WSO2 API Manager与Micro Integrator v4.0.0连接SSL异常求助

本地使用WSO2 API Manager和Micro Integrator v4.0.0，尝试将API发布至API Manager时，启动两者后Micro Integrator控制台出现如下异常，导致无法连接API Manager。已尝试复制证书、生成自签名证书等方法，仍未解决问题，恳请协助。

ERROR {ServiceCatalogUtils} - 读取服务目录响应时出错 javax.net.ssl.SSLHandshakeException: PKIX路径验证失败: java.security.cert.CertPathValidatorException: 签名校验失败
    at sun.security.ssl.Alert.createSSLException(Alert.java:131)
    at sun.security.ssl.TransportContext.fatal(TransportContext.java:324)
    at sun.security.ssl.TransportContext.fatal(TransportContext.java:267)
    at sun.security.ssl.TransportContext.fatal(TransportContext.java:262)
    at sun.security.ssl.CertificateMessage$T12CertificateConsumer.checkServerCerts(CertificateMessage.java:654)
    at sun.security.ssl.CertificateMessage$T12CertificateConsumer.onCertificate(CertificateMessage.java:473)
    at sun.security.ssl.CertificateMessage$T12CertificateConsumer.consume(CertificateMessage.java:369)
    at sun.security.ssl.SSLHandshake.consume(SSLHandshake.java:377)
    at sun.security.ssl.HandshakeContext.dispatch(HandshakeContext.java:444)
    at sun.security.ssl.HandshakeContext.dispatch(HandshakeContext.java:422)
    at sun.security.ssl.TransportContext.dispatch(TransportContext.java:182)
    at sun.security.ssl.SSLTransport.decode(SSLTransport.java:152)
    at sun.security.ssl.SSLSocketImpl.decode(SSLSocketImpl.java:1397)
    at sun.security.ssl.SSLSocketImpl.readHandshakeRecord(SSLSocketImpl.java:1305)
    at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:440)
    at sun.net.www.protocol.https.HttpsClient.afterConnect(HttpsClient.java:559)
    at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(AbstractDelegateHttpsURLConnection.java:197)
    at sun.net.www.protocol.http.HttpURLConnection.getInputStream0(HttpURLConnection.java:1572)
    at sun.net.www.protocol.http.HttpURLConnection.getInputStream(HttpURLConnection.java:1500)
    at java.net.HttpURLConnection.getResponseCode(HttpURLConnection.java:480)
    at sun.net.www.protocol.https.HttpsURLConnectionImpl.getResponseCode(HttpsURLConnectionImpl.java:352)
    at org.wso2.micro.integrator.initializer.utils.ServiceCatalogUtils.getAllServices(ServiceCatalogUtils.java:209)
    at org.wso2.micro.integrator.initializer.serviceCatalog.ServiceCatalogExecutor.run(ServiceCatalogExecutor.java:59)
    at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:511)
    at java.util.concurrent.FutureTask.run(FutureTask.java:266)
    at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
    at java.lang.Thread.run(Thread.java:750)
Caused by: sun.security.validator.ValidatorException: PKIX路径验证失败: java.security.cert.CertPathValidatorException: 签名校验失败
    at sun.security.validator.PKIXValidator.doValidate(PKIXValidator.java:386)
    at sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:291)
    at sun.security.validator.Validator.validate(Validator.java:271)
    at sun.security.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:315)
    at sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:223)
    at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:129)
    at sun.security.ssl.CertificateMessage$T12CertificateConsumer.checkServerCerts(CertificateMessage.java:638)
    ... 23 more
Caused by: java.security.cert.CertPathValidatorException: 签名校验失败
    at sun.security.provider.certpath.PKIXMasterCertPathValidator.validate(PKIXMasterCertPathValidator.java:135)
    at sun.security.provider.certpath.PKIXCertPathValidator.validate(PKIXCertPathValidator.java:220)
    at sun.security.provider.certpath.PKIXCertPathValidator.validate(PKIXCertPathValidator.java:140)
    at sun.security.provider.certpath.PKIXCertPathValidator.engineValidate(PKIXCertPathValidator.java:79)
    at java.security.cert.CertPathValidator.validate(CertPathValidator.java:292)
    at sun.security.validator.PKIXValidator.doValidate(PKIXValidator.java:381)
    ... 29 more
Caused by: java.security.SignatureException: 签名不匹配。
    at sun.security.x509.X509CertImpl.verify(X509CertImpl.java:457)
    at sun.security.provider.certpath.BasicChecker.verifySignature(BasicChecker.java:166)
    at sun.security.provider.certpath.BasicChecker.check(BasicChecker.java:147)
    at sun.security.provider.certpath.PKIXMasterCertPathValidator.validate(PKIXMasterCertPathValidator.java:125)

解决建议 #

• 确认API Manager证书完整导入Micro Integrator信任库：
  1. 从API Manager的<APIM_HOME>/repository/resources/security目录导出公钥证书：

     keytool -export -alias wso2carbon -file apim-cert.cer -keystore wso2carbon.jks -storepass wso2carbon
     

  2. 将证书导入Micro Integrator的<MI_HOME>/repository/resources/security/client-truststore.jks：

     keytool -import -alias apim-cert -file apim-cert.cer -keystore client-truststore.jks -storepass wso2carbon
     

• 检查证书有效性：确认API Manager使用的证书未过期，自签名证书需确保根证书已被Micro Integrator信任。
• 验证端点配置：确认Micro Integrator配置文件中API Manager的SSL端点地址（默认9443端口）正确无误。
• 清理缓存重启：删除<MI_HOME>/tmp和<APIM_HOME>/tmp目录内容，再重新启动两个服务。

内容的提问来源于stack exchange，提问作者Some Guy