SSL invalid certificate, may need to cross-certify

问题

We have an WebService and provide WSDL to our customers. All customers (there are hundreds) have no problem with our service except one who is using Lotus Notes. When their code trying to connect to our service the issue is thrown back. Here is a log.

I tried to import certificate to Notes JVM (cacerts). Did not help. I tried to disable veritifcation of certificate - did not help as well.

Certificate is GlobalSign

Lotus Notes 9.x. I'm using Java Agent to test WSDL.

Any idea what I have to do?

Error connecting to 'api.mywebiste.com' on port '443', SSL invalid certificate, may need to cross-certify.
    at lotus.domino.axis.InternalFault.makeFault(Unknown Source)
    at lotus.domino.axis.transport.http.HTTPSender.invoke(Unknown Source)
    at lotus.domino.axis.strategies.InvocationStrategy.visit(Unknown Source)
    at lotus.domino.axis.SimpleChain.doVisiting(Unknown Source)
    at lotus.domino.axis.SimpleChain.invoke(Unknown Source)
    at lotus.domino.axis.client.AxisClient.invoke(Unknown Source)
    at lotus.domino.axis.client.Call.invokeEngine(Unknown Source)
    at lotus.domino.axis.client.Call.invoke(Unknown Source)
    at lotus.domino.axis.client.Call.invoke(Unknown Source)
    at lotus.domino.axis.client.Call.invoke(Unknown Source)
    at lotus.domino.axis.client.Call.invoke(Unknown Source)
    at lotus.domino.websvc.client.Call.invoke(Unknown Source)
    at com.e_conomic.EconomicWebServiceSoapStub.connect(EconomicWebServiceSoapStub.java:9032)
    at JavaAgent.NotesMain(JavaAgent.java:20)
    at lotus.domino.AgentBase.runNotes(Unknown Source)
    at lotus.domino.NotesThread.run(Unknown Source)
Caused by: Error connecting to 'api.mywebiste.com' on port '443', SSL invalid certificate, may need to cross-certify.
    at lotus.domino.axis.transport.http.NotesSocket.<init>(Unknown Source)
    at lotus.domino.axis.transport.http.HTTPSender.getSocket(Unknown Source)

回答1:

So the main error is this.

SSL invalid certificate, may need to cross-certify.

In order for Notes to correctly recognise the SSL certificate you also need to ensure that the whole SSL chain is imported as well. On top of this it has to be cross certified with your organisations certificate (or the users personal certificate).

The following details how to do this for the server for R9.

https://serverfault.com/questions/505273/java-certificateexception-in-domino-9-when-trying-to-access-https-url/515189#515189

It should be somewhat similar process for the local client. You open the personal NAB and go to the advanced->certificates view.

回答2:

Not sure if it is related but there is an issue with Notes9 supporting SHA-2.

There is a workaround for Windows based servers. Here is IBM's post on the matter.

来源：https://stackoverflow.com/questions/25727441/ssl-invalid-certificate-may-need-to-cross-certify