Enable TLS in Standalone Java to connect to WSO2 IS

Some days ago, I wrote a blog on how to disable SSL and enable TLS in WebLogic application server. The link is here if you are interested to read further http://ayyappan-gandhirajan.blogspot.in/2015/09/enable-tls-security-in-weblogic-n-WSO2-IS.html

My colleague has approached me today to know how to do the same thing in a Core Java environment - I mean he is running a standalone program which uses HttpURLConnection to connect to HTTPS URL (which is hosted in WSO2 Identity Server, available at http://wso2.com/products/identity-server/)

After spending some time, I found a way to do this which has been described below:

1. Add JVM argument -Dhttps.protocols=TLSv1 on the client side

2. Or add this line into your the jave program - java.lang.System.setProperty("https.protocols", "TLSv1");

He just added JVM argument, and now he is able to connect the HTTPS URL without any issue.

Hope you like it.

Enable TLS security in Weblogic Application server to avoid "Read channel closed" error

Some host servers have been configured "not" to use SSL v1, v2 and v3 protocols for security reasons. Instead, they have been configured to use TLS protocol to ensure more secure HTTPS traffic.

Recently, I faced an issue with using SSL. My WebLogic application server had to connect to WSO2 Identity Server (http://wso2.com/products/identity-server/) for getting access token (https://docs.wso2.com/display/IS500/OpenID+Connect+with+the+WSO2+Identity+Server+and+WSO2+OAuth2+Playground) using an HTTPS URL. However, I was initially getting error "Read channel closed" on the WebLogic side. There was no other useful information. My other colleague, who takes care of WSO2 IS, troubleshooted and found that SSL has been disabled on the WSO2 IS server. This gave me a clue and then finally found the following option to make WebLogic to use TLS rather than SSL for initiating HTTPS traffic.

Pass this JVM argument -Dweblogic.security.SSL.protocolVersion=TLS1 into your WebLogic application server start up script. Restart the server and it is DONE.

With the above, my WebLogic server is now able to connect to WSO2 IS using HTTPS protocol.

Hope this helps.

Apache SSL configuration with sample

Many a times, you might want to set up an Apache httpd server as front end that talks to back end application servers such as Oracle WebLogic or Apache Tomcat. While httpd acts as a proxy, you might also want to use it as an SSL server. It will ensure that the communication between browser and apache httpd is secure. But, have you ever thought how easy it is to set up SSL using apache? Believe me, it is really easy. Apache configuration is so powerful (I agree, sometimes it is painful if you don’t know what you are usingJ) and needs very minimal configuration.

The minimum things that you would need are: -

a) Server certificate

                - Your browser user can identify which server he/she is connecting to. This is PEM encoded certificate. If you open the certificate in an editor like notepad, you can see scrambled text which starts with -----BEGIN CERTIFICATE----- and ends with -----END CERTIFICATE-----.

b) Private key to decrypt the encrypted data

                - Please make sure that your private key is kept secure. You can use key that use either RSA or DSA.

c) Certificate chain from your certificate authority

                - The end certificate in the chain will be a root certificate. If you don’t have the complete chain, SSL might not work.

If you have all the above, then you can easily set up 'one-way' SSL which is otherwise known as 'Server authentication'. Please see below the snippet that is the minimal configuration required:

Listen 443

<VirtualHost *:443>

     SSLEngine on

     SSLCertificateFile public.crt

     SSLCertificateKeyFile private.key

     SSLCertificateChainFile intermediate.crt      

</VirtualHost>

The mod_ssl module also allows you to access certain environment variables which you may use them for debugging purpose. Use the following line that will allow you to create a separate log file for capturing SSL related information. You may also decide to switch on logging only in development.

CustomLog logs/ssl_request_log "%t %h %l %u %{SSL_PROTOCOL}x %{SSL_CIPHER}x %{HTTPS}x %{REFERER}i %{X-Forwarded-For}i \"%r\" %s %b"

One common issue that every one might face is with configuring 443 for SSL. you might get an error that is given below: -

(13)Permission denied: AH00072: make_sock: could not bind to address xx.xxx.xx.xx:443

no listening sockets available, shutting down

AH00015: Unable to open logs

Please make sure that you have 'root' access which is required for using standard ports 80 for http and 443 for https.

Hope this information will be useful for you.