How to debug SSL connections errors

How to debug SSL connections errors

book

Article ID: KB0074656

calendar_today

Updated On:

Products Versions
TIBCO DataSynapse GridServer -

Description

When trying to isolate an SSL issue in GridServer (GS), the information included in the GS log files can be sparse or misleading making it difficult to identify the source of the issue.  The JVM includes some debugging information that can be helpful in tracking down the issue. 

Example log message: 

WARNING: [JndiSupport] Search failed on: ldaps://<server>:636, javax.naming.CommunicationException: <server>:636 [Root exception is java.net.SocketException: java.security.NoSuchAlgorithmException: Error constructing implementation (algorithm: Default, provider: SunJSSE, class: sun.security.ssl.SSLContextImpl$DefaultSSLContext)]

The underlying issue in this case was the keystore password was incorrect for server.keystore. 

Issue/Introduction

Steps to enable extra logging to debug SSL connection errors

Resolution

Debugging steps on a testing Linux environment:
1) Stop the manager
2) In the server.sh file:
***Insert this new line:
EXTRA_ARGS="-stdout $DS_BASEDIR/log/out.log -J-Djavax.net.debug=SSL,handshake,data,trustmanager $EXTRA_ARGS"

***After the following line that already exists in the file: 
EXTRA_ARGS="-J-Dds.logToSystem=$DS_LOG_TO_SYSTEM $EXTRA_ARGS"

3) Start the manager
4) Trigger SSL connection attempt
5) Review the out.log file under $DS_BASEDIR/log/ directory for more information around the issue

After this has been completed, you can disable the setting by:
1) Stopping the manager
2) Removing the line from the server.sh file:
EXTRA_ARGS="-stdout $DS_BASEDIR/log/out.log -J-Djavax.net.debug=SSL,handshake,data,trustmanager $EXTRA_ARGS"
3) Starting the manager

Additional Information

https://docs.oracle.com/javase/7/docs/technotes/guides/security/jsse/ReadDebug.html