SSL errors for security

• Refer to the documentation for your HTTP server for instructions on correctly enabling SSL. If you are using the IBM® HTTP Server or Apache, go to: http://www.ibm.com/software/webservers/httpservers/library.html. Click Frequently Asked Questions> SSL.
• If you use the IBM Key Management (IKeyman) tool to create certificates and keys, remember to stash the password to a file when creating the Key Database (KDB) file with the IBM Key Management Tool.
  1. Go to the directory where the KDB file is created, and see if an .sth file exists.
  2. If not, open the KDB file with the IBM Key Management Tool, and click Key Database File > Stash Password. The following message is displayed: The password has been encrypted and saved in the file.

• javax.net.ssl.SSLHandshakeException - The client and server could not negotiate the desired level of security. Reason: handshake failure
• javax.net.ssl.SSLHandshakeException - The client and server could not negotiate the desired level of security. Reason: unknown certificate
• javax.net.ssl.SSLHandshakeException - The client and server could not negotiate the desired level of security. Reason: bad certificate

[Root exception is org.omg.CORBA.TRANSIENT:  CAUGHT_EXCEPTION_WHILE_CONFIGURING_
SSL_CLIENT_SOCKET: CWWJE0080E:   javax.net.ssl.SSLHandshakeException - The client
and server could not negotiate the desired level of   security. Reason: handshake 
failure:host=MYSERVER,port=1079 minor code: 4942F303 completed: No]   at 
com.ibm.CORBA.transport.TransportConnectionBase.connect 
(TransportConnectionBase.java:NNN)

• Not having common ciphers between the client and server.
• Not specifying the correct protocol.

1. Review the SSL settings. In the administrative console, click Security > SSL certificate and key management. Under Configuration settings, click Manage endpoint security configurations > endpoint_configuration_name. Under Related items, click SSL configurations > SSL_configuration_name. You can also browse the file manually by viewing the install_root/properties/sas.client.props file.
2. Review the SSL settings. In the administrative console, click Security > SSL certificate and key management. Under Configuration settings, click Manage endpoint security configurations > endpoint_configuration_name. Under Related items, click SSL configurations > SSL_configuration_name. You can also browse the file manually by viewing the app_server_root/properties/sas.client.props file.
3. Check the property that is specified by the com.ibm.ssl.protocol file to determine which protocol is specified.
4. Check the cipher types that are specified by the com.ibm.ssl.enabledCipherSuites interface. You might want to add more cipher types to the list. To see which cipher suites are currently enabled, click Quality of protection settings (QoP), and look for the Cipher Suites property.
5. Correct the protocol or cipher problem by using a different client or server protocol and cipher selection. Typical protocols are SSL or SSLv3.
6. Make the cipher selection 40-bit instead of 128-bit. For Common Secure Interoperability Version 2 (CSIv2), set both of the following properties to false in the sas.client.props file, or set security level=medium in the administrative console settings:
   • com.ibm.CSI.performMessageConfidentialityRequired=false
   • com.ibm.CSI.performMessageConfidentialitySupported=false

ERROR: Could not get the initial context or unable to look up the starting context. 
Exiting.  Exception received: javax.naming.ServiceUnavailableException: A 
communication failure occurred while attempting to obtain an initial context using 
the provider url: "corbaloc:iiop:localhost:2809". Make sure that the host and port 
information is correct and that the server identified by the provider url is a 
running name server. If no port number is specified, the default port number 2809 
is used. Other possible causes include the network environment or workstation 
network configuration. [Root exception is org.omg.CORBA.TRANSIENT: 
CAUGHT_EXCEPTION_WHILE_CONFIGURING_SSL_CLIENT_SOCKET: CWWJE0080E: 
javax.net.ssl.SSLHandshakeException - The client and server could not 
negotiate the desired level of security. Reason: unknown 
certificate:host=MYSERVER,port=1940 minor code: 4942F303 completed: No]

1. Check the client truststore file to determine if the signer certificate from the server personal certificate is there. For a self-signed server personal certificate, the signer certificate is the public key of the personal certificate. For a certificate authority (CA)-signed server personal certificate, the signer certificate is the root CA certificate of the CA that signed the personal certificate.
2. Add the server signer certificate to the client truststore file.

• A personal certificate exists in the client keystore that is used for SSL mutual authentication.
• The signer certificate is not extracted into the server truststore file, and thus the server cannot trust the certificate whenever the SSL handshake is made.

ERROR: Could not get the initial context or unable to look 
up the starting context. Exiting.  
Exception received: javax.naming.ServiceUnavailableException: 
A communication failure occurred while attempting to obtain an 
initial context using the provider url: "corbaloc:iiop:localhost:2809". 
Make sure that the host and port information is correct and that the
server identified by the provider url is a running name 
server. If no port number is specified, the default port number 2809 
is used. Other possible causes include the network environment or 
workstation network configuration. 
[Root exception is org.omg.CORBA.TRANSIENT: CAUGHT_EXCEPTION_WHILE_CONFIGURING_SSL_
CLIENT_SOCKET: CWWJE0080E: javax.net.ssl.SSLHandshakeException - The client and 
server could not negotiate the desired level of security. Reason: 
bad certificate: host=MYSERVER,port=1940 minor code: 4942F303 completed: No]

ERROR: Could not get the initial context or unable to look up the starting context. 
Exiting. Exception received: org.omg.CORBA.INTERNAL: Trace from server: 1198777258 
at host MYHOST on port 0 >>org.omg.CORBA.INTERNAL: EntryNotFoundException minor 
code: 494210B0 completed: 
No at com.ibm.ISecurityLocalObjectBaseL13Impl.PrincipalAuthFailReason.
map_auth_fail_to_minor_code(PrincipalAuthFailReason.java:99)

[7/31/02 15:38:48:452 CDT] 27318f5 NTRegistryImp E CWSCJ0070E: No privilege id 
configured for: testuser