SSLHandshakeException in Tibco BW

ssl tibco businessworks tibco-business-works
Noel picture Noel · Feb 27, 2013 · Viewed 7.7k times · Source

I have been facing an SSLHandshakeException while trying to connect from Tibco BW to an external vendor. I understand that this error usually occurs due to a mismatch in the certificates installed on either of the systems. But i would like to know specifically for which side is this SSL exception exactly occuring?

Also as a part of resolution for which side should the certificates be changed or updated ? I have also attached the full log message. Thanks in advance

Answer

erikxiv picture erikxiv · Feb 27, 2013

I would suspect that the issue is not related to the certificates. If your BusinessWorks application did not trust the external vendors certificate you would get an entirely different error message.

A more likely suspect would be that your BusinessWorks application and the external vendor server could not find a matching protocol that both sides accept (such as SSLv3 or TLSv1). Try connecting using your favorite web browser or use tools such as openssl to find out which protocols the server supports.

Update: Try to execute the following commands and see if you get a handshake failure for any of them

openssl s_client -connect server:port -ssl2
openssl s_client -connect server:port -ssl3
openssl s_client -connect server:port -tls1

As an example, BW does not support SSL 2.0, so if that is the only protocol the server supports you need to modify the default security provider by setting the following property to your deployed .tra file

java.property.TIBCO_SECURITY_VENDOR=j2se

Related questions

Tibco SOAP request over https - SSL certificate verification problem

I'm using Tibco BusinessWorks to consume a soap web service over an HTTPS connection. The instructions boil down to: Export certificates using a web browser. Use the Tools->Trusted Certificates->Import PEM format to folder within the project. …

Read More
How to create a self-signed certificate with OpenSSL

I'm adding HTTPS support to an embedded Linux device. I have tried to generate a self-signed certificate with these steps: openssl req -new > cert.csr openssl rsa -in privkey.pem -out key.pem openssl x509 -in cert.csr -out …

Read More
Getting Chrome to accept self-signed localhost certificate

I have created a self-signed SSL certificate for the localhost CN. Firefox accepts this certificate after initially complaining about it, as expected. Chrome and IE, however, refuse to accept it, even after adding the certificate to the system certificate store …

Read More