ibm mobilefirst - Making web service calls to a HTTPS server from Worklight Adapter - javax.net.ssl.SSLPeerUnverifiedException: peer not authenticated

Question

I am trying to hit a REST based HTTPS service from my adapter and my .xml file looks like this,

<connectionPolicy xsi:type="http:HTTPConnectionPolicyType">
            <protocol>https</protocol>
            <domain>myco.company.com</domain>
            <port>443</port>    
            <!-- Following properties used by adapter's key manager for choosing specific certificate from key store  
            <sslCertificateAlias></sslCertificateAlias> 
            <sslCertificatePassword></sslCertificatePassword>
            -->     
        </connectionPolicy>
        <loadConstraints maxConcurrentConnectionsPerNode="2"/>
    </connectivity>

and I am getting this exception

Http request failed: javax.net.ssl.SSLPeerUnverifiedException: peer not authenticated

but everything was working fine when I was using HTTP protocol and a different server ip address. The server code deployed is the same and the services seems to work fine on a browser. I saw http://pic.dhe.ibm.com/infocenter/wrklight/v5r0m5/index.jsp?topic=%2Fcom.ibm.worklight.help.doc%2Fadmin%2Ft_ibm_worklight_server_and_self-signed_certificates.html but did not get any idea. Any help is appreciated.

Answer 1

The SSLPeerUnverifiedException happens when you either provide a certificate that is wrong, or you do not provide the right certificate. The reason it worked with HTTP was because the certificate was not required for it; it is only required for HTTPS.

In this case, it seems that you are not specifying a certificate that the server will use to be able to create the HTTPS connection. For this you have to do a couple of things:

1. Either create a certificate to use for testing purposes, or use the certificate that you are required to use, depending on your case. The link you provided explains how to create your own custom certificate for testing purposes. (Please be aware that you should only use custom certificates for testing purposes only, as they are not secure and thus should not be used in a production environment).

2. Put the certificate you have inside a Java keystore, and configure Worklight to use said keystore. For more details, see http://pic.dhe.ibm.com/infocenter/wrklight/v6r1m0/topic/com.ibm.worklight.deploy.doc/admin/r_ssl_certificate_keystore_setup.html.

3. After finishing the two previous steps, in the connectionPolicy that you have there, you have to specify the SSLCertificateAlias and SSLCertificatePassword. The alias is the name under which it was saved in the keystore, and the password is the password use to encrypt the keystore. For more details, look here: http://pic.dhe.ibm.com/infocenter/wrklight/v6r1m0/topic/com.ibm.worklight.dev.doc/devref/r_the__connectionpolicy__element.html

With that it should work.