IBM Support

How do I fix the SSL exception SSLC0008E CWPKI0022E "Extended key usage does not permit use for TLS client authentication" in WebSphere Application Server?

How To


Summary

In my SystemOut.log I can see the following SSL exception: CWPKI0022E: SSL HANDSHAKE FAILURE: A signer with SubjectDN "CN=abc, OU=IT, O=ibm , C=US" was sent from target host:port "unknown:0". The signer may need to be added to local trust store "/opt/IBM/WebSphere/AppServer/profiles/Dmgr/config/cells/DmgrCell/trust.p12" located in SSL configuration alias "XDADefaultSSLSettings" loaded from SSL configuration file "security.xml". The extended error message from the SSL handshake exception is: "Extended key usage does not permit use for TLS client authentication".

Similar error in the Systemout.log

SSLHandshakeE E SSLC0008E: Unable to initialize SSL connection. Unauthorized access was denied or security settings have expired. Exception is javax.net.ssl.SSLHandshakeException: com.ibm.jsse2.util.j: Extended key usage does not permit use for TLS client authentication
at com.ibm.jsse2.g.a(g.java:22)
at com.ibm.jsse2.bb.a(bb.java:69)
at com.ibm.jsse2.bb.a(bb.java:37)
at com.ibm.jsse2.bb.a(bb.java:73)
at com.ibm.jsse2.z$c.a(z$c.java:163)

Caused by: com.ibm.jsse2.util.j: Extended key usage does not permit use for TLS client authentication
at com.ibm.jsse2.util.b.a(b.java:36)
at com.ibm.jsse2.util.b.a(b.java:32)
at com.ibm.jsse2.util.g.a(g.java:13)
at com.ibm.jsse2.br.a(br.java:47)
at com.ibm.jsse2.br.a(br.java:67)
at com.ibm.jsse2.br.checkClientTrusted(br.java:166)
at com.ibm.ws.ssl.core.WSX509TrustManager.checkClientTrusted(WSX509TrustManager.java:288)
at com.ibm.ws.ssl.core.WSX509TrustManager.checkClientTrusted(WSX509TrustManager.java:217)
at com.ibm.jsse2.bp.checkClientTrusted(bp.java:42)
at com.ibm.jsse2.z$c.a(z$c.java:74)

Document Location

Worldwide

[{"Type":"MASTER","Line of Business":{"code":"LOB77","label":"Automation Platform"},"Business Unit":{"code":"BU048","label":"IBM Software"},"Product":{"code":"SSEQTP","label":"WebSphere Application Server"},"ARM Category":[{"code":"a8m50000000CdL1AAK","label":"WebSphere Application Server traditional-All Platforms-\u003ESecurity-\u003ESSL-\u003ESSL - Certificates"}],"ARM Case Number":"","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"All Versions"}]

Log InLog in to view more of this document

This document has the abstract of a technical article that is available to authorized users once you have logged on. Please use Log in button above to access the full document. After log in, if you do not have the right authorization for this document, there will be instructions on what to do next.

Document Information

Modified date:
03 March 2025

UID

ibm16594815

Page Feedback