WSO2 APIM 2.0アクセストークンを生成するときのクラスタリングデプロイメントの問題

Question

1台のサーバーに2台のkeymanagerノード、2台のpub-storeノード、1台のゲートウェイマネージャノードと2台のゲートウェイワーカーノードを配備し、負荷分散のためにnginxを配備しました。私は、アプリケーションのアクセストークンを生成しようとすると、エラーの下に報告：

2016-08-29 03:10:59,558 [-] [http-nio-9443-exec-5] ERROR subscription-add:jag org.jaggeryjs.scriptengine.exceptions.ScriptException: Error while obtaining the application access token for the application:DefaultApplication 
2016-08-29 03:29:37,439 [-] [http-nio-9443-exec-45] ERROR AMDefaultKeyManagerImpl Error while creating tokens - sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target 
javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target 
    at sun.security.ssl.Alerts.getSSLException(Alerts.java:192) 
    at sun.security.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1949) 
    at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:302) 
    at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:296) 
    at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1509) 
    at sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:216) 
    at sun.security.ssl.Handshaker.processLoop(Handshaker.java:979) 
    at sun.security.ssl.Handshaker.process_record(Handshaker.java:914) 
    at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1062) 
    at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1375) 
    at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1403) 
    at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1387) 
    at org.apache.http.conn.ssl.SSLSocketFactory.connectSocket(SSLSocketFactory.java:533) 
    at org.apache.http.conn.ssl.SSLSocketFactory.connectSocket(SSLSocketFactory.java:401) 
    at org.apache.http.impl.conn.DefaultClientConnectionOperator.openConnection(DefaultClientConnectionOperator.java:178) 
    at org.apache.http.impl.conn.AbstractPoolEntry.open(AbstractPoolEntry.java:144) 
    at org.apache.http.impl.conn.AbstractPooledConnAdapter.open(AbstractPooledConnAdapter.java:131) 
    at org.apache.http.impl.client.DefaultRequestDirector.tryConnect(DefaultRequestDirector.java:610) 
    at org.apache.http.impl.client.DefaultRequestDirector.execute(DefaultRequestDirector.java:445) 
    at org.apache.http.impl.client.AbstractHttpClient.doExecute(AbstractHttpClient.java:863) 
    at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:82) 
    at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:106) 
    at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:57) 
    at org.wso2.carbon.apimgt.impl.AMDefaultKeyManagerImpl.getNewApplicationAccessToken(AMDefaultKeyManagerImpl.java:360) 
    at org.wso2.carbon.apimgt.impl.APIConsumerImpl.renewAccessToken(APIConsumerImpl.java:867) 
    at org.wso2.carbon.apimgt.impl.UserAwareAPIConsumer.renewAccessToken(UserAwareAPIConsumer.java:36) 
    at org.wso2.carbon.apimgt.hostobjects.APIStoreHostObject.jsFunction_refreshToken(APIStoreHostObject.java:4120) 
... 
Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target 
    at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:387) 
    at sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:292) 
    at sun.security.validator.Validator.validate(Validator.java:260) 
    at sun.security.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:324) 
    at sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:229) 
    at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:124) 
    at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1491) 
    ... 90 more 
Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target 
    at sun.security.provider.certpath.SunCertPathBuilder.build(SunCertPathBuilder.java:141) 
    at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:126) 
    at java.security.cert.CertPathBuilder.build(CertPathBuilder.java:280) 
    at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:382) 

とパブ・ストア・ノードでは、私は、キーの検証のためにWSClientを使用して

<AuthManager> 
    <!-- Server URL of the Authentication service --> 
    <ServerURL>https://km.devzone.com/services/</ServerURL> 
    <!-- Admin username for the Authentication manager. --> 
    <Username>${admin.username}</Username> 
    <!-- Admin password for the Authentication manager. --> 
    <Password>${admin.password}</Password> 
    <!-- Indicates whether the permissions checking of the user (on the Publisher and Store) should be done 
     via a remote service. The check will be done on the local server when false. --> 
    <CheckPermissionsRemotely>false</CheckPermissionsRemotely> 
</AuthManager> 

可能コンフィグの問題は何を使用しましたか？

Answer 1

これは、ストアトラストストアにkeymanger証明書がない場合に発生します。これを修正するには、Keymanagerノードのjksファイルから公開証明書をエクスポートし、ストアノードのclient-truststore.jksにインポートします。