TroubleShoot: WebSphere WS-Security Keystore Errors

CWWSS5003E: The c:/WebSphere/AppServer/profiles/server1/etc/ws-security/webstore.jks key store cannot be read because an IOException error occurred.: java.net.MalformedURLException: unknown protocol: c ocurred while running action

The keystore does not exist.

CWWSS5003E: The c:/WebSphere/AppServer/profiles/server1/etc/ws-security/webstore.jks key store cannot be read because an IOException error occurred.: java.io.IOException: Keystore was tampered with, or password was incorrect

CWWSS5312E: The Application Server cannot retrieve the 'myKey' key from the 'c:/WebSphere/AppServer/profiles/server1/etc/ws-security/webstore.jks' keystore. The following exception occurred: java.security.UnrecoverableKeyException ocurred while running action:

The password may be incorrect for a private key. If it is, you will also see entries like the following in a WS-Security trace:

CWWSS5312E: The Application Server cannot retrieve the 'gateway-public' key from the '/apps/ki01/e8-was85-pt02/AppServer/etc/ShowcaseKeyStore-tpt.jks' keystore. The following exception occurred: java.lang.UnsupportedOperationException: trusted certificate entries are not password-protected

Private keys are required for Signature Generators and Encryption Consumers.

 

CWWSS5312E: The Application Server cannot retrieve the 'myKey' key from the 'c:/WebSphere/AppServer/profiles/server1/etc/ws-security/webstore.jks' keystore. The following exception occurred: java.security.UnrecoverableEntryException: requested entry requires a password (JAX-WS)

CWWSS5312E: The Application Server cannot retrieve the 'myKey' key from the 'c:/WebSphere/AppServer/profiles/server1/etc/ws-security/webstore.jks' keystore. The following exception occurred: java.lang.IllegalArgumentException: password can't be null (JAX-WS)

Same reason as the error above above. Different JDK levels can produce different exception types with different text, but the meaning is the same.

WSEC5184E: The key with alias "myKey" of keystore "c:/WebSphere/AppServer/profiles/server1/etc/ws-security/webstore.jks" cannot be recovered (the password could be wrong): java.security.UnrecoverableEntryException: requested entry requires a password (JAX-RPC)

Same reason as the error above except the stack will be different since it's the JAX-RPC runtime.

CWWSS6800E: The entry with alias 'anyKey' of keystore 'c:/WebSphere/AppServer/profiles/server1/etc/ws-security/webstore.jks' cannot be found: entry=null

An alias is configured that does not exist in the keystore.

CWWSS7073E: The key is not retrieved.

A public key is configured where a private key is required. You may see something like this in a trace:

CWWSS5003E: The c:/WebSphere/AppServer/profiles/server1/etc/ws-security/webstore.jks key store cannot be read because an IOException error occurred.: java.io.IOException: Invalid keystore format

The configured keystore type is incorrect.

CWWSS6809E: The X509 certificate owned by CN=SOAPRequester, OU=TRL, O=IBM, ST=Kanagawa, C=JP, which is created from the binary in the message is different from the X509 certificate owned by EMAILADDRESS=myx509root@us.ibm.com, CN=myx509root, OU=AIM, O=IBM, ST=TX, C=US, which is acquired from the keystore Path: g:\w\wl3wse\wssec\keys\myx509.ks.

The certificate configured in the X.509 token consumer is different than the one that was used to sign the message. When you get this message, you most likely configured a certificate on the X.509 token consumer when you shouldn't have. You should only configure a certificate on an X.509 token consumer if you want to restrict the consumer to accepting a single certificate.

CWWSS6811E: The key identifier QZOb+ZiiTuY= retrieved from the message is different from the key identifier iC3nl51GBjj0DnIxHQWiYhC3Xvw= acquired from the keystore Path: g:\w\wl3wse\wssec\keys\myx509.ks.

The message does not contain a copy of the certificate to verify the signature (like a BinarySecurityToken). When the certificate to verify the signature is not in the message, the certificate to verify the signature is configured on the X.509 token consumer. In this case, a KeyId was put in the message to identify the certificate that was used to sign the message. This error means that the KeyId calculated for the certificate configured on the X.509 token consumer does not match the one that was received in the message. They must match before the signature will be verified.

CWWSS7315E: Caught an exception attempting to create default configuration objects. The following exception occurred: java.security.AccessControlException: Access denied (java.io.FilePermission c:\WebSphere\AppServer\profiles\fvtTest\etc\ws-security\samples\intca2.cer read)].

If you get an error like this, but you know that the file in the message exists, you may have to disable Java 2 security.

SAMLResponse could not be verified.com.ibm.wsspi.wssecurity.core.SoapSecurityException: Fail to decrypt EncryptedKey

The WS-Security runtime is used to validate SAML Assertions for the SAML Web Single Sign-on TAI component. When you get this error, check a WS-Security trace for this entry:

CWWSS6521E: The Login failed because of an exception: javax.security.auth.login.LoginException: java.security.cert.CertPathBuilderException: unable to find valid certification path to requested target ocurred while running action: com.ibm.ws.wssecurity.handler.WSSecurityConsumerHandler

The certificate being validated is self-signed and isn't in the configured trust store. See the Trace analysis tab for information on how to debug this issue.

CWWSS6521E: The Login failed because of an exception: javax.security.auth.login.LoginException: java.security.cert.CertPathBuilderException: PKIXCertPathBuilderImpl could not build a valid CertPath.; internal cause is: java.security.cert.CertPathValidatorException: The certificate issued by EMAILADDRESS=test_it@us.ibm.com, CN=test_it, OU=AIM, O=IBM, ST=TX, C=US is not trusted; internal cause is: java.security.cert.CertPathValidatorException: Certificate chaining error

The certificate being validated is not self-signed and its issuer, or one of its subsequent issuers (the one shown in the message) isn't in the configured trust store. See the Trace analysis tab for information on how to debug this issue.