访问部署在 WebSphere Liberty 集群上的应用程序时出现证书问题

Question

I have set up a Liberty cluster comprising of the following:
node 1 - 10.11.12.201 server1
node 2 - 10.11.12.202 - server2, controller server, IHS load balancer with HTTPS enabled.
Have enabled dynamic routing feature at the load balancer level following ibm docs. Deployed my app on the server and tried accessing it follows: https://10.11.12.202/app/console .

The Internal proxy request is failing with:

ERROR com.kony.mobilefabric.util.restclient.RestCallHelper - GET call to ' https://10.11.12.202:443/app/api/v1_0/accounts/config ' failed with error: Host name '10.11.12.202' does not match the certificate subject provided by the peer (DC=com.ibm.ws.dynamic.routing, OU=dynamicrouting, CN=WebServer) javax.net.ssl.SSLPeerUnverifiedException: Host name '10.11.12.202' does not match the certificate subject provided by the peer (DC=com.ibm.ws.dynamic.routing, OU=dynamicrouting, CN=WebServer)

I guess this issue will be solved by updating the CN from "WebServer" to 10.11.12.202? i checked all the possible options for the dynamicRouting command but havent been able to figure out how to do this. Note i do not have DNS hence using Ip addresses.

Any help greatly appreciated

Answer 1

You should not use the generated plugin-key.kdb as the key store supplied with the KeyFile directive. It is generated for outbound connectivity in the WAS plugin, not for incoming requests to IHS.

If you want a useable frontend certificate, create a new KDB file with $IHSROOT/bin/gskcapicmd, create a certifcate request in it with the correct subjectAltName extensions, and get it signed. Point to it with the KeyFile directive.