Getting the Error : SSLException :End user tried to act as a CA in WAS

shyamsundar1.g · #1 (**permalink**) 07-01-2009, 01:33 AM

I have a web service application running in WAS 5.1 and client application running in WAS 6.1.
We use server side authentication and we have configured the trust store keystore on the client side.

But when we try to invoke the wenservice i get the error "SSLException :End user tried to act as a CA".

Kindly let me know the possibility of this error.

Thanks In advance
Shyam.

Steve11235 · #2 (**permalink**) 07-01-2009, 08:24 AM

This is just a guess, but it sounds like the client is running on the same server as the "Certificate Authority". The CA is supposed to be an independent third party. A simple attack would be to run a dummy CA service on the client machine to "authenticate" the client.

The obvious solution is to move the CA server to another instance of WAS, but that may not be practicable. The WAS 5.1 server might be convinced to overlook the situation...

shyamsundar1.g · #3 (**permalink**) 07-01-2009, 08:30 PM

Hi Steve,thanks for your reply.The client is running on different WAS server and Web service is running on different server.I believe the CA server is in different machine from client.

Do you have any other idea to debug the issue.

Steve11235 · #4 (**permalink**) 07-02-2009, 01:48 PM

Quote:

We use server side authentication and we have configured the trust store keystore on the client side.

This is what I was getting at...