Websphere Application Server 應用訪問微信公眾開放平臺 https 連結錯誤
在 WAS 佈署微信公眾開放平臺釋出開發包時，發現在原來在 Tomcat 下執行正常的呼叫 https 介面報出瞭如下錯誤：
javax.net.ssl.SSLHandshakeException: com.ibm.jsse2.util.j: PKIX path building failed:java.security.cert.CertPathBuilderException: PKIXCertPathBuilderImpl could not build a valid CertPath.; internal cause is:java.security.cert.CertPathValidatorException: The certificate issued by OU=Equifax Secure Certificate Authority, O=Equifax, C=US is not trusted; internal cause is: java.security.cert.CertPathValidatorException: Certificate chaining error
原因：WAS 採用了更嚴格的SSL訪問機制，需要事先將微信證書進行匯入。
解決辦法：將要訪問網站的 SSL 證書匯入到 WAS.
1. 開啟管理控制檯 【Security】 轉到 【SSL certificate and key management】；
2. 點選右側 【Key stores and certificates】 選擇列表中的 【NodeDefaultTrustStore】，在新彈出介面上點選右側 【Signer certificates】；
3. 在 Signer certificates 頁面上點選表格上部的【Retrieve from port button】；
4. 在配置介面中輸入 Host, Post, Alias, 例如：微信介面URL為 https://api.weixin.qq.com/.... 所以主機：api.weixin.qq.com 埠：443 別名起為：WeixinHttps
5. 點選【Retrieve signer information】，獲取資訊；
6. 成功後點擊【OK】；
7. 然後根據頂部提示將變更儲存到主配置檔案中。 【Save changes directly to master configuration】
8. 重新啟動 WAS
Add SSL certificate to trust store in WebSphere Application Server with exporting the certificate.
-
Open Admin console under Security go to SSL
certificate and key management
- Go to Key stores and certificates > CellDefaultTrustStore > Signer certificates
- On signer certificates page click Retrieve from port button
- Enter Host, and other information to import the SSL certificate
- Click on Retrieve signer information
- Click OK
- Save changes directly to master configuration
- Restart WAS