WSO2 API Manager 3.2更新SSL证书后无法访问发布者及开发者门户

我们在WSO2 API Manager 3.2中按以下步骤更新了自签名内部证书，之后无法访问Publisher和Dev Portal URL，但可正常访问Carbon URL。

执行的证书操作命令 #

keytool -genkey -alias wso2mcm -keyalg RSA -keysize 2048 -keystore wso2mcm.jks -dname "CN=ad.local.com, OU=Home,O=Home,L=SL,S=WS,C=LK" --storepass wso2carbon -keypass wso2carbon -validity 365
keytool -export -alias wso2mcm -keystore wso2mcm.jks -file wso2mcm.pem
keytool -delete -alias wso2mcm -keystore client-truststore.jks
keytool -import -alias wso2mcm -file wso2mcm.pem -keystore client-truststore.jks -storepass wso2carbon
keytool -importkeystore -srckeystore wso2mcm.jks -destkeystore wso2mcm.p12 -deststoretype PKCS12

当前deployment.toml配置 #

[keystore.tls]
file_name =  "wso2mcm.jks"
type =  "JKS"
password =  "wso2carbon"
alias =  "wso2mcm"
key_password =  "wso2carbon"

[keystore.primary]
file_name =  "wso2carbon.jks"
type =  "JKS"
password =  "wso2carbon"
alias =  "wso2carbon"
key_password =  "wso2carbon"

[keystore.internal]
file_name =  "wso2carbon.jks"
type =  "JKS"
password =  "wso2carbon"
alias =  "wso2carbon"
key_password =  "wso2carbon"

错误信息 #

• 页面表现：访问Publisher/Dev Portal时出现认证失败
• Carbon日志条目：

TID: [-1234] [] [2022-12-16 13:10:11,367] ERROR {org.wso2.carbon.identity.oauth2.OAuth2Service} - 为客户端ID : P_3DbvpsLEMzJJa89HsBFEjEJaUa，用户ID null，权限范围 : []以及授权类型 : authorization_code颁发访问令牌时出错 java.lang.NullPointerException
        at java.base/java.util.concurrent.ConcurrentHashMap.putVal(ConcurrentHashMap.java:1011)
        at java.base/java.util.concurrent.ConcurrentHashMap.put(ConcurrentHashMap.java:1006)
        at org.wso2.carbon.identity.oauth2.util.OAuth2Util.getPrivateKey(OAuth2Util.java:2370)
        at org.wso2.carbon.identity.oauth2.util.OAuth2Util.signJWTWithRSA(OAuth2Util.java:2327)
        at org.wso2.carbon.identity.oauth2.util.OAuth2Util.signJWT(OAuth2Util.java:2287)
        at org.wso2.carbon.identity.openidconnect.DefaultIDTokenBuilder.getIDToken(DefaultIDTokenBuilder.java:295)
        at org.wso2.carbon.identity.openidconnect.DefaultIDTokenBuilder.buildIDToken(DefaultIDTokenBuilder.java:204)
        at org.wso2.carbon.identity.oauth2.token.AccessTokenIssuer.issue(AccessTokenIssuer.java:338)
        at org.wso2.carbon.identity.oauth2.OAuth2Service.issueAccessToken(OAuth2Service.java:254)
        at org.wso2.carbon.identity.oauth.endpoint.token.OAuth2TokenEndpoint.issueAccessToken(OAuth2TokenEndpoint.java:318)
        at org.wso2.carbon.identity.oauth.endpoint.token.OAuth2TokenEndpoint.issueAccessToken(OAuth2TokenEndpoint.java:94)
        at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at java.base/jdk.internal.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
        at java.base/jdk.internal.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
        at java.base/java.lang.reflect.Method.invoke(Method.java:566)
        at org.apache.cxf.service.invoker.AbstractInvoker.performInvocation(AbstractInvoker.java:179)
        at org.apache.cxf.service.invoker.AbstractInvoker.invoke(AbstractInvoker.java:96)
        at org.apache.cxf.jaxrs.JAXRSInvoker.invoke(JAXRSInvoker.java:193)
        at org.apache.cxf.jaxrs.JAXRSInvoker.invoke(JAXRSInvoker.java:103)
        at org.apache.cxf.interceptor.ServiceInvokerInterceptor$1.run(ServiceInvokerInterceptor.java:59)
        at org.apache.cxf.interceptor.ServiceInvokerInterceptor.handleMessage(ServiceInvokerInterceptor.java:96)
        at org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(PhaseInterceptorChain.java:308)
        at org.apache.cxf.transport.ChainInitiationObserver.onMessage(ChainInitiationObserver.java:121)
        at org.apache.cxf.transport.http.AbstractHTTPDestination.invoke(AbstractHTTPDestination.java:267)
        at org.apache.cxf.transport.servlet.ServletController.invokeDestination(ServletController.java:234)
        at org.apache.cxf.transport.servlet.ServletController.invoke(ServletController.java:208)
        at org.apache.cxf.transport.servlet.ServletController.invoke(ServletController.java:160)
        at org.apache.cxf.transport.servlet.CXFNonSpringServlet.invoke(CXFNonSpringServlet.java:216)
        at org.apache.cxf.transport.servlet.AbstractHTTPServlet.handleRequest(AbstractHTTPServlet.java:301)
        at org.apache.cxf.transport.servlet.AbstractHTTPServlet.doPost(AbstractHTTPServlet.java:220)
        at javax.servlet.http.HttpServlet.service(HttpServlet.java:660)
        at org.apache.cxf.transport.servlet.AbstractHTTPServlet.service(AbstractHTTPServlet.java:276)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:231)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
        at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:53)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
        at org.wso2.carbon.webapp.mgt.filter.AuthorizationHeaderFilter.doFilter(AuthorizationHeaderFilter.java:128)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
        at org.wso2.carbon.ui.filters.cache.ContentTypeBasedCachePreventionFilter.doFilter(ContentTypeBasedCachePreventionFilter.java:53)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
        at org.apache.catalina.filters.HttpHeaderSecurityFilter.doFilter(HttpHeaderSecurityFilter.java:126)
        at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:193)
        at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:166)
        at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:202)
        at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:96)
        at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:541)
        at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:139)
        at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:92)
        at org.wso2.carbon.identity.context.rewrite.valve.TenantContextRewriteValve.invoke(TenantContextRewriteValve.java:86)
        at org.wso2.carbon.identity.authz.valve.AuthorizationValve.invoke(AuthorizationValve.java:110)
        at org.wso2.carbon.identity.auth.valve.AuthenticationValve.invoke(AuthenticationValve.java:101)
        at org.wso2.carbon.tomcat.ext.valves.CompositeValve.continueInvocation(CompositeValve.java:99)
        at org.wso2.carbon.tomcat.ext.valves.TomcatValveContainer.invokeValves(TomcatValveContainer.java:49)
        at org.wso2.carbon.tomcat.ext.valves.CompositeValve.invoke(CompositeValve.java:62)
        at org.wso2.carbon.tomcat.ext.valves.CarbonStuckThreadDetectionValve.invoke(CarbonStuckThreadDetectionValve.java:145)
        at org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:690)
        at org.wso2.carbon.tomcat.ext.valves.CarbonContextCreatorValve.invoke(CarbonContextCreatorValve.java:57)
        at org.wso2.carbon.tomcat.ext.valves.RequestCorrelationIdValve.invoke(RequestCorrelationIdValve.java:119)
        at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:74)
        at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:343)
        at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:373)
        at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:65)
        at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:868)
        at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1590)
        at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)
        at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1128)
        at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:628)
        at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
        at java.base/java.lang.Thread.run(Thread.java:834)

问题原因 #

日志中的NullPointerException发生在OAuth2服务获取签名私钥时，说明用于生成JWT/ID Token的私钥无法被正确读取。虽然已更新TLS证书，但内部通信密钥库配置未同步更新，且OAuth2签名机制仍在使用旧密钥配置，导致Publisher/Dev Portal的认证流程失败。

修复步骤 #

1. 同步更新内部通信密钥库配置 #

修改deployment.toml中的[keystore.internal]配置，使其使用新生成的密钥库：

[keystore.internal]
file_name =  "wso2mcm.jks"
type =  "JKS"
password =  "wso2carbon"
alias =  "wso2mcm"
key_password =  "wso2carbon"

2. 配置OAuth2/JWT签名使用新密钥 #

在deployment.toml中添加以下配置，指定JWT签名使用新证书的密钥：

[identity.oauth]
signature_algorithm = "RS256"
signature_alias = "wso2mcm"
signature_keystore = "${carbon.home}/repository/resources/security/wso2mcm.jks"
signature_keystore_password = "wso2carbon"

3. 清理缓存并重启服务 #

• 删除<APIM_HOME>/repository/tmp和<APIM_HOME>/repository/work目录下的所有内容
• 重新启动WSO2 API Manager服务

4. 验证服务提供者配置（可选） #

登录Carbon控制台，进入Identity > Service Providers > List，找到WSO2.API.Publisher和WSO2.API.Devportal：

• 确认其Inbound Authentication Configuration > OAuth/OpenID Connect Configuration中的回调URL域名与新证书的CN（ad.local.com）一致
• 确保签名算法设置为RS256

验证 #

重启后访问Publisher和Dev Portal，确认登录流程正常，且日志中不再出现NullPointerException。

内容的提问来源于stack exchange，提问作者PradeepKumar