users@glassfish.java.net

Re: Certificate Revocation List (CRL) use in GlassFish v3

From: <glassfish_at_javadesktop.org>
Date: Thu, 07 Oct 2010 06:50:56 PDT

I'm using the following in my domain.xml

<ssl key-store="${com.sun.aas.instanceRoot}/config/keystore.jks" trust-store="${com.sun.aas.instanceRoot}/config/cacerts.jks" cert-nickname="alias" trust-algorithm="PKIX" client-auth-enabled="false" crl-file="${com.sun.aas.instanceRoot}/config/crl.pem" />

and when I run & browse to the page I get the following in the server.log

[#|2010-10-07T13:23:01.441+0000|WARNING|glassfish3.0.1|com.sun.grizzly.config.GrizzlyServiceListener|_ThreadID=18;_ThreadName=Thread-1;|SSL support could not be configured!
java.io.IOException: Sequence tag error
        at com.sun.grizzly.util.net.jsse.JSSE14SocketFactory.init(JSSE14SocketFactory.java:183)
        at com.sun.grizzly.config.SSLConfigHolder.initializeSSL(SSLConfigHolder.java:359)
        at com.sun.grizzly.config.SSLConfigHolder.configureSSL(SSLConfigHolder.java:308)
        at com.sun.grizzly.config.GrizzlyEmbeddedHttps$LazySSLInitializationFilter.execute(GrizzlyEmbeddedHttps.java:171)
        at com.sun.grizzly.DefaultProtocolChain.executeProtocolFilter(DefaultProtocolChain.java:135)
        at com.sun.grizzly.DefaultProtocolChain.execute(DefaultProtocolChain.java:102)
        at com.sun.grizzly.DefaultProtocolChain.execute(DefaultProtocolChain.java:88)
        at com.sun.grizzly.http.HttpProtocolChain.execute(HttpProtocolChain.java:76)
        at com.sun.grizzly.ProtocolChainContextTask.doCall(ProtocolChainContextTask.java:53)
        at com.sun.grizzly.SelectionKeyContextTask.call(SelectionKeyContextTask.java:57)
        at com.sun.grizzly.NIOContext.execute(NIOContext.java:510)
        at com.sun.grizzly.SelectorHandlerRunner.handleSelectedKey(SelectorHandlerRunner.java:358)
        at com.sun.grizzly.SelectorHandlerRunner.handleSelectedKeys(SelectorHandlerRunner.java:258)
        at com.sun.grizzly.SelectorHandlerRunner.doSelect(SelectorHandlerRunner.java:195)
        at com.sun.grizzly.SelectorHandlerRunner.run(SelectorHandlerRunner.java:130)
        at com.sun.grizzly.util.AbstractThreadPool$Worker.doWork(AbstractThreadPool.java:330)
        at com.sun.grizzly.util.AbstractThreadPool$Worker.run(AbstractThreadPool.java:309)
        at java.lang.Thread.run(Thread.java:619)
|#]

[#|2010-10-07T13:23:01.446+0000|SEVERE|glassfish3.0.1|com.sun.grizzly.config.GrizzlyServiceListener|_ThreadID=18;_ThreadName=Thread-1;|ProtocolChain exception
java.lang.NullPointerException
        at com.sun.grizzly.filter.SSLReadFilter.newSSLEngine(SSLReadFilter.java:347)
        at com.sun.grizzly.filter.SSLReadFilter.obtainSSLEngine(SSLReadFilter.java:394)
        at com.sun.grizzly.filter.SSLReadFilter.execute(SSLReadFilter.java:154)
        at com.sun.grizzly.DefaultProtocolChain.executeProtocolFilter(DefaultProtocolChain.java:135)
        at com.sun.grizzly.DefaultProtocolChain.execute(DefaultProtocolChain.java:102)
        at com.sun.grizzly.DefaultProtocolChain.execute(DefaultProtocolChain.java:88)
        at com.sun.grizzly.http.HttpProtocolChain.execute(HttpProtocolChain.java:76)
        at com.sun.grizzly.ProtocolChainContextTask.doCall(ProtocolChainContextTask.java:53)
        at com.sun.grizzly.SelectionKeyContextTask.call(SelectionKeyContextTask.java:57)
        at com.sun.grizzly.NIOContext.execute(NIOContext.java:510)
        at com.sun.grizzly.SelectorHandlerRunner.handleSelectedKey(SelectorHandlerRunner.java:358)
        at com.sun.grizzly.SelectorHandlerRunner.handleSelectedKeys(SelectorHandlerRunner.java:258)
        at com.sun.grizzly.SelectorHandlerRunner.doSelect(SelectorHandlerRunner.java:195)
        at com.sun.grizzly.SelectorHandlerRunner.run(SelectorHandlerRunner.java:130)
        at com.sun.grizzly.util.AbstractThreadPool$Worker.doWork(AbstractThreadPool.java:330)
        at com.sun.grizzly.util.AbstractThreadPool$Worker.run(AbstractThreadPool.java:309)
        at java.lang.Thread.run(Thread.java:619)

If I remove the crl-file attribute everything works fine. The browser ask me for a cert, and when presented it is verified and I get my page. Only problem is I can present a revoked cert and I still get my page.

Can someone help me, please.

Thanks, Eric.
[Message sent by forum member 'eliscinsky']

http://forums.java.net/jive/thread.jspa?messageID=484541