Calling SSL or https Web Service using WebLogic : javax.net.ssl.SSLHandshakeException: Received fatal alert: bad_certificate

When trying to call an external web service Using PeopleSoft Integration broker, it is giving the following message

<Jul 23, 2019 6:47:30 PM EDT> <Notice> <Stdout> <BEA-000000> <[ACTIVE] ExecuteThread: '3' for queue: 'weblogic.kernel.Default (self-tuning)', RECV TLSv1.2 ALERT:  fatal, bad_certificate>

in Integration Broker Gateway Server, You will see

HttpTargetConnector:ExternalSystemContactException Received fatal alert: bad_certificate
Message Set : 158, Message ID : 10721 IOException: The host couldn't be resolved.
To further debug, use the following options in setEnv,sh

JAVA_OPTIONS_LINUX="-server -Xms1024m -Xmx1024m -Dtuxedo.jolt.LLEDeprecationWarnLevel=NONE -Djavax.net.debug=all -XX:MaxPermSize=256m -Dtoplink.xml.platform=oracle.toplink.platform.xml.jaxp.JAXPPlatform -Dcom.sun.xml.namespace.QName.useCompatibleSerialVersionUID=1.0"

or
-Djavax.net.debug=ssl:handshake:verbose

Review this document

[Java SE] Training - How to Process javax.net.debug Diagnostic Output (Doc ID 2170565.1)

egrep -i "\* ClientHello|\* ServerHello|\* Certificate chain|\* CertificateRequest|\* ServerHelloDone|\* ClientKeyExchange|\* ServerKeyExchange|\* CertificateVerify|Change Cipher Spec|\* Finished|fatal|exception"  outputfile
egrep -v "^[0-9A-Z][0-9A-Z][0-9A-Z][0-9A-Z]:" outputfile
Resolution
This issue is caused by an expired SSL Certificate (PrivateKeyEntry) entry in pskey keystore located at

$PS_CFG_HOME/webserv/peoplesoft/piaconfig/keystore

To list the entries

cd $PS_CFG_HOME/webserv/peoplesoft/piaconfig/keystore
ls -lrt
keytool -list -keystore pskey -storepass xxx -alias xxx -v
or to list every thing
keytool -list -keystore pskey -storepass xxx -v > output.txt

Review the output for expired entry.

This can also happen, if you have a PrivateKeyEntry that is signed by a Root CA which is not present in the target Web Service Provider keystore.

Solution: Delete the expired or invalid PrivateKeyentry and restart the webserver

keytool -delete -keystore pskey -storepass xxx -alias xxx

This has resolved the issue.

Other issue is that if you do not have RootCA of the target Web Service provider SSL Certificate in your keystore then you will need to import it in your keystore.

errorLog

javax.net.ssl.SSLHandshakeException: Received fatal alert: bad_certificate
 at sun.security.ssl.Alerts.getSSLException(Alerts.java:192)
 at sun.security.ssl.Alerts.getSSLException(Alerts.java:154)
 at sun.security.ssl.SSLSocketImpl.recvAlert(SSLSocketImpl.java:1972)
 at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1089)
 at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1325)
 at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1352)
 at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1336)
 at psft.pt8.pshttp.https.HttpsClient.doConnect(HttpsClient.java:246)
 at sun.net.NetworkClient.openServer(NetworkClient.java:136)
 at psft.pt8.pshttp.https.HttpClient.openServer(HttpClient.java:543)
 at psft.pt8.pshttp.https.HttpClient.<init>(HttpClient.java:364)
 at psft.pt8.pshttp.https.HttpsClient.<init>(HttpsClient.java:76)
 at psft.pt8.pshttp.https.HttpsClient.newClient(HttpsClient.java:132)
 at psft.pt8.pshttp.https.HttpsClient.newClient(HttpsClient.java:100)
 at psft.pt8.pshttp.https.HttpsURLConnection.connect(HttpsURLConnection.java:468)
 at psft.pt8.pshttp.PSHttp.getResponseCode(PSHttp.java:423)
 at com.peoplesoft.pt.integrationgateway.targetconnector.HttpTargetConnector.send(HttpTargetConnector.java:858)
 at com.peoplesoft.pt.integrationgateway.service.BasicConnectorInvocator.execute(BasicConnectorInvocator.java:131)
 at com.peoplesoft.pt.integrationgateway.framework.GatewayManager.invokeService(GatewayManager.java:148)
 at com.peoplesoft.pt.integrationgateway.framework.GatewayManager.connect(GatewayManager.java:192)
 at com.peoplesoft.pt.integrationgateway.listeningconnector.PeopleSoftListeningConnector.doPost(PeopleSoftListeningConnector.java:186)
 at javax.servlet.http.HttpServlet.service(HttpServlet.java:751)
 at com.peoplesoft.pt.integrationgateway.listeningconnector.PeopleSoftListeningConnector.service(PeopleSoftListeningConnector.java:87)
 at javax.servlet.http.HttpServlet.service(HttpServlet.java:844)
 at weblogic.servlet.internal.StubSecurityHelper$ServletServiceAction.run(StubSecurityHelper.java:280)
 at weblogic.servlet.internal.StubSecurityHelper$ServletServiceAction.run(StubSecurityHelper.java:254)
 at weblogic.servlet.internal.StubSecurityHelper.invokeServlet(StubSecurityHelper.java:136)
 at weblogic.servlet.internal.ServletStubImpl.execute(ServletStubImpl.java:346)
 at weblogic.servlet.internal.TailFilter.doFilter(TailFilter.java:25)
 at weblogic.servlet.internal.FilterChainImpl.doFilter(FilterChainImpl.java:79)
 at com.peoplesoft.pt.integrationgateway.common.IBFilter.doFilter(IBFilter.java:84)
 at weblogic.servlet.internal.FilterChainImpl.doFilter(FilterChainImpl.java:79)
 at weblogic.servlet.internal.WebAppServletContext$ServletInvocationAction.wrapRun(WebAppServletContext.java:3456)
 at weblogic.servlet.internal.WebAppServletContext$ServletInvocationAction.run(WebAppServletContext.java:3422)
 at weblogic.security.acl.internal.AuthenticatedSubject.doAs(AuthenticatedSubject.java:323)
 at weblogic.security.service.SecurityManager.runAs(SecurityManager.java:120)
 at weblogic.servlet.provider.WlsSubjectHandle.run(WlsSubjectHandle.java:57)
 at weblogic.servlet.internal.WebAppServletContext.doSecuredExecute(WebAppServletContext.java:2280)
 at weblogic.servlet.internal.WebAppServletContext.securedExecute(WebAppServletContext.java:2196)
 at weblogic.servlet.internal.WebAppServletContext.execute(WebAppServletContext.java:2174)
 at weblogic.servlet.internal.ServletRequestImpl.run(ServletRequestImpl.java:1632)
 at weblogic.servlet.provider.ContainerSupportProviderImpl$WlsRequestExecutor.run(ContainerSupportProviderImpl.java:256)
 at weblogic.work.ExecuteThread.execute(ExecuteThread.java:311)
 at weblogic.work.ExecuteThread.run(ExecuteThread.java:263)


PIA_stderr

com.peoplesoft.pt.integrationgateway.common.ExternalSystemContactException: HttpTargetConnector:ExternalSystemContactException Received fatal alert: bad_certificate
 at com.peoplesoft.pt.integrationgateway.targetconnector.HttpTargetConnector.send(HttpTargetConnector.java:1296)
 at com.peoplesoft.pt.integrationgateway.service.BasicConnectorInvocator.execute(BasicConnectorInvocator.java:131)
 at com.peoplesoft.pt.integrationgateway.framework.GatewayManager.invokeService(GatewayManager.java:148)
 at com.peoplesoft.pt.integrationgateway.framework.GatewayManager.connect(GatewayManager.java:192)
 at com.peoplesoft.pt.integrationgateway.listeningconnector.PeopleSoftListeningConnector.doPost(PeopleSoftListeningConnector.java:186)
 at javax.servlet.http.HttpServlet.service(HttpServlet.java:751)
 at com.peoplesoft.pt.integrationgateway.listeningconnector.PeopleSoftListeningConnector.service(PeopleSoftListeningConnector.java:87)
 at javax.servlet.http.HttpServlet.service(HttpServlet.java:844)
 at weblogic.servlet.internal.StubSecurityHelper$ServletServiceAction.run(StubSecurityHelper.java:280)
 at weblogic.servlet.internal.StubSecurityHelper$ServletServiceAction.run(StubSecurityHelper.java:254)
 at weblogic.servlet.internal.StubSecurityHelper.invokeServlet(StubSecurityHelper.java:136)
 at weblogic.servlet.internal.ServletStubImpl.execute(ServletStubImpl.java:346)
 at weblogic.servlet.internal.TailFilter.doFilter(TailFilter.java:25)
 at weblogic.servlet.internal.FilterChainImpl.doFilter(FilterChainImpl.java:79)
 at com.peoplesoft.pt.integrationgateway.common.IBFilter.doFilter(IBFilter.java:84)
 at weblogic.servlet.internal.FilterChainImpl.doFilter(FilterChainImpl.java:79)
 at weblogic.servlet.internal.WebAppServletContext$ServletInvocationAction.wrapRun(WebAppServletContext.java:3456)
 at weblogic.servlet.internal.WebAppServletContext$ServletInvocationAction.run(WebAppServletContext.java:3422)
 at weblogic.security.acl.internal.AuthenticatedSubject.doAs(AuthenticatedSubject.java:323)
 at weblogic.security.service.SecurityManager.runAs(SecurityManager.java:120)
 at weblogic.servlet.provider.WlsSubjectHandle.run(WlsSubjectHandle.java:57)
 at weblogic.servlet.internal.WebAppServletContext.doSecuredExecute(WebAppServletContext.java:2280)
 at weblogic.servlet.internal.WebAppServletContext.securedExecute(WebAppServletContext.java:2196)
 at weblogic.servlet.internal.WebAppServletContext.execute(WebAppServletContext.java:2174)
 at weblogic.servlet.internal.ServletRequestImpl.run(ServletRequestImpl.java:1632)
 at weblogic.servlet.provider.ContainerSupportProviderImpl$WlsRequestExecutor.run(ContainerSupportProviderImpl.java:256)
 at weblogic.work.ExecuteThread.execute(ExecuteThread.java:311)
 at weblogic.work.ExecuteThread.run(ExecuteThread.java:263)

Unable to find a Routing Corresponding to the incoming Request Message (158,505)

When testing a WSDL or WADL you are getting the above message in the output Unable to find a Routing Corresponding to the incoming Request Message (158,505). for e.g. after publishing the WSDL for Soap or WADL for Rest, you try to view the WSDL or WADL and get the above message. 

1. Make sure that GETWADL and GETWSDL Service Operation which is part of IB_UTILITY Service is active and has any to local routing defined and active. Once you add the missing routing, Go to Routing Definition and Select Parameter Tab and make sure that External alias is exactly GetWADL for GETWADL and GetWSDL for GETWSDL. If it is anything other for e.g. GETWADL or GETWADL.V1 it will not work.

See following My Oracle Support Resolutions 1949257.1 and 1572531.1 for more information.

Sample URL to view WADL and WSDL are

WADL (REST)

http://piahostname.com/PSIGW/RESTListeningConnector/PSFT_PA/PTCS_SECURITY.1.wadl

WSDL (SOAP)
http://piahostname.com/PSIGW/PeopleSoftServiceListeningConnector/PSFT_PA/PTCS_SECURITY.1.wsdl

To find out which WSDL or WADL are published to  WSDL Repository, Do the following Select.

select * from PSIBWSDLDFN;

Note: This is tested in 8.53.09 and 8.53.12 but may be valid for other PeopleTools version as well.