Enabling SSL on KillBill

[j...@ebctechnologies.com]

Hi

I am trying to connect with KillBill running on Jetty server on HTTPS protocol.
But I am getting the following error:

org.killbill.billing.client.KillBillClientException: java.util.concurrent.ExecutionException: java.net.ConnectException: General SSLEngine problem
at org.killbill.billing.client.KillBillHttpClient.doRequest(KillBillHttpClient.java:620)
at org.killbill.billing.client.KillBillHttpClient.doPrepareRequest(KillBillHttpClient.java:481)
at org.killbill.billing.client.KillBillHttpClient.doGet(KillBillHttpClient.java:381)
at org.killbill.billing.client.KillBillHttpClient.doGet(KillBillHttpClient.java:376)
at org.killbill.billing.client.KillBillClient.getAccount(KillBillClient.java:218)
at org.killbill.billing.client.KillBillClient.getAccount(KillBillClient.java:202)
at org.killbill.billing.client.KillBillClient.getAccount(KillBillClient.java:198)
at services.Killbill$.makePayment(Killbill.scala:210)
at controllers.Sample$.main(PaymentController.scala:101)
at controllers.Sample.main(PaymentController.scala)

Here is the code snippet:

killBillHttpClient = new KillBillHttpClient(url ,
userName,
password,
apiKey,
apiSecret,
proxyHost,
proxyPort,
connectTimeOut,
readTimeOut,
requestTimeout,
true,
"TLSv1")

killBillClient = new KillBillClient(killBillHttpClient)

account = new Account();
account.setExternalKey(killBillUser.customerUUID);
account.setCurrency(killBillUser.currency);
account = killBillClient.createAccount(account, user, reason, comment);

I am using the latest version of KillBill and KillBill java client and using the newly added constructor. But I am not able to understand what I am missing.
Kindly suggest what I need to do for running it on HTTPS.

Thanks
Joy

[stephane brossier]

Joy,

Have you tried using 'TLSv1.2', or do you need to specify "TLSv1" ? There is a thread that discussed this issue already.

S.

--
You received this message because you are subscribed to the Google Groups "Kill Bill users mailing-list" group.
To unsubscribe from this group and stop receiving emails from it, send an email to killbilling-users+unsubscribe@googlegroups.com.
To post to this group, send email to killbilling-users@googlegroups.com.
Visit this group at https://groups.google.com/group/killbilling-users.
To view this discussion on the web visit https://groups.google.com/d/msgid/killbilling-users/4373f567-5541-40a2-bddc-2b0e73b0cc78%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[joyma...@gmail.com]

I have tried both but getting the same exception. I have seen this thread, and used the new constructor added in killbill client. I also updated the KillBill platform from 16.* to 18.* But still facing the same issue.

[j...@ebctechnologies.com]

Can anyone help me out with this.

[Pierre-Alexandre Meyer]

Hi Joy,

I don't think we have enough information yet to pinpoint the issue, but here are some ideas:

• Did you verify SSL is correctly configured on the server side by issuing a cURL command?
• What's the output of curl -v ..., which should list the cyphers in use? Did you verify they are supported by your JVM environment on the client side?
• Can you try to get the underlying SSL exception on the client side (maybe via a breakpoint)? What's the cause of the "General SSLEngine problem"?

On Mon, Apr 3, 2017 at 6:55 AM, <j...@ebctechnologies.com> wrote:

Can anyone help me out with this.

--
You received this message because you are subscribed to the Google Groups "Kill Bill users mailing-list" group.
To unsubscribe from this group and stop receiving emails from it, send an email to killbilling-users+unsubscribe@googlegroups.com.
To post to this group, send email to killbilling-users@googlegroups.com.
Visit this group at https://groups.google.com/group/killbilling-users.

To view this discussion on the web visit https://groups.google.com/d/msgid/killbilling-users/4b6fc0f2-463d-4296-86c4-4080194763bc%40googlegroups.com.

For more options, visit https://groups.google.com/d/optout.

--

Pierre

[j...@ebctechnologies.com]

Here is the complete log of exception:

org.killbill.billing.client.KillBillClientException: java.util.concurrent.ExecutionException: java.net.ConnectException: General SSLEngine problem
at org.killbill.billing.client.KillBillHttpClient.doRequest(KillBillHttpClient.java:620)
at org.killbill.billing.client.KillBillHttpClient.doPrepareRequest(KillBillHttpClient.java:481)
at org.killbill.billing.client.KillBillHttpClient.doGet(KillBillHttpClient.java:381)
at org.killbill.billing.client.KillBillHttpClient.doGet(KillBillHttpClient.java:376)
at org.killbill.billing.client.KillBillClient.getAccount(KillBillClient.java:218)
at org.killbill.billing.client.KillBillClient.getAccount(KillBillClient.java:202)
at org.killbill.billing.client.KillBillClient.getAccount(KillBillClient.java:198)

at services.Killbill$.makePayment(Killbill.scala:185)

at controllers.Sample$.main(PaymentController.scala:101)
at controllers.Sample.main(PaymentController.scala)

Caused by: java.util.concurrent.ExecutionException: java.net.ConnectException: General SSLEngine problem
at com.ning.http.client.providers.netty.future.NettyResponseFuture.abort(NettyResponseFuture.java:231)
at com.ning.http.client.providers.netty.request.NettyConnectListener.onFutureFailure(NettyConnectListener.java:132)
at com.ning.http.client.providers.netty.request.NettyConnectListener.access$200(NettyConnectListener.java:37)
at com.ning.http.client.providers.netty.request.NettyConnectListener$1.operationComplete(NettyConnectListener.java:101)
at org.jboss.netty.channel.DefaultChannelFuture.notifyListener(DefaultChannelFuture.java:409)
at org.jboss.netty.channel.DefaultChannelFuture.notifyListeners(DefaultChannelFuture.java:395)
at org.jboss.netty.channel.DefaultChannelFuture.setFailure(DefaultChannelFuture.java:362)
at org.jboss.netty.handler.ssl.SslHandler.setHandshakeFailure(SslHandler.java:1452)
at org.jboss.netty.handler.ssl.SslHandler.unwrap(SslHandler.java:1306)
at org.jboss.netty.handler.ssl.SslHandler.decode(SslHandler.java:852)
at org.jboss.netty.handler.codec.frame.FrameDecoder.callDecode(FrameDecoder.java:425)
at org.jboss.netty.handler.codec.frame.FrameDecoder.messageReceived(FrameDecoder.java:310)
at org.jboss.netty.channel.SimpleChannelUpstreamHandler.handleUpstream(SimpleChannelUpstreamHandler.java:70)
at org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:564)
at org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:559)
at org.jboss.netty.channel.Channels.fireMessageReceived(Channels.java:268)
at org.jboss.netty.channel.Channels.fireMessageReceived(Channels.java:255)
at org.jboss.netty.channel.socket.nio.NioWorker.read(NioWorker.java:88)
at org.jboss.netty.channel.socket.nio.AbstractNioWorker.process(AbstractNioWorker.java:108)
at org.jboss.netty.channel.socket.nio.AbstractNioSelector.run(AbstractNioSelector.java:337)
at org.jboss.netty.channel.socket.nio.AbstractNioWorker.run(AbstractNioWorker.java:89)
at org.jboss.netty.channel.socket.nio.NioWorker.run(NioWorker.java:178)
at org.jboss.netty.util.ThreadRenamingRunnable.run(ThreadRenamingRunnable.java:108)
at org.jboss.netty.util.internal.DeadLockProofWorker$1.run(DeadLockProofWorker.java:42)
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142)
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617)
at java.lang.Thread.run(Thread.java:745)
Caused by: java.net.ConnectException: General SSLEngine problem
at com.ning.http.client.providers.netty.request.NettyConnectListener.onFutureFailure(NettyConnectListener.java:128)
... 25 more
Caused by: javax.net.ssl.SSLHandshakeException: General SSLEngine problem
at sun.security.ssl.Handshaker.checkThrown(Handshaker.java:1431)
at sun.security.ssl.SSLEngineImpl.checkTaskThrown(SSLEngineImpl.java:535)
at sun.security.ssl.SSLEngineImpl.readNetRecord(SSLEngineImpl.java:813)
at sun.security.ssl.SSLEngineImpl.unwrap(SSLEngineImpl.java:781)
at javax.net.ssl.SSLEngine.unwrap(SSLEngine.java:624)
at org.jboss.netty.handler.ssl.SslHandler.unwrap(SslHandler.java:1220)
... 18 more
Caused by: javax.net.ssl.SSLHandshakeException: General SSLEngine problem
at sun.security.ssl.Alerts.getSSLException(Alerts.java:192)
at sun.security.ssl.SSLEngineImpl.fatal(SSLEngineImpl.java:1728)
at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:304)
at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:296)
at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1509)
at sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:216)
at sun.security.ssl.Handshaker.processLoop(Handshaker.java:979)
at sun.security.ssl.Handshaker$1.run(Handshaker.java:919)
at sun.security.ssl.Handshaker$1.run(Handshaker.java:916)
at java.security.AccessController.doPrivileged(Native Method)
at sun.security.ssl.Handshaker$DelegatedTask.run(Handshaker.java:1369)
at org.jboss.netty.handler.ssl.SslHandler.runDelegatedTasks(SslHandler.java:1384)
at org.jboss.netty.handler.ssl.SslHandler.unwrap(SslHandler.java:1261)
... 18 more
Caused by: java.security.cert.CertificateException: No subject alternative names present
at sun.security.util.HostnameChecker.matchIP(HostnameChecker.java:144)
at sun.security.util.HostnameChecker.match(HostnameChecker.java:93)
at sun.security.ssl.X509TrustManagerImpl.checkIdentity(X509TrustManagerImpl.java:455)
at sun.security.ssl.AbstractTrustManagerWrapper.checkAdditionalTrust(SSLContextImpl.java:998)
at sun.security.ssl.AbstractTrustManagerWrapper.checkServerTrusted(SSLContextImpl.java:937)
at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1496)
... 26 more

Here is the complete log of exception I am getting. Kindly suggest

Thanks

[Pierre-Alexandre Meyer]

Hi Joy,

On Fri, Apr 7, 2017 at 2:11 AM, <j...@ebctechnologies.com> wrote:

Caused by: java.security.cert.CertificateException: No subject alternative names present
        at sun.security.util.HostnameChecker.matchIP(HostnameChecker.java:144)
        at sun.security.util.HostnameChecker.match(HostnameChecker.java:93)
        at sun.security.ssl.X509TrustManagerImpl.checkIdentity(X509TrustManagerImpl.java:455)
        at sun.security.ssl.AbstractTrustManagerWrapper.checkAdditionalTrust(SSLContextImpl.java:998)
        at sun.security.ssl.AbstractTrustManagerWrapper.checkServerTrusted(SSLContextImpl.java:937)
        at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1496)
        ... 26 more

It looks like there is an issue with your certificate that even our LooseTrustManager doesn't validate.

Can you try some of the work-arounds described here: https://stackoverflow.com/questions/19540289/how-to-fix-the-java-security-cert-certificateexception-no-subject-alternative ?

--

Pierre