web-services - 无法从 https (tlsv1.2) wsdl uri 创建基于 wsdl 的代理

Question

我正在尝试从服务创建基于 WSDL 的代理。此服务在已配置为仅接受使用 TLSv1.2 的安全连接的 tomcat 服务器中运行。并且该服务位于运行 wso2server 的内部网之外。

当我在基于 WSDL 的代理模板中测试 wsdl uri 时出现问题，启动系统时出现以下警报:“无效的 WSDL URI(无法建立连接)”。我不得不说 wso2esb 与外部有连接，问题不在于访问这个 url，因为:

• 如果我在服务的服务器上不接受任何 SSL 连接，它运行良好。
• 我可以使用 wget 命令向 https wsdl url 请求 WSDL 信息
• 我可以使用安全连接创建其他代理，例如来自以下位置的代理服务器:https://webservices.amazon.com/AWSECommerceService/AWSECommerceService.wsdl

根据失败的安全 wsdl URL 的浏览器连接信息，我得到连接 TLS 协议(protocol)是 1.2，密码是:TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256

更多有用信息:

• wso2server 版本:4.8.1
• 测试的 java 版本(均失败):1.7.0_45 和 1.8.0_60
• 在 CARBON_HOME/bin/wso2server.sh 中添加参数:-Dhttps.protocols=TLSv1,TLSv1.1,TLSv1.2

• 来自 CARBON_HOME/repository/conf/tomcat /catalina-server.xml: 的 Tomcat 连接器配置

  <Connector  protocol="org.apache.coyote.http11.Http11NioProtocol"
  port="8888"
  bindOnInit="false"
  sslProtocol="TLS"
  sslEnabledProtocols="TLSv1,TLSv1.1,TLSv1.2"
  maxHttpHeaderSize="8192"
  acceptorThreadCount="2"
  maxThreads="250"
  minSpareThreads="50"
  disableUploadTimeout="false"
  enableLookups="false"
  connectionUploadTimeout="120000"
  maxKeepAliveRequests="200"
  acceptCount="200"
  server="WSO2 Carbon Server"
  clientAuth="false"
  compression="on"
  scheme="https"
  secure="true"
  SSLEnabled="true"
  compressionMinSize="2048"
  noCompressionUserAgents="gozilla, traviata"
  compressableMimeType="..."
  URIEncoding="UTF-8" />
  

• 在 axis2.xml 中添加传输发送方和接收方以下参数:TLSv1,TLSv1.1,TLSv1.2

也许我在 wso2server 配置中遗漏了什么？

---

更新问题:

将 SSL 证书的公共(public)部分安装到 ESB 信任库后，我可以毫无问题地基于已发布的 WSDL 创建代理服务，并且我可以通过 ESB 请求 WSDL 模板。但是我认为还没有完全解决的问题:

尝试使用 SoapUI 服务时，我在服务器中收到以下异常(在 wso2carbon.log 中读取):

TID: [0] [ESB] [2015-10-15 08:24:31,057] ERROR {org.apache.synapse.transport.passthru.TargetHandler} -  I/O error: Received fatal alert: protocol_version {org.apache.synapse.transport.passthru.TargetHandler}
javax.net.ssl.SSLException: Received fatal alert: protocol_version
at sun.security.ssl.Alerts.getSSLException(Alerts.java:208)
at sun.security.ssl.SSLEngineImpl.fatal(SSLEngineImpl.java:1619)
at sun.security.ssl.SSLEngineImpl.fatal(SSLEngineImpl.java:1587)
at sun.security.ssl.SSLEngineImpl.recvAlert(SSLEngineImpl.java:1756)
at sun.security.ssl.SSLEngineImpl.readRecord(SSLEngineImpl.java:1060)
at sun.security.ssl.SSLEngineImpl.readNetRecord(SSLEngineImpl.java:884)
at sun.security.ssl.SSLEngineImpl.unwrap(SSLEngineImpl.java:758)
at javax.net.ssl.SSLEngine.unwrap(SSLEngine.java:624)
at org.apache.http.nio.reactor.ssl.SSLIOSession.doUnwrap(SSLIOSession.java:228)
at org.apache.http.nio.reactor.ssl.SSLIOSession.doHandshake(SSLIOSession.java:263)
at org.apache.http.nio.reactor.ssl.SSLIOSession.isAppInputReady(SSLIOSession.java:380)
at org.apache.http.impl.nio.reactor.AbstractIODispatch.inputReady(AbstractIODispatch.java:118)
at org.apache.http.impl.nio.reactor.BaseIOReactor.readable(BaseIOReactor.java:160)
at org.apache.http.impl.nio.reactor.AbstractIOReactor.processEvent(AbstractIOReactor.java:342)
at org.apache.http.impl.nio.reactor.AbstractIOReactor.processEvents(AbstractIOReactor.java:320)
at org.apache.http.impl.nio.reactor.AbstractIOReactor.execute(AbstractIOReactor.java:280)
at org.apache.http.impl.nio.reactor.BaseIOReactor.execute(BaseIOReactor.java:106)
at org.apache.http.impl.nio.reactor.AbstractMultiworkerIOReactor$Worker.run(AbstractMultiworkerIOReactor.java:604)
at java.lang.Thread.run(Thread.java:744)
TID: [0] [ESB] [2015-10-15 08:25:04,600]  WARN {org.apache.synapse.transport.passthru.SourceHandler} -  Connection time out after request is read: http-incoming-11 {org.apache.synapse.transport.passthru.SourceHandler}

也许我在 axis2.xml 配置文件($CARBON_HOME/repository/conf/axis2/axis2.xml)中漏掉了什么？这是与以下内容相关的部分:

• TransportReceiver(https 部分):

 
    <transportReceiver name="https" class="org.apache.synapse.transport.passthru.PassThroughHttpSSLListener">
        <parameter name="port" locked="false">8443</parameter>
        <parameter name="non-blocking" locked="false">true</parameter>
        <parameter name="bind-address" locked="false">XXX.XXX.XXX.XXX</parameter>
        <parameter name="WSDLEPRPrefix" locked="false">https://XXX.XXX.XXX.XXX:8443</parameter>
        <parameter name="httpGetProcessor" locked="false">org.wso2.carbon.transport.nhttp.api.PassThroughNHttpGetProcessor
        <parameter name="HttpsProtocols">TLSv1,TLSv1.1,TLSv1.2</parameter>
        <parameter name="keystore" locked="false">
            <KeyStore>
                <Location>repository/resources/security/wso2carbon.jks</Location>
                <Type>JKS</Type>
                <Password>XXX</Password>
                <KeyPassword>XXX</KeyPassword>
            </KeyStore>
        </parameter>
        <parameter name="truststore" locked="false">
            <TrustStore>
                <Location>repository/resources/security/client-truststore.jks</Location>
                <Type>JKS</Type>
                <Password>XXX</Password>
            </TrustStore>
        </parameter>
   </transportReceiver>

 

• TransportSender(https 部分):

 
    <transportSender name="https" class="org.apache.synapse.transport.passthru.PassThroughHttpSSLSender">
        <parameter name="non-blocking" locked="false">true
        <parameter name="HttpsProtocols">TLSv1,TLSv1.1,TLSv1.2
        <parameter name="keystore" locked="false">
            <KeyStore>
                <Location>repository/resources/security/wso2carbon.jks</Location>
                <Type>JKS</Type>
                <Password>XXXX</Password>
                <KeyPassword>XXXX</KeyPassword>
            </KeyStore>
        </parameter>
        <parameter name="truststore" locked="false">
            <TrustStore>
                <Location>repository/resources/security/client-truststore.jks</Location>
                <Type>JKS</Type>
                <Password>XXXXX</Password>
            </TrustStore>
        </parameter>
        <parameter name="HostnameVerifier">AllowAll</parameter>        
    </transportSender>
 

谢谢!

Answer 1

您是否已将服务的公共(public)证书导入 ESB 的信任库？如果没有，This blog post可能会提供一些想法(虽然有点过时)。