{"id":5917,"date":"2013-08-08T14:39:15","date_gmt":"2013-08-08T18:39:15","guid":{"rendered":"http:\/\/onlineappsdba.com\/?p=5917"},"modified":"2017-03-24T06:51:12","modified_gmt":"2017-03-24T10:51:12","slug":"weblogic-ssl-configuration-inconsistent-security-configuration-cannot-convert-identity-certificate","status":"publish","type":"post","link":"https:\/\/onlineappsdba.com\/index.php\/2013\/08\/08\/weblogic-ssl-configuration-inconsistent-security-configuration-cannot-convert-identity-certificate\/","title":{"rendered":"WebLogic SSL configuration : Inconsistent security configuration Cannot convert identity certificate"},"content":{"rendered":"

I discussed about SSL basics<\/a> and SSL configuration in WebLogic Server<\/a>. In this post I am going to cover an issue encountered after configuring SSL in OIM\/SOA <\/a>deployed on WebLogic Server.<\/p>\n

 <\/p>\n

Issue<\/strong><\/span> : After configuring SSL WebLogic Server failed to start on SSL.<\/p>\n

Error message reported in WebLogic Server Log<\/strong><\/span> : $DOMAIN_HOME\/servers\/[server_name]\/logs<\/strong>\/<\/p>\n

_______<\/p>\n

<07-Aug-2013 13:52:53 o’clock UTC> <Notice> <Security> <BEA-090171> <Loading the identity certificate and private key stored under the alias\u00a0soa from the JKS keystore file \/u01\/app\/oracle\/admin\/domain\/dev\/config\/fmwconfig\/soa.jks.> <\/span>
\n<07-Aug-2013 13:52:53 o’clock UTC> <Error> <WebLogicServer> <BEA-000297> <Inconsistent security configuration, java.lang.RuntimeException: Cannot convert identity certificate<\/strong>>
\n<07-Aug-2013 13:52:53 o’clock UTC> <Error> <Server> <BEA-002618> <An invalid attempt was made to configure a channel for unconfigured protocol “Cannotconvert identity certificate”.><\/span><\/p>\n

______<\/p>\n

 <\/p>\n

Root Cause<\/strong><\/span> : This issue could be because of many reasons<\/p>\n

1. SHA as HASH ALgorithm :\u00a0<\/strong>If while signing the Certificate, signature hash algorithm<\/strong> used by CA is SHA256<\/strong> (to find Algorithm, click certificate and then Details<\/strong><\/span>) then this is supported only on WebLogic 10.3.3 or higher version (for prior version of WebLogic use SHA1<\/strong>). For WebLogic 10.3.3 or higher with SHA256<\/strong>, select option Use JSSE SSL<\/strong> in SSL<\/strong> tab<\/p>\n

 <\/p>\n

\"\"<\/a><\/p>\n

 <\/p>\n

Fix<\/strong>: \u00a0Use option Use JSEE SSL<\/strong><\/p>\n

Servers<\/strong> -> [<\/strong>name_of_the_weblogic_server_for_which_ssl_is_configured]<\/strong> -> Configuration<\/strong> -> SSL<\/strong> (sub tab) : Click on Advanced<\/strong> at bottom of the Page , select check box Use JSSE SSL<\/strong> and then save<\/strong> . Activate Change<\/strong> and restart WebLogic Server<\/strong>.<\/p>\n

 <\/p>\n

\"\"<\/a><\/p>\n

 <\/p>\n

2.<\/strong>\u00a0Other reason could be use of wildcard (*.domain_name) in SSL certificate .<\/p>\n

 <\/p>\n

Reference<\/strong><\/span><\/p>\n