How to Resolve SSL Connection Issues Between Nginx on AWS and WebSphere AS with Java 6?

What should I do when SSL connection fails with no Certificate Request from the server while connecting to Nginx on AWS using WebSphere AS running Java 6?

SSL connection issues often arise due to incorrect configurations or incompatible protocol versions and ciphers. In this case, when connecting WebSphere Application Server (WAS) running Java 6 to Nginx on AWS, the error indicates that the server is not sending a Certificate Request, which is essential for a mutual SSL/TLS authentication setup.

# Nginx example configuration for SSL with client certificate verification
server {
    listen 443 ssl;
    server_name yourdomain.com;

    ssl_certificate /etc/ssl/certs/server.crt;
    ssl_certificate_key /etc/ssl/private/server.key;
    ssl_verify_client on;
    ssl_client_certificate /etc/ssl/certs/client_ca.crt;

    ssl_protocols TLSv1 TLSv1.1; # Ensure these are supported by Java 6
    ssl_ciphers HIGH:!aNULL:!MD5;
}

Causes

• Java 6 does not support modern SSL/TLS protocols (like TLS 1.2) by default, which can lead to negotiation failures.
• Nginx may not be correctly configured to request client certificates from SSL connections.
• Mismatched cipher suites between the client (WebSphere) and the server (Nginx).

Solutions

• Upgrade your Java environment to a more recent version that supports TLS 1.2 or higher, ideally Java 8 or above.
• Ensure Nginx is configured to require client certificates. This can be done by adding 'ssl_verify_client on;' in the server block of Nginx configuration.
• Specify a set of secure cipher suites in Nginx that are compatible with Java 6. Use 'ssl_ciphers' directive to set this up.

Mistake: Not enabling client certificate verification in the Nginx configuration.

Solution: Make sure to include 'ssl_verify_client on;' in your Nginx server configuration.

Mistake: Using outdated or insecure cipher suites.

Solution: Review and specify strong cipher suites in your Nginx configuration to ensure compatibility.