Peer not authenticated 在保护 API 时观察到，在本地主机中使用 WSO2 EI Oauth 2.0

Question

我尝试在 wso2 EI 自定义 SimpleOauthhandler 中使用 Oauth 2.0 http://abeykoon.blogspot.com/2015/04/wso2-esb-securing-rest-end-point-using.html 来保护我的 API，但我观察到了这个异常原因：javax.net.ssl.SSLPeerUnverifiedException：对等端未通过身份验证。我尝试使用 keytool 导入证书，但我不确定哪些证书已过期，如果证书过期是导致此异常的原因。

SimpleOAuthHandler 中的第 63 行（return stub.validate(dto).getValid();) class http://abeykoon.blogspot.com/2015/04/wso2-esb-securing-rest-end-point-using.html 导致此异常

异常：

[2020-01-10 13:10:54,931] [EI-Core]  INFO - HTTPSender Unable to sendViaPost to url[https://localhost:9445/services/OAuth2TokenValidationService]
javax.net.ssl.SSLPeerUnverifiedException: peer not authenticated
    at sun.security.ssl.SSLSessionImpl.getPeerCertificates(SSLSessionImpl.java:450)
    at org.apache.commons.httpclient.protocol.SSLProtocolSocketFactory.verifyHostName(SSLProtocolSocketFactory.java:276)
    at org.apache.commons.httpclient.protocol.SSLProtocolSocketFactory.createSocket(SSLProtocolSocketFactory.java:186)
    at org.apache.commons.httpclient.HttpConnection.open(HttpConnection.java:707)
    at org.apache.commons.httpclient.MultiThreadedHttpConnectionManager$HttpConnectionAdapter.open(MultiThreadedHttpConnectionManager.java:1361)
    at org.apache.commons.httpclient.HttpMethodDirector.executeWithRetry(HttpMethodDirector.java:387)
    at org.apache.commons.httpclient.HttpMethodDirector.executeMethod(HttpMethodDirector.java:171)
    at org.apache.commons.httpclient.HttpClient.executeMethod(HttpClient.java:397)
    at org.apache.axis2.transport.http.AbstractHTTPSender.executeMethod(AbstractHTTPSender.java:704)
    at org.apache.axis2.transport.http.HTTPSender.sendViaPost(HTTPSender.java:199)
    at org.apache.axis2.transport.http.HTTPSender.send(HTTPSender.java:81)
    at org.apache.axis2.transport.http.CommonsHTTPTransportSender.writeMessageWithCommons(CommonsHTTPTransportSender.java:459)
    at org.apache.axis2.transport.http.CommonsHTTPTransportSender.invoke(CommonsHTTPTransportSender.java:286)
    at org.apache.axis2.engine.AxisEngine.send(AxisEngine.java:442)
    at org.apache.axis2.description.OutInAxisOperationClient.send(OutInAxisOperation.java:441)
    at org.apache.axis2.description.OutInAxisOperationClient.executeImpl(OutInAxisOperation.java:227)
    at org.apache.axis2.client.OperationClient.execute(OperationClient.java:149)
    at org.wso2.carbon.identity.oauth2.stub.OAuth2TokenValidationServiceStub.validate(OAuth2TokenValidationServiceStub.java:738)
    at org.wso2.handler.SimpleOauthHandler.handleRequest(SimpleOauthHandler.java:93)
    at org.apache.synapse.rest.API.process(API.java:325)
    at org.apache.synapse.rest.RESTRequestHandler.apiProcess(RESTRequestHandler.java:135)
    at org.apache.synapse.rest.RESTRequestHandler.dispatchToAPI(RESTRequestHandler.java:113)
    at org.apache.synapse.rest.RESTRequestHandler.process(RESTRequestHandler.java:71)
    at org.apache.synapse.core.axis2.Axis2SynapseEnvironment.injectMessage(Axis2SynapseEnvironment.java:303)
    at org.apache.synapse.core.axis2.SynapseMessageReceiver.receive(SynapseMessageReceiver.java:92)
    at org.apache.axis2.engine.AxisEngine.receive(AxisEngine.java:180)
    at org.apache.synapse.transport.passthru.ServerWorker.processNonEntityEnclosingRESTHandler(ServerWorker.java:337)
    at org.apache.synapse.transport.passthru.ServerWorker.run(ServerWorker.java:158)
    at org.apache.axis2.transport.base.threads.NativeWorkerPool.run(NativeWorkerPool.java:172)
    at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
    at java.lang.Thread.run(Thread.java:748)
[2020-01-10 13:10:54,933] [EI-Core] ERROR - SimpleOauthHandler Error occurred while processing the message
org.apache.axis2.AxisFault: peer not authenticated
    at org.apache.axis2.AxisFault.makeFault(AxisFault.java:430)

Answer 1

下载服务器证书（这里描述了如何： https://superuser.com/questions/97201/how-to-save-a-remote-server-ssl-certificate-locally-as-a-file) 你的情况来自 localhost:9445
在 WSO2 中将下载的服务器 SSL 证书添加到客户端-truststore.jks。

keytool -import -alias localhost -file {PathToDownloadedCertFile} -keystore {WSO2HomeDir}\repository\resources\security\client-truststore.jks

重新启动 WSO2

Peer not authenticated 在保护 API 时观察到，在本地主机中使用 WSO2 EI Oauth 2.0

Peer not authenticated Observed while securing API , using WSO2 EI Oauth 2.0 in localhost

oauth-2.0

wso2

certificate

wso2esb

wso2ei