close popover
Jeff Houle (HOULJ)
PEGA
Senior Software Engineer
Pegasystems Inc.
US
View Profile

Hi,


What version of Pega are you experiencing this on?


Could you please post the stack trace for the original issue (without setting any related DSS)?


Also, when you say the certificates are "completely configured in WAS," what "level" are they set at? Node/Server/etc?
Share this page Share via LinkedIn Copying...
Copied!