title: How I can correctly import this remote server certifcate (.crt file) in order to perform an HTTPS request from WSO2 ESB application?
body: <p>I am absolutly new in <strong>WSO2 ESB</strong> and I am going crazy trying to correctly implement an <strong>HTTPS POST</strong> call from an implemented API. It seems that I have some problem related to the <strong>SSL certificate</strong> that I can't resolve.</p>
  
  <p>So basically I have the following situation:</p>
  
  <p>from my bash shell I can perform a <strong>CURL</strong> call toward a remote webservice exposed on <strong>HTTPS</strong> passing to its certificate into the related <strong>.crt</strong> file (I have obtained this certificate file exporting it from Firefox):</p>
  
  <pre><code>$ curl --cacert 52708968.crt https://XX.YY.ZZ.WW/myProject/xml/manager
    % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                   Dload  Upload   Total   Spent    Left  Speed
  100   129  100   129    0     0    201      0 --:--:-- --:--:-- --:--:--   201&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;response&gt;&lt;error&gt;XML document does not appear to begin with "&amp;lt;?xml"&lt;/error&gt;&lt;/response&gt;
  </code></pre>
  
  <p>As you ca see it works because I am obtaining the expected response without any problem.</p>
  
  <p>Ok, so in my <strong>WSO2 ESB</strong> project I have created the endpoint pointing to this URL: <strong><a href="https://XX.YY.ZZ.WW/myProject/xml/manager" rel="nofollow noreferrer">https://XX.YY.ZZ.WW/myProject/xml/manager</a></strong>.</p>
  
  <p>Then I defined my API in this way (saved into <strong>RegisterReourceAPI.xml</strong> file of my project):</p>
  
  <pre><code>&lt;?xml version="1.0" encoding="UTF-8"?&gt;
  &lt;api context="/registerResource" name="RegisterResourceAPI" xmlns="http://ws.apache.org/ns/synapse"&gt;
      &lt;resource methods="GET" uri-template="/registerResource/"&gt;
          &lt;inSequence&gt;
              &lt;log description="Request Log" level="custom"&gt;
                  &lt;property name="message" value="&amp;quot;Welcome to Resource Registration Service&amp;quot;"/&gt;
              &lt;/log&gt;
              &lt;send&gt;
                  &lt;endpoint key="QueryWsEP"/&gt;
              &lt;/send&gt;
          &lt;/inSequence&gt;
          &lt;outSequence&gt;
              &lt;send/&gt;
          &lt;/outSequence&gt;
          &lt;faultSequence/&gt;
      &lt;/resource&gt;
  &lt;/api&gt;
  </code></pre>
  
  <p>So to starts the execution flow I have to perform this request into my shell:</p>
  
  <pre><code>curl -v http://localhost:8280/registerResource/registerResource/
  </code></pre>
  
  <p>But doing so I obtain the following error:</p>
  
  <p>1) Into the shell where I perform the CURL call I obtain this timeout:</p>
  
  <pre><code>$ curl -v http://localhost:8280/registerResource/registerResource/
  * timeout on name lookup is not supported
  *   Trying ::1...
  * TCP_NODELAY set
    % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                   Dload  Upload   Total   Spent    Left  Speed
    0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0*   Trying 127.0.0.1...
  * TCP_NODELAY set
  * Connected to localhost (127.0.0.1) port 8280 (#0)
    0     0    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0&gt; GET /registerResource/registerResource/ HTTP/1.1
  &gt; Host: localhost:8280
  &gt; User-Agent: curl/7.53.0
  &gt; Accept: */*
  &gt;
    0     0    0     0    0     0      0      0 --:--:--  0:03:00 --:--:--     0* Empty reply from server
    0     0    0     0    0     0      0      0 --:--:--  0:03:00 --:--:--     0
  * Connection #0 to host localhost left intact
  curl: (52) Empty reply from server
  </code></pre>
  
  <p>2) Into the <strong>WSO2 ESB</strong> console I obtain this exception:</p>
  
  <pre><code>[2017-03-13 12:24:31,276]  INFO - LogMediator message = "Welcome to Resource Registration Service"
  [2017-03-13 12:24:31,284]  INFO - TimeoutHandler This engine will expire all callbacks after GLOBAL_TIMEOUT: 120 seconds, irrespective of the timeout action, after the specified or optional timeout
  [2017-03-13 12:24:31,564] ERROR - TargetHandler I/O error: handshake alert:  unrecognized_name
  javax.net.ssl.SSLProtocolException: handshake alert:  unrecognized_name
      at sun.security.ssl.ClientHandshaker.handshakeAlert(Unknown Source)
      at sun.security.ssl.SSLEngineImpl.recvAlert(Unknown Source)
      at sun.security.ssl.SSLEngineImpl.readRecord(Unknown Source)
      at sun.security.ssl.SSLEngineImpl.readNetRecord(Unknown Source)
      at sun.security.ssl.SSLEngineImpl.unwrap(Unknown Source)
      at javax.net.ssl.SSLEngine.unwrap(Unknown Source)
      at org.apache.http.nio.reactor.ssl.SSLIOSession.doUnwrap(SSLIOSession.java:245)
      at org.apache.http.nio.reactor.ssl.SSLIOSession.doHandshake(SSLIOSession.java:280)
      at org.apache.http.nio.reactor.ssl.SSLIOSession.isAppInputReady(SSLIOSession.java:410)
      at org.apache.http.impl.nio.reactor.AbstractIODispatch.inputReady(AbstractIODispatch.java:119)
      at org.apache.http.impl.nio.reactor.BaseIOReactor.readable(BaseIOReactor.java:159)
      at org.apache.http.impl.nio.reactor.AbstractIOReactor.processEvent(AbstractIOReactor.java:338)
      at org.apache.http.impl.nio.reactor.AbstractIOReactor.processEvents(AbstractIOReactor.java:316)
      at org.apache.http.impl.nio.reactor.AbstractIOReactor.execute(AbstractIOReactor.java:277)
      at org.apache.http.impl.nio.reactor.BaseIOReactor.execute(BaseIOReactor.java:105)
      at org.apache.http.impl.nio.reactor.AbstractMultiworkerIOReactor$Worker.run(AbstractMultiworkerIOReactor.java:586)
      at java.lang.Thread.run(Unknown Source)
  [2017-03-13 12:24:31,603]  WARN - EndpointContext Endpoint : QueryWsEP with address https://XX.YY.ZZ.WW/MYPROJECT/xml/manager will be marked SUSPENDED as it failed
  [2017-03-13 12:24:31,604]  WARN - EndpointContext Suspending endpoint : QueryWsEP with address https://XX.YY.ZZ.WW/MYPROJECT/xml/manager - current suspend duration is : 30000ms - Next retry after : Mon Mar 13 12:25:01 CET 2017
  [2017-03-13 12:27:31,317]  WARN - SourceHandler Connection time out after request is read: http-incoming-1 Socket Timeout : 180000 Remote Address : /127.0.0.1:52188
  </code></pre>
  
  <p>So I have found this tutorial: <a href="http://yasassriratnayake.blogspot.it/2016/04/how-to-get-rid-of-handshake-alert.html" rel="nofollow noreferrer">http://yasassriratnayake.blogspot.it/2016/04/how-to-get-rid-of-handshake-alert.html</a></p>
  
  <p>that simply says to add <strong>-Djsse.enableSNIExtension=false</strong> to the <strong>JVM property</strong>. So I have add it into the server VM-arguments into Eclipse server settings:</p>
  
  <p><a href="https://i.stack.imgur.com/ETwZu.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/ETwZu.png" alt="enter image description here"></a></p>
  
  <p>Performing again the CURL call to execute the ESB application flow now I obtain these different exceptions:</p>
  
  <pre><code>[2017-03-14 13:05:58,883]  INFO - LogMediator message = "Welcome to Resource Registration Service"
  [2017-03-14 13:05:58,891]  INFO - TimeoutHandler This engine will expire all callbacks after GLOBAL_TIMEOUT: 120 seconds, irrespective of the timeout action, after the specified or optional timeout
  [2017-03-14 13:06:03,788] ERROR - TargetHandler I/O error: General SSLEngine problem
  javax.net.ssl.SSLHandshakeException: General SSLEngine problem
      at sun.security.ssl.Handshaker.checkThrown(Unknown Source)
      at sun.security.ssl.SSLEngineImpl.checkTaskThrown(Unknown Source)
      at sun.security.ssl.SSLEngineImpl.writeAppRecord(Unknown Source)
      at sun.security.ssl.SSLEngineImpl.wrap(Unknown Source)
      at javax.net.ssl.SSLEngine.wrap(Unknown Source)
      at org.apache.http.nio.reactor.ssl.SSLIOSession.doWrap(SSLIOSession.java:237)
      at org.apache.http.nio.reactor.ssl.SSLIOSession.doHandshake(SSLIOSession.java:271)
      at org.apache.http.nio.reactor.ssl.SSLIOSession.isAppInputReady(SSLIOSession.java:410)
      at org.apache.http.impl.nio.reactor.AbstractIODispatch.inputReady(AbstractIODispatch.java:119)
      at org.apache.http.impl.nio.reactor.BaseIOReactor.readable(BaseIOReactor.java:159)
      at org.apache.http.impl.nio.reactor.AbstractIOReactor.processEvent(AbstractIOReactor.java:338)
      at org.apache.http.impl.nio.reactor.AbstractIOReactor.processEvents(AbstractIOReactor.java:316)
      at org.apache.http.impl.nio.reactor.AbstractIOReactor.execute(AbstractIOReactor.java:277)
      at org.apache.http.impl.nio.reactor.BaseIOReactor.execute(BaseIOReactor.java:105)
      at org.apache.http.impl.nio.reactor.AbstractMultiworkerIOReactor$Worker.run(AbstractMultiworkerIOReactor.java:586)
      at java.lang.Thread.run(Unknown Source)
  Caused by: javax.net.ssl.SSLHandshakeException: General SSLEngine problem
      at sun.security.ssl.Alerts.getSSLException(Unknown Source)
      at sun.security.ssl.SSLEngineImpl.fatal(Unknown Source)
      at sun.security.ssl.Handshaker.fatalSE(Unknown Source)
      at sun.security.ssl.Handshaker.fatalSE(Unknown Source)
      at sun.security.ssl.ClientHandshaker.serverCertificate(Unknown Source)
      at sun.security.ssl.ClientHandshaker.processMessage(Unknown Source)
      at sun.security.ssl.Handshaker.processLoop(Unknown Source)
      at sun.security.ssl.Handshaker$1.run(Unknown Source)
      at sun.security.ssl.Handshaker$1.run(Unknown Source)
      at java.security.AccessController.doPrivileged(Native Method)
      at sun.security.ssl.Handshaker$DelegatedTask.run(Unknown Source)
      at org.apache.http.nio.reactor.ssl.SSLIOSession.doRunTask(SSLIOSession.java:255)
      at org.apache.http.nio.reactor.ssl.SSLIOSession.doHandshake(SSLIOSession.java:293)
      ... 9 more
  Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
      at sun.security.validator.PKIXValidator.doBuild(Unknown Source)
      at sun.security.validator.PKIXValidator.engineValidate(Unknown Source)
      at sun.security.validator.Validator.validate(Unknown Source)
      at sun.security.ssl.X509TrustManagerImpl.validate(Unknown Source)
      at sun.security.ssl.X509TrustManagerImpl.checkTrusted(Unknown Source)
      at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(Unknown Source)
      ... 18 more
  Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
      at sun.security.provider.certpath.SunCertPathBuilder.build(Unknown Source)
      at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(Unknown Source)
      at java.security.cert.CertPathBuilder.build(Unknown Source)
      ... 24 more
  [2017-03-14 13:06:03,815]  WARN - EndpointContext Endpoint : QueryWsEP with address https://XX.YY.ZZ.WW/MYPROJECT/xml/manager will be marked SUSPENDED as it failed
  [2017-03-14 13:06:03,816]  WARN - EndpointContext Suspending endpoint : QueryWsEP with address https://XX.YY.ZZ.WW/MYPROJECT/xml/manager - current suspend duration is : 30000ms - Next retry after : Tue Mar 14 13:06:33 CET 2017
  </code></pre>
  
  <p>It seems that is something related certificate...as it can't find the certificate...so I think: "ok in the first CURL request you have manually added this certificate (the <strong>52708968.crt</strong> file), I have to add this certificate also into WSO2 ESB server".</p>
  
  <p>So I acces to the <strong>WSO2 ESB</strong> administraton panel (<a href="https://192.168.249.1:9443/carbon/" rel="nofollow noreferrer">https://192.168.249.1:9443/carbon/</a>) and:</p>
  
  <p>1) <strong>Keystore --> List</strong> and here I can found the <strong>wso2carbon.jks</strong> file:</p>
  
  <p><a href="https://i.stack.imgur.com/BesXK.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/BesXK.png" alt="enter image description here"></a></p>
  
  <p>2) Then I clicked on the <strong>Import Cert</strong> button to add my <strong>52708968.crt</strong> to this keystore and I have done:</p>
  
  <p><a href="https://i.stack.imgur.com/JPTXA.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/JPTXA.png" alt="enter image description here"></a></p>
  
  <p>3) So this cert seems to be correctly added to my keystore, infact now I can see in the cert list:</p>
  
  <p><a href="https://i.stack.imgur.com/rslwa.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/rslwa.png" alt="enter image description here"></a></p>
  
  <p>So the certificate to connect to the external web service via <strong>HTTPS</strong> should be imported.</p>
  
  <p>4) I restarted the server and I perform again the request that starts the <strong>WSO2 ESB application</strong> execution flows:</p>
  
  <pre><code>curl -v http://localhost:8280/registerResource/registerResource/
  </code></pre>
  
  <p>but I still obtain exactly the previous exceptions !!!</p>
  
  <p>How is it possible? The certificate is setted inside the keystore. What is wrong? What am I missing? How can I try to fix this issue?</p>