Skip to main content

This content is closed to future replies and is no longer being maintained or updated.
Links may no longer function. If you have a similar request, please write a new post.

Question

 Nagaraj Ponnurangam (NagarajP0101)
ING Belgium SA NV

ING Belgium SA NV
BE
NagarajP0101 Member since 2017 54 posts
ING Belgium SA NV
Posted: Apr 18, 2018
Last activity: Apr 18, 2018
Posted: 18 Apr 2018 6:28 EDT
Last activity: 18 Apr 2018 13:28 EDT
Closed

Issue with SSL handshake post oracle 12 upgrade

Hi,

We recently migrated oracle DB for our pega application from version 11g to 12c. Since then, facing below SSL issue with connect rest,

https/allowAllHostnames = true -> peer not authenticated error

https/allowAllHostnames = false -> exception :Caught unhandled exception: javax.net.ssl.SSLException: hostname in certificate didn't match: !=

Certificates from the external systems are completely configured in WAS. pega do not have truststore\Keystore in this case.

Could you please advise what could be missed in this issue?

To see attachments, please log in.
DevOps
Data Integration
Security

Posted: 6 years ago
Posted: 18 Apr 2018 11:23 EDT
Basavaraj Kadakol (BASAVARAJ)
PEGA
Senior Manager of Technical Support Engineering
Pegasystems Inc.
AU

Hi Nagaraj,

Have you tried adding a DSS "https/allowAllHostnames" in "Pega-IntegrationEngine" ruleset and setting it to "true"? 

Regards,

Basavaraj

To see attachments, please log in.
Posted: 6 years ago
Posted: 18 Apr 2018 12:21 EDT
Nagaraj Ponnurangam (NagarajP0101)
ING Belgium SA NV

ING Belgium SA NV
BE

Hi Basavaraj,

Thanks for your reply. when i made this DSS as true, getting the exception "

Show More

Hi Basavaraj,

Thanks for your reply. when i made this DSS as true, getting the exception "

Caused by: 
javax.net.ssl.SSLPeerUnverifiedException: peer not authenticated
	at com.ibm.jsse2.dc.getPeerCertificates(dc.java:60)
	at com.pega.apache.http.conn.ssl.AbstractVerifier.verify(AbstractVerifier.java:128)
	at com.pega.apache.http.conn.ssl.SSLSocketFactory.connectSocket(SSLSocketFactory.java:398)
	at com.pega.apache.http.conn.ssl.SSLSocketFactory.connectSocket(SSLSocketFactory.java:496)
	at com.pega.apache.http.conn.scheme.SchemeSocketFactoryAdaptor.connectSocket(SchemeSocketFactoryAdaptor.java:62)
	at com.pega.apache.http.impl.conn.DefaultClientConnectionOperator.openConnection(DefaultClientConnectionOperator.java:148)
	at com.pega.apache.http.impl.conn.AbstractPoolEntry.open(AbstractPoolEntry.java:149)
	at com.pega.apache.http.impl.conn.AbstractPooledConnAdapter.open(AbstractPooledConnAdapter.java:121)
	at com.pega.apache.http.impl.client.DefaultRequestDirector.tryConnect(DefaultRequestDirector.java:573)
	at com.pega.apache.http.impl.client.DefaultRequestDirector.execute(DefaultRequestDirector.java:425)
	at com.pega.apache.http.impl.client.AbstractHttpClient.execute(AbstractHttpClient.java:825)
	at com.pega.apache.http.impl.client.AbstractHttpClient.execute(AbstractHttpClient.java:759)
	at com.pegarules.generated.activity.ra_action_pyinvokerestconnector_28ccb2185309b8c9c6d59a05ed51acae.step5_circum0(ra_action_pyinvokerestconnector_28ccb2185309b8c9c6d59a05ed51acae.java:1185)

Could you please advise what could be the issue here?


Show Less
To see attachments, please log in.
Posted: 6 years ago
Posted: 18 Apr 2018 13:22 EDT
Jeff Houle (HOULJ) Senior Software Engineer
Pegasystems Inc.
US

This is DSS a DEBUG-TIME-ONLY setting, and should NOT be used in production environments. The inherent security risks are too great.

To see attachments, please log in.
Posted: 6 years ago
Posted: 18 Apr 2018 13:28 EDT
Jeff Houle (HOULJ) Senior Software Engineer
Pegasystems Inc.
US

Hi,

What version of Pega are you experiencing this on?

Could you please post the stack trace for the original issue (without setting any related DSS)?

Also, when you say the certificates are "completely configured in WAS," what "level" are they set at? Node/Server/etc?

To see attachments, please log in.

We'd prefer it if you saw us at our best.

Pega Collaboration Center has detected you are using a browser which may prevent you from experiencing the site as intended. To improve your experience, please update your browser.

Close Deprecation Notice