Dcm4chee HTTPS connection issues after upgrade to 2.18.3.

[zaka]

After upgrade from 2.18.1 to 2.18.3 dcm4chee-web3 fails to launch Weasis viewer with selected study. The problem is only for the HTTPS connection, HTTP connection works good. Direct connector request 'https://localhost:8443/weasis-pacs-connector/viewer?patientID=' also works good. Maybe some additional configuration is required? Here is the error:

2016-02-08 00:53:51,536 ERROR -> (http-0.0.0.0-8443-1) [org.dcm4chee.web.war.folder.webviewer.Webviewer] Cannot view the selection!
javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
    at com.sun.net.ssl.internal.ssl.Alerts.getSSLException(Alerts.java:174)
    at com.sun.net.ssl.internal.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1747)
    at com.sun.net.ssl.internal.ssl.Handshaker.fatalSE(Handshaker.java:241)
    at com.sun.net.ssl.internal.ssl.Handshaker.fatalSE(Handshaker.java:235)
    at com.sun.net.ssl.internal.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1209)
    at com.sun.net.ssl.internal.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:135)
    at com.sun.net.ssl.internal.ssl.Handshaker.processLoop(Handshaker.java:593)
    at com.sun.net.ssl.internal.ssl.Handshaker.process_record(Handshaker.java:529)
    at com.sun.net.ssl.internal.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:943)
    at com.sun.net.ssl.internal.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1188)
    at com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1215)
    at com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1199)
    at sun.net.www.protocol.https.HttpsClient.afterConnect(HttpsClient.java:434)
    at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(AbstractDelegateHttpsURLConnection.java:166)
    at sun.net.www.protocol.http.HttpURLConnection.getOutputStream(HttpURLConnection.java:1031)
    at sun.net.www.protocol.https.HttpsURLConnectionImpl.getOutputStream(HttpsURLConnectionImpl.java:230)
    at org.dcm4chee.web.webview.weasis.WeasisLinkProvider.viewAllSelection(WeasisLinkProvider.java:174)
    at org.dcm4chee.web.common.webview.link.WebviewerLinkProvider.viewAllSelection(WebviewerLinkProvider.java:149)
    at org.dcm4chee.web.war.folder.webviewer.Webviewer$1.onClick(Webviewer.java:140)
    at org.apache.wicket.markup.html.link.Link.onLinkClicked(Link.java:225)
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
    at java.lang.reflect.Method.invoke(Method.java:597)
    at org.apache.wicket.RequestListenerInterface.invoke(RequestListenerInterface.java:182)
    at org.apache.wicket.request.target.component.listener.ListenerInterfaceRequestTarget.processEvents(ListenerInterfaceRequestTarget.java:73)
    at org.apache.wicket.request.AbstractRequestCycleProcessor.processEvents(AbstractRequestCycleProcessor.java:92)
    at org.apache.wicket.RequestCycle.processEventsAndRespond(RequestCycle.java:1279)
    at org.apache.wicket.RequestCycle.step(RequestCycle.java:1358)
    at org.apache.wicket.RequestCycle.steps(RequestCycle.java:1465)
    at org.apache.wicket.RequestCycle.request(RequestCycle.java:545)
    at org.apache.wicket.protocol.http.WicketFilter.doGet(WicketFilter.java:486)
    at org.apache.wicket.protocol.http.WicketFilter.doFilter(WicketFilter.java:319)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
    at org.jboss.web.tomcat.filters.ReplyHeaderFilter.doFilter(ReplyHeaderFilter.java:96)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:235)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:206)
    at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:230)
    at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:175)
    at org.jboss.web.tomcat.security.SecurityAssociationValve.invoke(SecurityAssociationValve.java:182)
    at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:524)
    at org.jboss.web.tomcat.security.JaccContextValve.invoke(JaccContextValve.java:84)
    at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:127)
    at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:102)
    at org.jboss.web.tomcat.service.jca.CachedConnectionValve.invoke(CachedConnectionValve.java:157)
    at org.apache.catalina.authenticator.SingleSignOn.invoke(SingleSignOn.java:420)
    at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:109)
    at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:262)
    at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:844)
    at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.process(Http11Protocol.java:583)
    at org.apache.tomcat.util.net.JIoEndpoint$Worker.run(JIoEndpoint.java:446)
    at java.lang.Thread.run(Thread.java:662)
Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
    at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:323)
    at sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:217)
    at sun.security.validator.Validator.validate(Validator.java:218)
    at com.sun.net.ssl.internal.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:126)
    at com.sun.net.ssl.internal.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:209)
    at com.sun.net.ssl.internal.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:249)
    at com.sun.net.ssl.internal.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1188)
    ... 48 more
Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
    at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:174)
    at java.security.cert.CertPathBuilder.build(CertPathBuilder.java:238)
    at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:318)
    ... 54 more

[Nicolas Roduit]

It could be a bug in dcm4chee-web3. I have to check with https.

[Nicolas Roduit]

I don't think it is a bug, it is the normal ssl error. If you are using a self-signed certificate or the one in dcm4chee, they cannot be fully trusted.

If it is for testing purpose, you can replace dcm4chee-web-weasis.jar in the deploy directory and restart dcm4chee. This file in attachment will allow to bypass the ssl security when the request of pacs-connector is made on the running server (it is OK when weasis-pacs-connector running on the same server).

It is not recommended to use it in production, the solution will be to buy a certificate. 

[zaka]

I don't think that the self-signed certificate is the reason. I have successfully run SSLPoke in such a way:

  java -Djavax.net.ssl.keyStore=client.p12 -Djavax.net.ssl.keyStorePassword=clientpass -Djavax.net.ssl.keyStoreType=pkcs12 -Djavax.net.ssl.trustStore=client.truststore.jks -Djavax.net.ssl.trustStorePassword=clientpass SSLPoke localhost 8443

and also I have successfully performed WADO request:

  JAVA_OPTS="-Djavax.net.ssl.keyStore=client.p12 -Djavax.net.ssl.keyStorePassword=clientpass -Djavax.net.ssl.keyStoreType=pkcs12 -Djavax.net.ssl.trustStore=client.truststore.jks -Djavax.net.ssl.trustStorePassword=clientpass" dcmwado https://localhost:8443/wado -dcm -nostore -uid ...

пятница, 19 февраля 2016 г., 13:36:29 UTC+5 пользователь Nicolas Roduit написал: