Giters

OpenAS2 / OpenAs2App

OpenAS2 is a java-based implementation of the EDIINT AS2 standard. It is intended to be used as a server. It is extremely configurable and supports a wide variety of signing and encryption algorithms.

Home Page:https://sourceforge.net/projects/openas2/

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Self signed SSL certs in Docker

ThorTL67 opened this issue · comments

commented

We're running an OpenAS2v3.9.0 server using Docker

Problem: Connecting to a Partner AS2 server using a self signed certificate caused the issue described in OpenAS2Howto.pdf:

javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

Running the SSL cert checker within the docker container did not add the certificate to a keystore:

java -cp lib/openas2-server-3.9.0.jar CheckCertificate -s as2.example.net -c jssechaincerts
Adding KeyManager for possible HTTP AUTH...
Set SSLContext using protocol: TLSv1.3

                **** Starting SSL handshake...
javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
        at java.base/sun.security.ssl.Alert.createSSLException(Unknown Source)
...
Exception caught starting SSL handshake so trying to set up a local certificate store with trust chain....


Trying using Apache HTTP Client...
javax.net.ssl.SSLHandshakeException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
        at java.base/sun.security.ssl.Alert.createSSLException(Unknown Source)
        at java.base/sun.security.ssl.TransportContext.fatal(Unknown Source)
        at java.base/sun.security.ssl.TransportContext.fatal(Unknown Source)
        at java.base/sun.security.ssl.TransportContext.fatal(Unknown Source)
        at java.base/sun.security.ssl.CertificateMessage$T12CertificateConsumer.checkServerCerts(Unknown Source)
        at java.base/sun.security.ssl.CertificateMessage$T12CertificateConsumer.onCertificate(Unknown Source)
        at java.base/sun.security.ssl.CertificateMessage$T12CertificateConsumer.consume(Unknown Source)
        at java.base/sun.security.ssl.SSLHandshake.consume(Unknown Source)
        at java.base/sun.security.ssl.HandshakeContext.dispatch(Unknown Source)
        at java.base/sun.security.ssl.HandshakeContext.dispatch(Unknown Source)
        at java.base/sun.security.ssl.TransportContext.dispatch(Unknown Source)
        at java.base/sun.security.ssl.SSLTransport.decode(Unknown Source)
        at java.base/sun.security.ssl.SSLSocketImpl.decode(Unknown Source)
        at java.base/sun.security.ssl.SSLSocketImpl.readHandshakeRecord(Unknown Source)
        at java.base/sun.security.ssl.SSLSocketImpl.startHandshake(Unknown Source)
        at java.base/sun.security.ssl.SSLSocketImpl.startHandshake(Unknown Source)
        at org.apache.http.conn.ssl.SSLConnectionSocketFactory.createLayeredSocket(SSLConnectionSocketFactory.java:436)
        at org.apache.http.conn.ssl.SSLConnectionSocketFactory.connectSocket(SSLConnectionSocketFactory.java:384)

Importing the certificates with a GUI app to the .jks keystore defined in config.xml and rebuilding resulted in the same error.
Importing the certificates with a GUI app to cacerts in the root directory of the repo and rebuilding resulted in the same error.

I managed to get this working by Modifying the Dockerfile as so:

...

FROM openjdk:11-jre-slim 
ENV OPENAS2_BASE=/opt/openas2
ENV OPENAS2_HOME=/opt/openas2
ENV OPENAS2_TMPDIR=/opt/openas2/temp
COPY --from=builder /usr/src/openas2/Runtime/bin ${OPENAS2_BASE}/bin
COPY --from=builder /usr/src/openas2/Runtime/lib ${OPENAS2_BASE}/lib
COPY --from=builder /usr/src/openas2/Runtime/resources ${OPENAS2_BASE}/resources
COPY --from=builder /usr/src/openas2/Runtime/config_template ${OPENAS2_HOME}/config_template
RUN mkdir ${OPENAS2_BASE}/config
WORKDIR $OPENAS2_HOME
# Import self-signed certs
COPY ./self-signed-certs /opt/workdir/certs/
RUN mkdir -p /usr/share/man/man1 \
    && apt-get update \
    && apt-get install -y ca-certificates-java \
    && for CERT in $(ls /opt/workdir/certs/*.cer); do \
         keytool -importcert -file $CERT -alias $(basename $CERT) -cacerts -storepass changeit -noprompt; \
       done
ENTRYPOINT ${OPENAS2_BASE}/bin/start-container.sh

This now trusts the self signed certificate and I'm able to communicate with the Partner AS2 server.

Is this the correct way to import self signed certs using Docker, or is there a 'cleaner way'?

I'm happy to work on or open a PR should this be something useful for the repo.

commented