{"id":5145,"date":"2015-08-16T20:26:43","date_gmt":"2015-08-16T12:26:43","guid":{"rendered":"http:\/\/rmohan.com\/?p=5145"},"modified":"2015-08-16T20:26:43","modified_gmt":"2015-08-16T12:26:43","slug":"more-on-ihs-and-ssl-ssl0208e-ssl-handshake-failed-certificate-validation-error","status":"publish","type":"post","link":"https:\/\/mohan.sg\/?p=5145","title":{"rendered":"More on IHS and SSL – SSL0208E: SSL Handshake Failed, Certificate validation error"},"content":{"rendered":"
\n

if you see: –<\/div>\n
<\/div>\n
Error 101 (net::ERR_CONNECTION_RESET): The connection was reset.<\/span><\/div>\n
<\/div>\n
in Chrome, and: –<\/div>\n
<\/div>\n
[Wed Apr 17 05:06:32 2013] [error] [client 192.168.8.1] [7f0eb40028d0] [5144] SSL0208E: SSL Handshake Failed, Certificate validation error. [192.168.8.1:52195 -> 192.168.8.162:8443]\u00a0[05:06:32.584379]
\n[Wed Apr 17 05:06:32 2013] [error] [client 192.168.8.1] [7f0eb400b3d0] [5144] SSL0208E: SSL Handshake Failed, Certificate validation error. [192.168.8.1:52196 -> 192.168.8.162:8443]\u00a0[05:06:32.585419]
\n[Wed Apr 17 05:06:32 2013] [error] [client 192.168.8.1] [7f0eb800edd0] [5144] SSL0208E: SSL Handshake Failed, Certificate validation error. [192.168.8.1:52197 -> 192.168.8.162:8443]\u00a0[05:06:32.586475]
\n[Wed Apr 17 05:06:32 2013] [error] [client 192.168.8.1] [7f0eac0115c0] [5144] SSL0208E: SSL Handshake Failed, Certificate validation error. [192.168.8.1:52198 -> 192.168.8.162:8443]\u00a0[05:06:32.587517]
\n[Wed Apr 17 05:06:32 2013] [error] [client 192.168.8.1] [7f0eb000e7b0] [5144] SSL0208E: SSL Handshake Failed, Certificate validation error. [192.168.8.1:52199 -> 192.168.8.162:8443]\u00a0[05:06:32.588528]<\/span><\/p>\n<\/div>\n
in the IHS error logs, chances are that you\u00a0only have one certificate in\u00a0the\u00a0IHS SSL\u00a0keystore or, to be more accurate, the root CA certificate is\u00a0missing.<\/div>\n<\/div>\n
<\/div>\n
This can be validated as follows: –<\/div>\n
<\/div>\n
\/opt\/IBM\/HTTPServer\/bin\/gskcapicmd -cert -list -db client.kdb\u00a0<\/i><\/p>\n<\/div>\n
Certificates found<\/span><\/div>\n
* default, – personal, ! trusted
\n*- clientcert<\/span><\/p>\n<\/div>\n
In other words, this shows that we only have the client certificate ( sometimes known as the intermediate or “device” certificate ) but not the CA\u00a0certificate.<\/div>\n
<\/div>\n
This is easily fixed: –<\/div>\n
<\/div>\n
\/opt\/IBM\/HTTPServer\/java\/jre\/bin\/ikeycmd -cert -add -db client.kdb -label myca -file test.cer<\/i><\/div>\n
<\/div>\n
( this assumes that you’ve been following the previous post and have extracted the root CA certificate from the CA\u00a0keystore into the file test.cer )<\/div>\n
<\/div>\n
\/opt\/IBM\/HTTPServer\/bin\/gskcapicmd -cert -list -db client.kdb\u00a0<\/i><\/p>\n<\/div>\n
Certificates found
\n* default, – personal, ! trusted
\n! myca
\n*- clientcert<\/span><\/p>\n<\/div>\n
Once IHS is restarted, all is well \ud83d\ude42<\/div>\n","protected":false},"excerpt":{"rendered":"

if you see: – Error 101 (net::ERR_CONNECTION_RESET): The connection was reset. in Chrome, and: – [Wed Apr 17 05:06:32 2013] [error] [client 192.168.8.1] [7f0eb40028d0] [5144] SSL0208E: SSL Handshake Failed, Certificate validation error. [192.168.8.1:52195 -> 192.168.8.162:8443] [05:06:32.584379] [Wed Apr 17 05:06:32 2013] [error] [client 192.168.8.1] [7f0eb400b3d0] [5144] SSL0208E: SSL Handshake Failed, Certificate validation error. [192.168.8.1:52196 […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[25],"tags":[],"_links":{"self":[{"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/posts\/5145"}],"collection":[{"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mohan.sg\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=5145"}],"version-history":[{"count":1,"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/posts\/5145\/revisions"}],"predecessor-version":[{"id":5146,"href":"https:\/\/mohan.sg\/index.php?rest_route=\/wp\/v2\/posts\/5145\/revisions\/5146"}],"wp:attachment":[{"href":"https:\/\/mohan.sg\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=5145"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mohan.sg\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=5145"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mohan.sg\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=5145"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}