如何解决WSO2 Integration Studio调用HTTPS端点的General SSLEngine问题？

我在WSO2 Integration Studio中创建了一个API，用于调用WSO2 API端点，配置代码如下：

<?xml version="1.0" encoding="UTF-8"?>
<api context="/backend" name="Backend" xmlns="http://ws.apache.org/ns/synapse">
    <resource methods="GET">
        <inSequence>
            <call>
                <endpoint>
                    <http method="get" uri-template="https://localhost:9443/api/am/publisher/v3/apis">
                        <suspendOnFailure>
                            <initialDuration>-1</initialDuration>
                            <progressionFactor>-1</progressionFactor>
                            <maximumDuration>0</maximumDuration>
                        </suspendOnFailure>
                        <markForSuspension>
                            <retriesBeforeSuspension>0</retriesBeforeSuspension>
                        </markForSuspension>
                    </http>
                </endpoint>
            </call>
            <respond/>
        </inSequence>
        <outSequence/>
        <faultSequence/>
    </resource>
</api>

调用时控制台出现如下错误：

[2023-04-05 09:55:18,582]  WARN {TargetHandler} - ERROR_CODE = 101500, STATE_DESCRIPTION = Exception occurred when Server establishing a connection to the backend, INTERNAL_STATE = REQUEST_READY, DIRECTION = REQUEST, CAUSE_OF_ERROR = I/O exception : General SSLEngine problem, TARGET_HOST = 127.0.0.1, TARGET_PORT = 9443, TARGET_CONTEXT = https://localhost:9443/api/am/publisher/v3/apis, HTTP_METHOD = GET, TRIGGER_TYPE = api, TRIGGER_NAME = Backend, REMOTE_ADDRESS = localhost/127.0.0.1:9443, CONNECTION = http-outgoing-2
[2023-04-05 09:55:18,582] ERROR {TargetHandler} - I/O error: General SSLEngine problem javax.net.ssl.SSLHandshakeException: General SSLEngine problem
    at sun.security.ssl.Handshaker.checkThrown(Handshaker.java:1566)
    at sun.security.ssl.SSLEngineImpl.checkTaskThrown(SSLEngineImpl.java:545)
    at sun.security.ssl.SSLEngineImpl.writeAppRecord(SSLEngineImpl.java:1217)
    at sun.security.ssl.SSLEngineImpl.wrap(SSLEngineImpl.java:1185)
    at javax.net.ssl.SSLEngine.wrap(SSLEngine.java:471)
    at org.apache.http.nio.reactor.ssl.SSLIOSession.doWrap(SSLIOSession.java:237)
    at org.apache.http.nio.reactor.ssl.SSLIOSession.doHandshake(SSLIOSession.java:271)
    at org.apache.http.nio.reactor.ssl.SSLIOSession.isAppInputReady(SSLIOSession.java:410)
    at org.apache.http.impl.nio.reactor.AbstractIODispatch.inputReady(AbstractIODispatch.java:119)
    at org.apache.http.impl.nio.reactor.BaseIOReactor.readable(BaseIOReactor.java:159)
    at org.apache.http.impl.nio.reactor.AbstractIOReactor.processEvent(AbstractIOReactor.java:338)
    at org.apache.http.impl.nio.reactor.AbstractIOReactor.processEvents(AbstractIOReactor.java:316)
    at org.apache.http.impl.nio.reactor.AbstractIOReactor.execute(AbstractIOReactor.java:277)
    at org.apache.http.impl.nio.reactor.BaseIOReactor.execute(BaseIOReactor.java:105)
    at org.apache.http.impl.nio.reactor.AbstractMultiworkerIOReactor$Worker.run(AbstractMultiworkerIOReactor.java:586)
    at java.lang.Thread.run(Thread.java:748)
Caused by: javax.net.ssl.SSLHandshakeException: General SSLEngine problem
    at sun.security.ssl.Alerts.getSSLException(Alerts.java:198)
    at sun.security.ssl.SSLEngineImpl.fatal(SSLEngineImpl.java:1729)
    at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:333)
    at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:325)
    at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1688)
    at sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:226)
    at sun.security.ssl.Handshaker.processLoop(Handshaker.java:1082)
    at sun.security.ssl.Handshaker$1.run(Handshaker.java:1015)
    at sun.security.ssl.Handshaker$1.run(Handshaker.java:1012)
    at java.security.AccessController.doPrivileged(Native Method)
    at sun.security.ssl.Handshaker$DelegatedTask.run(Handshaker.java:1504)
    at org.apache.http.nio.reactor.ssl.SSLIOSession.doRunTask(SSLIOSession.java:255)
    at org.apache.http.nio.reactor.ssl.SSLIOSession.doHandshake(SSLIOSession.java:293)
    ... 9 more
Caused by: sun.security.validator.ValidatorException: PKIX path validation failed: java.security.cert.CertPathValidatorException: signature check failed
    at sun.security.validator.PKIXValidator.doValidate(PKIXValidator.java:380)
    at sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:285)
    at sun.security.validator.Validator.validate(Validator.java:262)
    at sun.security.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:330)
    at sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:289)
    at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:144)
    at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1675)
    ... 17 more
Caused by: java.security.cert.CertPathValidatorException: signature check failed
.
.
.
Caused by: java.security.SignatureException: Signature does not match.

解决方法 #

这个错误源于SSL握手失败，JVM无法验证目标WSO2服务器的证书签名，本质是Integration Studio的信任库未包含目标服务器的有效证书。可通过以下两种方式解决：

方法一：导入目标服务器证书到信任库（生产环境推荐） #

1. 导出WSO2服务器证书
   找到目标WSO2服务器的密钥库（默认路径：<WSO2_SERVER_HOME>/repository/resources/security/wso2carbon.jks），执行以下命令导出证书：

   keytool -export -alias wso2carbon -file wso2carbon.cer -keystore <WSO2_SERVER_HOME>/repository/resources/security/wso2carbon.jks -storepass wso2carbon
   

   注：若修改过密钥库密码，替换wso2carbon为实际密码。

2. 导入证书到Integration Studio信任库
   找到Integration Studio的客户端信任库（默认路径：<INTEGRATION_STUDIO_HOME>/runtime/microesb/conf/security/client-truststore.jks），执行以下命令导入证书：

   keytool -import -alias wso2carbon -file wso2carbon.cer -keystore <INTEGRATION_STUDIO_HOME>/runtime/microesb/conf/security/client-truststore.jks -storepass wso2carbon
   

   提示是否信任该证书时，输入yes确认。

3. 重启运行环境
   停止当前运行的Micro Integrator实例，重新启动后，信任库的变更会生效。

方法二：禁用SSL验证（仅测试环境使用） #

如果是测试环境，可临时在端点配置中禁用SSL验证，修改后的端点配置如下：

<http method="get" uri-template="https://localhost:9443/api/am/publisher/v3/apis">
    <ssl-config disableSslVerification="true"/>
    <suspendOnFailure>
        <initialDuration>-1</initialDuration>
        <progressionFactor>-1</progressionFactor>
        <maximumDuration>0</maximumDuration>
    </suspendOnFailure>
    <markForSuspension>
        <retriesBeforeSuspension>0</retriesBeforeSuspension>
    </markForSuspension>
</http>

内容的提问来源于stack exchange，提问作者Oussama Nairi