tylert
commented
7 years ago I have run into the exact same problem as described here with IoT 3.1.0-M8, 3.1.0-alpha and 3.1.0-beta.
Steps to reproduce the problem for any recent IoT 3.1.0 builds:
- Download an official IoT zip file and extract it.
- Make the changes defined by https://docs.wso2.com/display/IoTS310/Configuring+WSO2+IoT+Server+with+the+IP (replace "localhost" with "test1.mydomain.foo").
- Follow the steps to correct the certificates as defined by https://wso2.org/jira/browse/DOCUMENTATION-4535.
- Copy the resulting *.jks files back to their expected locations.
The following steps work perfectly for IoT 3.0.0 but fail to work for recent 3.1.0 builds:
- Download an official IoT zip file and extract it.
- Make the changes defined by https://docs.wso2.com/display/IoTS300/Configuring+WSO2+IoT+Server+with+the+IP (replace "localhost" with "test1.mydomain.foo").
- Copy the existing *.jks files from the zip file to a temp location.
- Follow the steps to correct the certificates as defined by https://docs.wso2.com/display/IoTS300/General+iOS+Server+Configurations.
- Copy the modified *.jks files back to their expected locations.
I found the following script template very helpful while trying to automate some of the tedious manual steps:
#!/usr/bin/env bash
if [ -z "${myhostname}" ]; then
myhostname="test1.mydomain.foo"
fi
# Perform tedious, in-place configuration changes
perl -pi -e "s/localhost/${myhostname}/g" $(find . -name 'carbon.xml')
perl -pi -e "s/localhost/${myhostname}/g" $(find . -name 'wso2server.sh') # IoT 3.0.0
perl -pi -e "s/localhost/${myhostname}/g" $(find . -name 'iot-server.sh') # IoT 3.1.0
perl -pi -e "s/localhost/${myhostname}/g" $(find . -name 'sso-idp-config.xml')
perl -pi -e "s/localhost/${myhostname}/g" $(find . -name 'app-manager.xml')
perl -pi -e "s/localhost/${myhostname}/g" $(find . -name 'app-conf.json')
perl -pi -e "s/%iot.keymanager.host%/${myhostname}/g" $(find . -name 'app-conf.json')
perl -pi -e "s/%iot.keymanager.https.port%/9443/g" $(find . -name 'app-conf.json')
perl -pi -e "s/%iot.manager.host%/${myhostname}/g" $(find . -name 'app-conf.json')
perl -pi -e "s/%iot.manager.https.port%/9443/g" $(find . -name 'app-conf.json')
perl -pi -e "s/localhost/${myhostname}/g" $(find . -name 'site.json')
perl -pi -e "s/localhost/${myhostname}/g" $(find . -name 'designer.json')
perl -pi -e "s/%https.host%/https:\/\/${myhostname}:9443/g" $(find . -name 'designer.json')
perl -pi -e "s/localhost/${myhostname}/g" $(find . -name 'admin--Android-Mutual-SSL*.xml')
# XXX FIXME XXX
# Grab the existing keystores to be fixed (it is assumed that they're all the same)
mkdir -p junk
cp --verbose $(find . -name 'client-truststore.jks' | head -1) junk
cp --verbose $(find . -name 'wso2carbon.jks' | head -1) junk
cp --verbose $(find . -name 'wso2certs.jks' | head -1) junk
# Do some certificate fixing stuff here...
# XXX FIXME XXX
# Put the repaired keystores back (overwrite the existing ones)
for target in $(find . -name 'client-truststore.jks'); do
cp --verbose junk/client-truststore.jks ${target}
done
for target in $(find . -name 'wso2carbon.jks'); do
cp --verbose junk/wso2carbon.jks ${target}
done
for target in $(find . -name 'wso2certs.jks'); do
cp --verbose junk/wso2certs.jks ${target}
done
Tofdu31
MattcCR92
milanperera
monta9
Hi all,
Error after installation certificate
I have customized the IP address of the server. Everything works fine. When I set up the certificates for my domain name, I have an error when starting the WSO2 server Iot 3.1.0
I can connect without worry with the certificates to WSO2 carbon and the certificate is well recognized
14/5000 Here are the logs :
[2017-07-06 14:32:35,278] [IoT-Core] INFO - {org.wso2.carbon.dashboard.deployment.DashboardDeployer} Dashboard definition [device-statistics-dashboard] has been created. [2017-07-06 14:32:35,285] [IoT-Core] WARN - {org.wso2.carbon.application.deployer.internal.ApplicationManager} No artifacts found to be deployed in this server. Ignoring Carbon Application : org_wso2_carbon_iot_geo_dashboard-1.0.0.car [2017-07-06 14:32:35,298] [IoT-Core] INFO - {org.apache.tomcat.util.net.NioSelectorPool} Using a shared selector for servlet write/read [2017-07-06 14:32:35,342] [IoT-Core] INFO - {org.apache.tomcat.util.net.NioSelectorPool} Using a shared selector for servlet write/read [2017-07-06 14:32:35,513] [IoT-Core] INFO - {org.wso2.carbon.ntask.core.service.impl.TaskServiceImpl} Task service starting in STANDALONE mode... [2017-07-06 14:32:35,531] [IoT-Core] INFO - {org.wso2.carbon.device.mgt.core.task.impl.DeviceTaskManagerServiceImpl} Task adding for android [2017-07-06 14:32:35,654] [IoT-Core] INFO - {org.wso2.carbon.ntask.core.impl.AbstractQuartzTaskManager} Task scheduled: [-1234][DEVICE_MONITORING][android-1234] [2017-07-06 14:32:35,654] [IoT-Core] INFO - {org.wso2.carbon.device.mgt.core.task.impl.DeviceTaskManagerServiceImpl} Task adding for windows [2017-07-06 14:32:35,689] [IoT-Core] INFO - {org.wso2.carbon.ntask.core.impl.AbstractQuartzTaskManager} Task scheduled: [-1234][DEVICE_MONITORING][windows-1234] [2017-07-06 14:32:35,693] [IoT-Core] INFO - {org.wso2.carbon.device.mgt.core.status.task.impl.DeviceStatusTaskManagerServiceImpl} Device Status monitoring Task adding for android [2017-07-06 14:32:35,724] [IoT-Core] INFO - {org.wso2.carbon.ntask.core.impl.AbstractQuartzTaskManager} Task scheduled: [-1234][DEVICE_STATUS_MONITORING][DEVICE_STATUS_MONITORING_android_1] [2017-07-06 14:32:35,724] [IoT-Core] INFO - {org.wso2.carbon.device.mgt.core.status.task.impl.DeviceStatusTaskManagerServiceImpl} Device Status monitoring Task adding for windows [2017-07-06 14:32:35,754] [IoT-Core] INFO - {org.wso2.carbon.ntask.core.impl.AbstractQuartzTaskManager} Task scheduled: [-1234][DEVICE_STATUS_MONITORING][DEVICE_STATUS_MONITORING_windows_3] [2017-07-06 14:32:35,898] [IoT-Core] INFO - {org.wso2.carbon.ntask.core.impl.AbstractQuartzTaskManager} Task scheduled: [-1234][MONITORING_TASK][MONITORING_-1234] [2017-07-06 14:32:35,952] [IoT-Core] INFO - {org.wso2.carbon.registry.eventing.internal.RegistryEventingServiceComponent} Successfully Initialized Eventing on Registry [2017-07-06 14:32:36,129] [IoT-Core] INFO - {org.wso2.carbon.core.init.JMXServerManager} JMX Service URL : service:jmx:rmi://localhost:11111/jndi/rmi://localhost:9999/jmxrmi [2017-07-06 14:32:36,131] [IoT-Core] INFO - {org.wso2.carbon.device.mgt.url.printer.URLPrinterStartupHandler} IoT Console URL : https://MY_DOMAIN:9443/devicemgt [2017-07-06 14:32:36,159] [IoT-Core] INFO - {org.wso2.carbon.core.internal.StartupFinalizerServiceComponent} Server : WSO2 IoT Server-3.1.0-SNAPSHOT [2017-07-06 14:32:36,160] [IoT-Core] INFO - {org.wso2.carbon.core.internal.StartupFinalizerServiceComponent} WSO2 Carbon started in 196 sec [2017-07-06 14:32:36,660] [IoT-Core] INFO - {org.wso2.carbon.ui.internal.CarbonUIServiceComponent} Mgt Console URL : https://MY_DOMAIN:9443/carbon/ [2017-07-06 14:32:40,740] [IoT-Analytics] ERROR {org.wso2.carbon.device.mgt.input.adapter.mqtt.util.MQTTAdapterListener} - Failed to create a http connection. javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target at sun.security.ssl.Alerts.getSSLException(Alerts.java:192) at sun.security.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1949) at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:302) at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:296) at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1514) at sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:216) at sun.security.ssl.Handshaker.processLoop(Handshaker.java:1026) at sun.security.ssl.Handshaker.process_record(Handshaker.java:961) at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1062) at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1375) at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1403) at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1387) at org.apache.http.conn.ssl.SSLConnectionSocketFactory.connectSocket(SSLConnectionSocketFactory.java:261) at org.apache.http.impl.conn.HttpClientConnectionOperator.connect(HttpClientConnectionOperator.java:118) at org.apache.http.impl.conn.PoolingHttpClientConnectionManager.connect(PoolingHttpClientConnectionManager.java:314) at org.apache.http.impl.execchain.MainClientExec.establishRoute(MainClientExec.java:357) at org.apache.http.impl.execchain.MainClientExec.execute(MainClientExec.java:218) at org.apache.http.impl.execchain.ProtocolExec.execute(ProtocolExec.java:194) at org.apache.http.impl.execchain.RetryExec.execute(RetryExec.java:85) at org.apache.http.impl.execchain.RedirectExec.execute(RedirectExec.java:108) at org.apache.http.impl.client.InternalHttpClient.doExecute(InternalHttpClient.java:186) at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:82) at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:106) at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:57) at org.wso2.carbon.device.mgt.input.adapter.mqtt.util.MQTTAdapterListener.startListener(MQTTAdapterListener.java:174) at org.wso2.carbon.device.mgt.input.adapter.mqtt.util.MQTTAdapterListener.run(MQTTAdapterListener.java:302) at java.lang.Thread.run(Thread.java:748) Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:387) at sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:292) at sun.security.validator.Validator.validate(Validator.java:260) at sun.security.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:324) at sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:229) at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:105) at org.apache.http.conn.ssl.SSLContextBuilder$TrustManagerDelegate.checkServerTrusted(SSLContextBuilder.java:190) at sun.security.ssl.AbstractTrustManagerWrapper.checkServerTrusted(SSLContextImpl.java:984) at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1496) ... 22 more Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target at sun.security.provider.certpath.SunCertPathBuilder.build(SunCertPathBuilder.java:141) at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:126) at java.security.cert.CertPathBuilder.build(CertPathBuilder.java:280) at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:382) ... 30 more Exception in thread "Thread-38" org.wso2.carbon.apimgt.integration.client.exception.APIMClientOAuthException: failed to retrieve oauth token using jwt at org.wso2.carbon.apimgt.integration.client.OAuthRequestInterceptor.apply(OAuthRequestInterceptor.java:114) at feign.SynchronousMethodHandler.targetRequest(SynchronousMethodHandler.java:158) at feign.SynchronousMethodHandler.executeAndDecode(SynchronousMethodHandler.java:88) at feign.SynchronousMethodHandler.invoke(SynchronousMethodHandler.java:76) at feign.ReflectiveFeign$FeignInvocationHandler.invoke(ReflectiveFeign.java:103) at com.sun.proxy.$Proxy40.apisGet(Unknown Source) at org.wso2.carbon.apimgt.webapp.publisher.APIPublisherServiceImpl.publishAPI(APIPublisherServiceImpl.java:53) at org.wso2.carbon.apimgt.webapp.publisher.APIPublisherStartupHandler.publishAPIs(APIPublisherStartupHandler.java:97) at org.wso2.carbon.apimgt.webapp.publisher.APIPublisherStartupHandler.access$500(APIPublisherStartupHandler.java:30) at org.wso2.carbon.apimgt.webapp.publisher.APIPublisherStartupHandler$1.run(APIPublisherStartupHandler.java:69) at java.lang.Thread.run(Thread.java:748) Caused by: org.wso2.carbon.identity.jwt.client.extension.exception.JWTClientException: Failed loading the private key. at org.wso2.carbon.identity.jwt.client.extension.util.JWTClientUtil.generateSignedJWTAssertion(JWTClientUtil.java:301) at org.wso2.carbon.identity.jwt.client.extension.util.JWTClientUtil.generateSignedJWTAssertion(JWTClientUtil.java:212) at org.wso2.carbon.identity.jwt.client.extension.JWTClient.getAccessToken(JWTClient.java:71) at org.wso2.carbon.apimgt.integration.client.OAuthRequestInterceptor.apply(OAuthRequestInterceptor.java:99) ... 10 more Caused by: java.lang.IllegalArgumentException: The private RSA key must not be null at com.nimbusds.jose.crypto.RSASSASigner.<init>(RSASSASigner.java:55) at org.wso2.carbon.identity.jwt.client.extension.util.JWTClientUtil.generateSignedJWTAssertion(JWTClientUtil.java:282) ... 13 moreI can not connect to devicemgt too
Error : ` SAML 2.0 based Single Sign-On
Error when processing the authentication request!
Please try login again.
`
Thanks for your help