Topic
IC4NOTICE: developerWorks Community will be offline May 29-30, 2015 while we upgrade to the latest version of IBM Connections. For more information, read our upgrade FAQ.
9 replies Latest Post - ‏2011-05-23T06:42:57Z by MaheshKharvi
MaheshKharvi
MaheshKharvi
43 Posts
ACCEPTED ANSWER

Pinned topic IHS tries to load GSK even when ssl in not enabled.

‏2011-05-13T13:21:24Z |
I am using March beta refresh on AIX 6.1
Below error is seen while starting IHS.

Fri May 13 09:10:59 2011 error lib_security: logSSLError: str_security (gsk error 408): GSK_ERROR_BAD_KEYFILE_PASSWORD
Fri May 13 09:10:59 2011 error lib_security: initializeSecurity: Failed to initialize GSK environment
Fri May 13 09:10:59 2011 error ws_transport: transportInitializeSecurity: Failed to initialize security
Fri May 13 09:10:59 2011 error ws_server: serverAddTransport: Failed to initialize security
Fri May 13 09:10:59 2011 error ws_server: serverAddTransport: HTTPS Transport is skipped
Fri May 13 09:10:59 2011 error lib_security: logSSLError: str_security (gsk error 408): GSK_ERROR_BAD_KEYFILE_PASSWORD
Fri May 13 09:10:59 2011 error lib_security: initializeSecurity: Failed to initialize GSK environment
Fri May 13 09:10:59 2011 error ws_transport: transportInitializeSecurity: Failed to initialize security
Fri May 13 09:10:59 2011 error ws_server: serverAddTransport: Failed to initialize security
Fri May 13 09:10:59 2011 error ws_server: serverAddTransport: HTTPS Transport is skipped

Thanks,
Mahesh
Updated on 2011-05-23T06:42:57Z at 2011-05-23T06:42:57Z by MaheshKharvi
  • MaheshKharvi
    MaheshKharvi
    43 Posts
    ACCEPTED ANSWER

    Re: IHS tries to load GSK even when ssl in not enabled.

    ‏2011-05-13T13:56:52Z  in response to MaheshKharvi
    Made some observations.
    We have installed plugin at non-default location.

    1. This behavior is seen when
    ${DMGR_HOME}/bin/GenPluginCfg.sh is run without any passing destination.root

    2. No errors seen regarding gsk when
    ${DMGR_HOME}/bin/GenPluginCfg.sh -destination.root ${PLUGIN_HOME}
  • SystemAdmin
    SystemAdmin
    462 Posts
    ACCEPTED ANSWER

    Re: IHS tries to load GSK even when ssl in not enabled.

    ‏2011-05-19T18:56:16Z  in response to MaheshKharvi
    This is working as designed. If you don't supply the destination root, the plugin configuration generator will have to apply a default value.
    • MaheshKharvi
      MaheshKharvi
      43 Posts
      ACCEPTED ANSWER

      Re: IHS tries to load GSK even when ssl in not enabled.

      ‏2011-05-20T05:50:17Z  in response to SystemAdmin
      I agree. But what makes IHS looks for GSK libraries when ssl is not enabled.
      I haven't seen same behaviour on WAS v7
  • SystemAdmin
    SystemAdmin
    462 Posts
    ACCEPTED ANSWER

    Re: IHS tries to load GSK even when ssl in not enabled.

    ‏2011-05-20T13:01:31Z  in response to MaheshKharvi
    What you are seeing is the plugin writing messages to the IHS error log. In your tests, where you didn't supply the destination root, the plugin-cfg.xml defaulted to the '/usr/IBM/WebSphere/Plugins' path. This was also set for the plugin log. When IHS/Plugin attempts to start it tried to initialize the log for this location, but couldn't. This is indicated by the error message in the IHS log.

    Thu May 19 08:04:51 2011 error ws_config_parser: handleLogEnd: Failed to open log file: '/usr/IBM/WebSphere/Plugins/logs/http_plugin.log', OS Err: 2

    Thereafter, plugin logging was being passed back to the IHS Error log which also logged the gskit error messages you saw.

    I hope this clears up the issue for you.
    • MaheshKharvi
      MaheshKharvi
      43 Posts
      ACCEPTED ANSWER

      Re: IHS tries to load GSK even when ssl in not enabled.

      ‏2011-05-20T13:10:12Z  in response to SystemAdmin
      But why gsk error when ssl is not configured. Morever I don't get ssl error if plugin is generated with destination.root
      • SystemAdmin
        SystemAdmin
        462 Posts
        ACCEPTED ANSWER

        Re: IHS tries to load GSK even when ssl in not enabled.

        ‏2011-05-20T14:32:06Z  in response to MaheshKharvi
        SSL for the connection to the AppServer is configured in the Webserver Plugin, with paths to key stores that don't exist. This is what's failing, and it should be clear from the relatively short plugin-cfg.xml.

        This is unrelated to whether you happen to have SSL configured on the frontend.

        When you tell it the proper root directory, the paths to the keystores are correct.
        • MaheshKharvi
          MaheshKharvi
          43 Posts
          ACCEPTED ANSWER

          Re: IHS tries to load GSK even when ssl in not enabled.

          ‏2011-05-23T06:42:57Z  in response to SystemAdmin
          Eric,
          Thank you for the updates.

          When I generate the plugin with proper destination.root, it updates all values like keystores, log paths etc, but not the PluginInstallRoot. It will be same as before i.e /usr/IBM/WebSphere/Plugins/.

          If I remove the DMGR_HOME/config/cells/plugin-cfg.xml before generating, I could see correct plugin root in new cfg.

          Let me know if this can be ignored.

          Thanks,
          Mahesh