My Services WebSphere Training | JEE Build & Deploy | Automatic Linux Provisioning
Select webserver1 and apply it to the web module of the application as shown below. This will create a URI for the Plugin to map requests from IHS to the Web Application running in Websphere. Click OK and save changes to complete. We are now going to tell WebSphere to re-generate the Plugin and propagate to IHS. One gain navigate to the Web Server’s list screen and then click Generate Plug-in, and then Click Propagate Plugin. Note: Propagate in our example means the DMgr’s version of the Plugin-Cfg.xml is copied to the appropriate location where IHS is looking for the Plugin. /var/apps/wasnd7/profiles/Dmgr01/config/cells/localhostCell01/nodes/localhostNode01/servers/webserver1/plugin-cfg.xml Is copied to: /var/apps/ihs6/Plugins/config/webserver1/plugin-cfg.xml on the Web server computer We can now go and look at the updated Plugin-Cfg.xml file in IHS. Type the command: view /var/apps/ihs6/P lugins/config/webserver1/plugin-cfg.xml Below is a snippet of the plugin-cfg.xml file <Config ASDisableNagle="false" AcceptAllContent="false" AppServerPortPreference="WebserverPort" ChunkedResponse="false" FIPSEnable="false" IISDisableNagle="false" IISPluginPriority="High" IgnoreDNSFailures="false" RefreshInterval="60" ResponseChunkSize="64" VHostMatchingCompat="false"> <Log LogLevel="Error" Name="/var/apps/ihs6/Plugins/logs/webserver1/http_plugin.log"/> <Property Name="ESIEnable" Value="true"/> <Property Name="ESIMaxCacheSize" Value="1024"/> <Property Name="ESIInvalidationMonitor" Value="false"/> <Property Name="ESIEnableToPassCookies" Value="false"/> <Property Name="PluginInstallRoot" Value="/var/apps/ihs6/Plugins/"/> <VirtualHostGroup Name="default_host"> <VirtualHost Name="*:9080"/> <VirtualHost Name="*:80"/> <VirtualHost Name="*:9443"/> <VirtualHost Name="*:5060"/> <VirtualHost Name="*:5061"/> <VirtualHost Name="*:443"/> <VirtualHost Name="*:9061"/> <VirtualHost Name="*:9044"/> <VirtualHost Name="*:9062"/> <VirtualHost Name="*:9081"/> <VirtualHost Name="*:9444"/> <VirtualHost Name="*:9045"/> </VirtualHostGroup> <ServerCluster CloneSeparatorChange="false" GetDWLMTable="false" IgnoreAffinityRequests="true" LoadBalance="Round Robin" Name="cluster01" PostBufferSize="64" PostSizeLimit="-1" RemoveSpecialHeaders="true" RetryInterval="60"> <Server CloneID="14f9snmv4" ConnectTimeout="5" ExtendedHandshake="false" LoadBalanceWeight="2" MaxConnections="-1" Name="localhostNode01_server01" ServerIOTimeout="60" WaitForContinue="false"> <Transport Hostname="localhost" Port="9080" Protocol="http"/> <Transport Hostname="localhost" Port="9443" Protocol="https"> <Property Name="keyring" Value="/var/apps/ihs6/Plugins/config/webserver1/plugin-key.kdb"/> <Property Name="stashfile" Value="/var/apps/ihs6/Plugins/config/webserver1/plugin-key.sth"/> </Transport> </Server> <Server CloneID="14f9snv2s" ConnectTimeout="5" ExtendedHandshake="false" LoadBalanceWeight="2" MaxConnections="-1" Name="localhostNode01_server02" ServerIOTimeout="60" WaitForContinue="false"> <Transport Hostname="localhost" Port="9081" Protocol="http"/> <Transport Hostname="localhost" Port="9444" Protocol="https"> <Property Name="keyring" Value="/var/apps/ihs6/Plugins/config/webserver1/plugin-key.kdb"/> <Property Name="stashfile" Value="/var/apps/ihs6/Plugins/config/webserver1/plugin-key.sth"/> </Transport> </Server> <PrimaryServers> <Server Name="localhostNode01_server01"/> <Server Name="localhostNode01_server02"/> </PrimaryServers> </ServerCluster> <UriGroup Name=" default_host_cluster01_URIs "> <Uri AffinityCookie="JSESSIONID" AffinityURLIdentifier="jsessionid" Name="/snoop/* "/> <Uri AffinityCookie="JSESSIONID" AffinityURLIdentifier="jsessionid" Name="/hello"/> <Uri AffinityCookie="JSESSIONID" AffinityURLIdentifier="jsessionid" Name="/hitcount"/> <Uri AffinityCookie="JSESSIONID" AffinityURLIdentifier="jsessionid" Name="*.jsp"/> <Uri AffinityCookie="JSESSIONID" AffinityURLIdentifier="jsessionid" Name="*.jsv"/> <Uri AffinityCookie="JSESSIONID" AffinityURLIdentifier="jsessionid" Name="*.jsw"/> <Uri AffinityCookie="JSESSIONID" AffinityURLIdentifier="jsessionid" Name="/j_security_check"/> <Uri AffinityCookie="JSESSIONID" AffinityURLIdentifier="jsessionid" Name="/ibm_security_logout"/> <Uri AffinityCookie="JSESSIONID" AffinityURLIdentifier="jsessionid" Name="/servlet/*"/> </UriGroup> <Route ServerCluster="cluster01" UriGroup=" default_host_cluster01_URIs " VirtualHostGroup=" default_host "/> You see by reviewing the setting in red/bod that the Plugin uses the XML to determine routing paths for http traffic. Because our cluster has two application servers, workload management will occur via the Plugin and Websphere and so each HTTP request on port 80 from IHS will route in a round robin fashion to each of clones i.e. 9080, then 9081, then 9080, then 9081 etc. We can now restart IHS and test the snoop servlet can be accessed via port 80. When we navigate to snoop using the URL we used previously in the article we can scroll down to see which application server is loading the servlet. The snippet below shows the initial server being server01. If you refresh the browser the snoop servlet will be reloaded and the Plugin will “workload manage” between the clones of our cluster. Since we have two clones in our cluster the next server will be server02. The screen capture below shows an example of server02 being hit. We have now achieved workload management using IHS, the WebSphere Plugin and two clones within a single WebSphere cluster. Configuring SSL for IBM HTTP Server (IHS) What we now want to do is get to the heart of this article and configure IHS to accept SSL. This will allow client browsers to use HTTP/S with IHS. First we need to run the IHS ikeyman utility to generate a new self signed certificate. This tool requires XWindows to be running for this demo as we are using the Graphical interface. <ihs_root>/bin/ ikeyman When IBM Ikey Management tool has loaded click Key Database File >> New from the menu as shown below Select CMS as The Key database type Then click OK and you will be prompted for password to secure your new key ring as shown below. Click “OK” and you will be reminded that a stash file has been created. This file will be used later by IHS to gain access to the key ring. To create a new self-signed certificate you need to select Personal Certificates from the Certificate Type drop down as shown in the image below and then click the New Self Signed button to start the creation of a new self signed certificate. You will prompt to fill in the certificate details as seen below. This can be as detailed as you like. Ensure you use a label that you can recognise if there were more than one in your key ring. Click “OK” to generate the certificate; you will see it listed when you return to the main panel. Tip: As shown below it is a good habit to ensure that you have saved the current password to your stash file before exiting the key ring. You can now exit the ikeyman tool What we now need to do is add a virtual host to the IBM HTTP Server configuration so that we can use SSL. ./apachectl stop If you get the following error [Sun Sep 20 17:58:49 2009] [error] (EAI 2)Name or service not known: Failed to resolve server name for 192.168.0.91 (check DNS) -- or specify an explicit ServerName It is because I am using a virtual server and it cannot resolve the ip address to fix it I add this line to /etc/hosts 192.168.0.61 localhost.localdomain localhost Configuring The httpd.conf file for SSL Below is an example of a virtual server that facilitates SSL. I will not go into detail as this information is freely available on my site and also other Apache sites. Listen 192.168.0.9:443 <VirtualHost 192.168.0.91:443> DocumentRoot "/var/apps/ihs6/htdocs/en_US" SSLEnable SSLServerCert IHS_SSL_Key KeyFile "/var/apps/ihs6/bin/key.kdb" ErrorLog logs/https-error_log SSLV2Timeout 100 SSLV3Timeout 1000 </VirtualHost> If you restart IBM HTTP Server, you will now be able to access IHS via SSL. We will now test… If we then try to navigate to https://<hostname>/snoop we wi lget the following 500 error. This error can only be resolved by fixes to the Web server software. It is not a client-side problem. It is up to the operators of the Web server site to locate and analyze the logs which should give further information about the error. OK, IBM HTTP Server is reporting a problem, let’s look at the logs. By looking into the Plugin logs which are located in /var/apps/ihs6/Plugins/logs/webserver1 as per our configuration of the Plugin previously. You can see in red below that the application cannot be found on this request. [Sun Sep 20 19:13:12 2009] 0000748b 06d2eb90 - ERROR: lib_stream: openStream: Failed in r_gsk_secure_soc_init: GSK_ERROR_BAD_CERT(gsk rc = 414) [Sun Sep 20 19:13:12 2009] 0000748b 06d2eb90 - ERROR: ws_common: websphereGetStream: Could not open stream [Sun Sep 20 19:13:12 2009] 0000748b 06d2eb90 - ERROR: ws_common: websphereExecute: Failed to create the stream [Sun Sep 20 19:13:12 2009] 0000748b 06d2eb90 - ERROR: ws_server: serverSetFailoverStatus: Marking localhostNode01_server02 down [Sun Sep 20 19:13:12 2009] 0000748b 06d2eb90 - ERROR: ws_common: websphereHandleRequest: Failed to execute the transaction to 'localhostNode01_server02'on host 'localhost'; will try another one [Sun Sep 20 19:13:12 2009] 0000748b 06d2eb90 - ERROR: lib_stream: openStream: Failed in r_gsk_secure_soc_init: GSK_ERROR_BAD_CERT(gsk rc = 414) [Sun Sep 20 19:13:12 2009] 0000748b 06d2eb90 - ERROR: ws_common: websphereGetStream: Could not open stream [Sun Sep 20 19:13:12 2009] 0000748b 06d2eb90 - ERROR: ws_common: websphereExecute: Failed to create the stream [Sun Sep 20 19:13:12 2009] 0000748b 06d2eb90 - ERROR: ws_server: serverSetFailoverStatus: Marking localhostNode01_server01 down [Sun Sep 20 19:13:12 2009] 0000748b 06d2eb90 - ERROR: ws_common: websphereHandleRequest: Failed to execute the transaction to 'localhostNode01_server01'on host 'localhost' ; will try another one [Sun Sep 20 19:13:12 2009] 0000748b 06d2eb90 - ERROR: ws_common: websphereWriteRequestReadResponse: Failed to find an app server to handle this request [Sun Sep 20 19:13:12 2009] 0000748b 06d2eb90 - ERROR: ESI: getResponse: failed to get response: rc = 2 [Sun Sep 20 19:13:12 2009] 0000748b 06d2eb90 - ERROR: ws_common: websphereHandleRequest: Failed to handle request The reason is that IHS does not know how to speak to WeSphere via SSL. Configure SSL Between IHS and WebSphere Web Container Navigate to the Web Server Definition in the admin console and click to edit the configuration. The plug-in keyring file is propagated from /var/apps/wasnd7/profiles/Dmgr01/config/cells/localhostCell01/nodes/localhostNode01/servers/webserver1/plugin-key.kdb to /var/apps/ihs6/Plugins/config/webserver1/plugin-key.kdb on the Web server computer. Note: You can also change the default password by clicking manage certificates. The default password just like in previous versions is WebAS. The plugin-key.kdb (Key Ring) and plugin-in.sth (Password stash) are now updated on the webserver1 definition as shown the file system image below. We can now restart IHS and when you load snoop via SSL, you will get a screen similar to the following below. As you can see above the port for IHS is 443 which is what the client is using, however the application is being served by port 9443 which is the SSL port of the application servers Web Container. If we refresh the browser, we will see that the local port changes to 9444 as seen below. This is because the Plugin is facilitating Workload Management because we are using Websphere ND Clustering which has two application server clones. This concludes the lesson on how easy it is to now set-up SSL between IBM HTTP Server and WebSphere. In previous version of WebSphere this was so much more complicated and I am sure many WebSphere administrators will be happy about how simple it is now. Another cool thing is that the entire installation and configuration process can be automated with a response files, a little scripting and some Jython. I hope that this document has helped you understand more about configuring SSL between IBM HTTP Server and WebSphere Application Server. If you ever need any help, email me on steve.robinson@webspheretools.com Your friend, Steve Robinson
Extra Information A new feature of WebSphere 7 is that you can also have the admin console generate IHS virtual servers. These next few slides are for reference and are not required in our demonstrations. As sown above we are going to configure the Virtual server definition for this WebServer. Click New as shown below. As shown below, on the Virtual host screen we need to select Name-based or IP-based virtual host. Then click Next.
Steve Robinson has been working in IT for over 15 years and has provided solutions for many large-enterprise corporate companies across the world. Steve specialises in Java and Middleware consulting. Steve comes from both an administration and development background.
Before moving to JEE, Steve was an accomplished developer and consultant for both IBM Lotus Notes and Microsoft .NET Technologies.
Follow Steve as @stevencrobinson on twitter.
IBM WebSphere Application Server 8.0 Administration Guide
WebSphere Application Server 7.0 Administration Guide