1

We have two servers deployed, everything same but different Host specific certificates. Both the servers have their on java key store (jks) in which host specific cert, intrim and root certs are imported.
Host specific certs say host-1 and host-2 have same trust chain till root but in host-2 all the certs till root have longer validity. To get the new certs its a time taking process, hence to make the things work, I copy the jks from server-2 and replace it in host-1, delete the host-2 related cert/alias from the jks and import the host-1 in the same jks. Now I try to start my webapp. It starts green. (earlier app did not star with the expired chain). But when I try to access the REST APIs, I get following error.

2016-08-02 15:29:23,969 DEBUG nio.ssl (SslConnection.java:wrap(475)) - SCEP@fe16e5{l(/IP1:35840)<->r(/IP2:8444),s=1,open=true,ishut=false,oshut=false,rb=false,wb=false,w=true,i=1r}-{SslConnection@4ddce8ac SSL NEED_WRAP i/o/u=0/0/0 ishut=false oshut=false {AsyncHttpConnection@20993ce7,g=HttpGenerator{s=0,h=-1,b=-1,c=-1},p=HttpParser{s=-14,l=0,c=0},r=0}}
javax.net.ssl.SSLHandshakeException: no cipher suites in common
        at sun.security.ssl.Handshaker.checkThrown(Handshaker.java:1431)
        at sun.security.ssl.SSLEngineImpl.checkTaskThrown(SSLEngineImpl.java:535)
        at sun.security.ssl.SSLEngineImpl.writeAppRecord(SSLEngineImpl.java:1214)
        at sun.security.ssl.SSLEngineImpl.wrap(SSLEngineImpl.java:1186)
        at javax.net.ssl.SSLEngine.wrap(SSLEngine.java:469)

Here is the command(s) I used to import Host specific certificate in the jks. All following are tried but I get the same error.

keytool -import -alias gateway-identity -keyalg RSA -keystore gateway.jks -trustcacerts -file /etc/pki/tls/certs/Prod-A-HostFQDN.cer -storepass JKSP@ssword

keytool -import -alias gateway-identity -keyalg RSA -keystore gateway.jks -file /etc/pki/tls/certs/Prod-A-HostFQDN.cer -storepass JKSP@ssword

keytool -import -alias gateway-identity -keystore gateway.jks -file /etc/pki/tls/certs/Prod-A-HostFQDN.cer -storepass JKSP@ssword

Can anyone say what is the issue and how to go about this?

JE

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.