Enable SSL authentication between Apache Ace and Management agent

Question

I am trying to enable two way ssl authentication between Apache Ace and management agent(by following the document http://ace.apache.org/dev-doc/design/using-client-certificates.html). To achieve this , first of all i created the required certificates by following the steps mentioned below:

Step#1) Created a self-signed certificate authority using OpenSSL by excecuting the command below:

openssl req -x509 -new -config Certi/X509CA/openssl.cnf -days 365 -out Certi/X509CA/ca/new_ca.pem -keyout Certi/X509CA/ca/new_ca_pk.pem

This command created a certificate new_ca.pem and its private key new_ca_pk.pem.

Step#2) Imported the certificate new_ca.pem to keystore file named truststore by using following command

keytool -import -alias truststore -keystore truststore -file new_ca.pem

Step#3) Created certificate for the management agent, available in a Java keystore file, called keystore-ma.jks.

keytool -genkey -dname "CN=<hostIP>, OU=IT, O=<Organization Name>, ST=UP, C=IN" -validity 365 -alias keystore-ma -keypass secret -keystore keystore-ma.jks -storepass secret

Step#4) Created a CSR:

keytool -certreq -alias keystore-ma -file keystore-ma_csr.pem -keypass secret -keystore keystore-ma.jks -storepass secret

Step#5) Signed the certificate using the certificate authority created in Step 1.

openssl ca -config X509CA/openssl.cnf -days 365 -cert C:/X509CA/ca/new_ca.pem -keyfile C:/X509CA/ca/new_ca_pk.pem -in C:/X509CA/ca/keystore-ma_csr.pem -out C:/X509CA/ca/keystore-ma.pem

Step#6) Imported the certificate in a kestore file named keystore-ma

keytool -import -alias keystore-ma -keystore keystore-ma -file keystore-ma.pem

Similar steps(3-6) were followed to create and sign the cetificate or the ACE server, available in a Java keystore file, called keystore-server.

Then i updated the Platform.properties of Ace Server to include the additional properties and started Ace Server:

-Dorg.osgi.service.http.port.secure=8443
-Dorg.apache.felix.https.enable=true
-Dorg.apache.felix.https.truststore=/path/to/truststore
-Dorg.apache.felix.https.truststore.password=secret
-Dorg.apache.felix.https.keystore=/path/to/keystore-server
-Dorg.apache.felix.https.keystore.password=secret
-Dorg.apache.felix.https.clientcertificate=needs

Started ace-launcher.jar with the following command:

java -Djavax.net.ssl.trustStore=/path/to/truststore -Djavax.net.ssl.trustStorePassword=secret -Djavax.net.ssl.keyStore=/path/to/keystore-ma -Djavax.net.ssl.keyStorePassword=secret -jar org.apache.ace.launcher-0.8.1-SNAPSHOT.jar  discovery=https://<Ace Server Ip>:8443 identification=MyTarget

i tried multiple times by changing the discovery url to

 1) https://<Ace Server Ip>:8080
 2) http://<Ace Server Ip>:8080
 3) https://<Ace Server Ip>:8443

But the target was not registered in the Ace Server. Am i using the correct URLs to connect to Ace server through HTTPS? Also how to confirm if my Ace Server is configured to accept HTTPS traffic from the management agent?

Answer 1

I see you use a distinguished name (DN) with more than only a common name.
By convention, the hostname as common name is used for certificate validation. It should work if you create a certificate with CN=hostname-of-target (IP address is not sufficient).

Another hint I can give you for troubleshooting SSL errors: use -Djavax.net.debug=ssl for the server, it will spit out lots of information, but gives detailed information on what is going on and what causes the error.