Home/ Questions/Q 6578149
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-25T15:44:02+00:00

I am attempting to create a keystore and truststore file from a self-signed certificate,

  • 0

I am attempting to create a keystore and truststore file from a self-signed certificate, for use in a HTTPRouter action, deployed within a JBoss ESB. I used openssl to retrieve the certificate of interest and generated a keystore file and a truststore file with the following commands:

keytool -import -alias ejb-ssl -file cert.der -keystore cert.truststore
keytool -import -alias ejb-ssl -file cert.der -keystore cert.keystore -trustcacerts

Before generating the keystore and truststore files, I am converting the certificate to X509 format, otherwise the keytool utility does not work, returning an exception with the message ‘input not an x.509 certificate’ exception. To convert the certificate of interest, I am using the following command:

openssl x509 -in cert.cer -outform DER -out cert.der

I then copied these files into the my ESB’s ‘esbcontent/META-INF’ folder. Below are the properties I am setting for the HTTPRouter action

#Configurators
configurators=HttpProtocol

#HttpProtocol Config...
protocol-socket-factory=org.jboss.soa.esb.http.protocol.SelfSignedSSLProtocolSocketFactoryBuilder

keystore=/META-INF/keystore/cert.keystore
keystore-passw=password
truststore=/META-INF/truststore/cert.truststore
truststore-passw=password

When I deploy the ESB I am getting the following error:

Caused by: org.jboss.soa.esb.ConfigurationException: Invalid 'keystore' config.  Must be valid URL.

Looking at the certificate retrieved from the third party webservice, all URL’s look OK. Does anyone have any idea why JBoss would not accept the URL in the generated keystore? I’m starting to tear my hair out on this one!

Also, I have been trying to use the org.apache.commons.httpclient.contrib.ssl.EasySSLProtocolSocketFactory for the protocol-socket-factory. When using this, the ESB deploys OK. However, the HTTPRouter does not seem to send the request to the third party web service. I’ve used SoapUI to establish the web service is ok, so I think it’s a problem with my configuration of the HTTPRouter action.

Any help offered is greatly appreaciated!

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    This took me an awful long time to figure out, but the solution turned out to be very simple. The path to the keystore file must be absolute. It CANNOT BE RELATIVE! Therefore, replacing

    '/META-INF/keystore/cert.keystore' path

    with 

    'C:/dev/server/jboss/jboss-as/server/default/deploy/MyEsb.esb/META-INF/keystore/cert.keystore

    Solved the problem!

    Leaving the properties file with this absolute path isn’t always suitable when wanting to deploy the ESB within various different environments (Windows and Ubuntu). I’m using gradle as my build tool, so I used the ReplaceTokens feature to replace the keystore token with the absolute path required. I suppose you could also copy the keystore file into the deploy directory so it’s available for all ESB’s who require it.

    Hope this helps someone else who comes across this problem. Was a simple solution in the end, but there is no mention anywhere in the docs for the keystore file to be referenced with an absolute path. But, doing that fixed the issue for me.

    Thanks

    • 0