Question

4
Replies
152
Views
NagarajP0101 Member since 2017 54 posts
ING Belgium SA NV
Posted: 2 years ago
Last activity: 2 years 6 months ago
Closed

Issue with SSL handshake post oracle 12 upgrade

Hi,

We recently migrated oracle DB for our pega application from version 11g to 12c. Since then, facing below SSL issue with connect rest,

https/allowAllHostnames = true -> peer not authenticated error

https/allowAllHostnames = false -> exception :Caught unhandled exception: javax.net.ssl.SSLException: hostname in certificate didn't match: !=

Certificates from the external systems are completely configured in WAS. pega do not have truststore\Keystore in this case.

Could you please advise what could be missed in this issue?

DevOps Data Integration Security
Close popover
Moderation Team has archived post
Posted: 2 years ago

Hi Nagaraj,


Have you tried adding a DSS "https/allowAllHostnames" in "Pega-IntegrationEngine" ruleset and setting it to "true"? 


Regards,


Basavaraj

Posted: 2 years ago

Hi Basavaraj,


Thanks for your reply. when i made this DSS as true, getting the exception "



Caused by: 
javax.net.ssl.SSLPeerUnverifiedException: peer not authenticated
	at com.ibm.jsse2.dc.getPeerCertificates(dc.java:60)
	at com.pega.apache.http.conn.ssl.AbstractVerifier.verify(AbstractVerifier.java:128)
	at com.pega.apache.http.conn.ssl.SSLSocketFactory.connectSocket(SSLSocketFactory.java:398)
	at com.pega.apache.http.conn.ssl.SSLSocketFactory.connectSocket(SSLSocketFactory.java:496)
	at com.pega.apache.http.conn.scheme.SchemeSocketFactoryAdaptor.connectSocket(SchemeSocketFactoryAdaptor.java:62)
	at com.pega.apache.http.impl.conn.DefaultClientConnectionOperator.openConnection(DefaultClientConnectionOperator.java:148)
	at com.pega.apache.http.impl.conn.AbstractPoolEntry.open(AbstractPoolEntry.java:149)
	at com.pega.apache.http.impl.conn.AbstractPooledConnAdapter.open(AbstractPooledConnAdapter.java:121)
	at com.pega.apache.http.impl.client.DefaultRequestDirector.tryConnect(DefaultRequestDirector.java:573)
	at com.pega.apache.http.impl.client.DefaultRequestDirector.execute(DefaultRequestDirector.java:425)
	at com.pega.apache.http.impl.client.AbstractHttpClient.execute(AbstractHttpClient.java:825)
	at com.pega.apache.http.impl.client.AbstractHttpClient.execute(AbstractHttpClient.java:759)
	at com.pegarules.generated.activity.ra_action_pyinvokerestconnector_28ccb2185309b8c9c6d59a05ed51acae.step5_circum0(ra_action_pyinvokerestconnector_28ccb2185309b8c9c6d59a05ed51acae.java:1185)


Could you please advise what could be the issue here?

Posted: 2 years ago

This is DSS a DEBUG-TIME-ONLY setting, and should NOT be used in production environments. The inherent security risks are too great.

Posted: 2 years ago

Hi,


What version of Pega are you experiencing this on?


Could you please post the stack trace for the original issue (without setting any related DSS)?


Also, when you say the certificates are "completely configured in WAS," what "level" are they set at? Node/Server/etc?
Share this page LinkedIn
Copied!