HowTo:Deploying Certificates with Cisco pxGrid:CA signed pxGrid client and self-signed ISE pxGrid node certificate

Transcription

1 使用 Cisco pxgrid 部署证书 证书颁发机构 (CA) 签名的 pxgrid 客户端和自签名的 ISE pxgrid 节点证书

2 目录 关于本文档... 3 简介... 4 证书配置示例... 5 自签名 ISE pxgrid 节点证书和 pxgrid 角色配置... 5 pxgrid 客户端证书配置... 8 测试 pxgrid 客户端和 ISE pxgrid 节点 查看密钥库条目 故障排除 思科系统公司第 2 页

3 关于本文档 本文档说明使用 CA 机构签名的证书和适用于 ISE pxgrid 节点的 ISE 中 ISE 自签名证书, 配置 pxgrid 客户端所需执行的配置步骤 本文档面向部署 Cisco pxgrid 的思科现场工程师 技术营销工程师 合作伙伴和客户 读者需要熟悉 pxgrid 如果读者不熟悉 pxgrid, 请参阅 Configure_and_Test_Integrion_with_Cisco_pxGrid.pdf: Configure_and_Test_Integrion_with_Cisco_pxGrid.pdf pxgrid sdk 可从思科客户团队获取 本文档假设已安装思科身份服务引擎 (ISE) 1.3 对于 pxgrid 客户端, 可以使用运行 OSX 的 MAC, 或者 Linux 操作系统 此外,pxGrid 客户端需要具备 Oracle Java Development Kit 7 或 8 在 使用证书部署 pxgrid 系列中还有两个文档 : 将 CA 签名的证书与 ISE pxgrid 节点和 pxgrid 客户端配合使用 将自签名证书与 ISE pxgrid 节点和 ISE pxgrid 客户端配合使用 2015 思科系统公司第 3 页

4 简介 本节详细说明在 ISE 独立部署中为 pxgrid 客户端和 ISE pxgrid 节点配置 CA 签名证书的过程 在这种情况下, pxgrid 客户端可能包含 Entrust 等公共 CA 签名的证书 请注意, 必须创建具有同时用于客户端身份验证 ( ) 和服务器身份验证 ( ) 的增强型密钥使用 (EKU) ISO 定义的对象标识符 (OID) 的自定义 pxgrid 模板 ISE pxgrid 节点包含 ISE 受信任证书库中的自签名 ISE 身份证书 Microsoft Enterprise CA 2008 R2 将用作签署 pxgrid 客户端证书的 CA 机构 Microsoft CA 提供的 CA root 证书将添加至 ISE 受信任证书库中 ISE 公用证书将添加至 pxgrid 客户端的密钥库 当 pxgrid 客户端连接到 ISE pxgrid 节点时, 为使 pxgrid 连接成功, 两个公共证书对于简单身份验证和安全层 (SASL) 而言都将是受信任的 下图显示证书信息流 2015 思科系统公司第 4 页

5 证书配置示例 下图显示本文档中使用的证书示例 自签名 ISE pxgrid 节点证书和 pxgrid 角色配置 此处, 我们将 ISE 自签名证书导入到 ISE 受信任证书库中 将 ISE 身份证书导入到受信任证书库中后, 可以在 ISE 节点上启用 pxgrid 角色, 并使其成为主节点 发布的节点将显示在 pxgrid Services View 中 步骤 1 导出自签名 ISE 身份证书并另存为.pem 文件 Administrion -> System -> Certifices -> select ISE identity cert -> Export( 仅公钥 ) 2015 思科系统公司第 5 页

6 步骤 2 将已保存的 ISE.pem 文件导入到 ISE 受信任证书库中 Administrion -> System -> Certifices -> Trusted Certifices -> Browse and upload file -> Submit 您将看到已导入的 ISE 受信任证书 2015 思科系统公司第 6 页

7 步骤 3 下载 CA root 证书并将其上传至 ISE 受信任证书库中, 然后启用 Trust for ISE communicion Administrion -> System -> Certifices -> Trusted Certifices -> Import & Upload the CA root certifice 步骤 4 在 ISE 中启用 pxgrid 角色 Administrion -> System -> Deployment -> Enable pxgrid -> Change role to Primary -> Save 注 : 无需将角色改为主用 2015 思科系统公司第 7 页

8 步骤 5 验证发布的服务是否已启动 Administrion -> pxgrid Services Note: 在 ISE 发布节点出现之前, 可能会有延迟 在启用 pxgrid 角色之前, 必须安装证书 pxgrid 客户端证书配置 本节逐步介绍 pxgrid 客户端自签名证书的生成过程 生成证书公钥 / 私钥对之后, 系统将根据私钥 self2.key 创建 PKCS12 文件 该 PKCS12 文件将导入到身份密钥库 self1.jks 中 此身份密钥库和关联的密码将用作 pxgrid 脚本中的 keystorefilename 和 keystorepassword pxgrid 客户端证书 self2.cer 也将被添加至身份密钥库 批量会话下载所需的 ISE 身份证书 isemnt 和 CA root 证书都将添加至信任密钥库 root.jks 中 此信任密钥库和关联的密码将用作 pxgrid 脚本中的 truststorefilename 和 truststorepassword 步骤 1 为 pxgrid 客户端生成私钥 ( 例如 self2.key) openssl genrsa -out self2.key 4096 Genering RSA prive key, 4096 bit long modulus e is (0x10001) 步骤 2 生成需要向 CA 机构提出的 CSR( 例如 self2.csr) 请求 提供质询密码 ( 例如 cisco123) openssl req -new -key self2.key -out self2.csr You are about to be asked to enter informion th will be incorpored into your certifice request. Wh you are about to enter is wh is called a Distinguished Name or a DN. There are quite a few fields but you can leave some blank For some fields there will be a default value, If you enter '.', the field will be left blank Country Name (2 letter code) [AU: Ste or Province Name (full name) [Some-Ste: Locality Name (eg, city) [: Organizion Name (eg, company) [Internet Widgits Pty Ltd: Organizional Unit Name (eg, section) [: 2015 思科系统公司第 8 页

9 Common Name (e.g. server FQDN or YOUR name) [: Address [: Please enter the following 'extra' tributes to be sent with your certifice request A challenge password [:cisco123 An optional company name [:Eppich,Inc 注 : 在本文档各处使用相同的密码可便于维护, 并减少错误 步骤 3 CA 机构必须使用包含增强型密钥使用 (EKU) ISO 定义的对象标识符 (OID) 的自定义模板 ( 例如 pxgrid) 来为用户证书提供服务, 其中一个对象标识符用于客户端身份验证, 另一个对象标识符用于服务器身份验证 注 : 已在 CA 机构中创建 pxgrid 模板 这是一个重复的用户模板, 采用 Windows 2003 格式, 显示于 Certifice Temple 下拉列表中 EKU 客户端身份验证和服务器身份验证都已添加至模板中 步骤 4 根据 pxgrid 客户端证书 ( 例如 self2.cer) 中的私钥创建一个 pxgrid 客户端.pkcs12 文件 ( 例如 self2.p12) 此文件将用于密钥库管理 其中包括 CA root 文件 ( 例如 ca_root.cer) openssl pkcs12 -export -out self2.p12 -inkey self2.key -in self2.cer -chain -CAfile ca_root.cer Enter Export Password: cisco123 Verifying - Enter Export Password: cisco123 Johns-MacBook-Pro:pxGridsdk jeppich$ 注 :cisco123 是本文档中使用的密码 2015 思科系统公司第 9 页

10 步骤 5 创建 pxgrid 客户端身份密钥库 ( 例如 self2.jks), 它将用作 pxgrid 脚本示例的 keystorefilename 和关联 keystorepassword keytool -importkeystore -srckeystore self2.p12 -destkeystore self2.jks -srcstoretype PKCS12 Enter destinion keystore password: cisco123 Re-enter new password: cisco123 Enter source keystore password: cisco123 Entry for alias 1 successfully imported. Import command completed: 1 entries successfully imported, 0 entries failed or cancelled 步骤 6 仅将公共 ISE 身份证书导出到 pxgrid 客户端中, 请注意导出文件将采用.pem 格式 您可以重命名扩展名为.pem 的文件, 使其更易于读取 在本示例中, 该文件已重命名为 isemnt.pem 步骤 7 将.pem 文件转换为.der 格式 openssl x509 -outform der -in isemnt.pem -out isemnt.der 步骤 8 将 ISE 身份证书添加至信任密钥库 ( 例如 root.jks) 中, 它将成为 pxgrid 脚本中使用的 truststorefilename 和关联的 truststorepassword keytool -import -alias mnt -keystore root.jks -file isemnt.der Enter keystore password: cisco123 Re-enter new password: cisco123 Owner: CN=ise.lab6.com Issuer: CN=ise.lab6.com Serial number: f ec27e53c1dd64f46 Valid from: Sun Dec 07 17:46:29 PST 2014 until: Mon Dec 07 17:46:29 PST 2015 Certifice fingerprints: MD5: 04:7D:67:04:EC:D2:F5:BC:DC:79:4D:0A:FF:62:09:FD SHA1: 5A:7B:02:E4:07:A1:D2:0B:7D:A5:AE:83:27:3B:E7:33:33:30:1E:32 SHA256: C4:21:6C:6F:5B:06:F3:2C:D7:26:35:CB:BE:2B:1B:FF:0E:EE:09:91:F6:B6:54:0C:6F:63:CB:43:1F:77:F2:37 Signure algorithm name: SHA1withRSA Version: 3 Extensions: #1: ObjectId: Criticality=false BasicConstraints:[ CA:true PhLen: 思科系统公司第 10 页

11 #2: ObjectId: Criticality=false ExtendedKeyUsages [ serverauth clientauth #3: ObjectId: Criticality=false KeyUsage [ DigitalSignure Key_Encipherment Key_Agreement Key_CertSign #4: ObjectId: Criticality=false NetscapeCertType [ SSL server #5: ObjectId: Criticality=false SubjectKeyIdentifier [ KeyIdentifier [ 0000: C4 F3 1A 9E 7B 1B 14 4F 51 9E A A AC...OQ...3.z. 0010: D4 u76. Trust this certifice? [no: yes Certifice was added to keystore Johns-MacBook-Pro:pxGridsdk jeppich$ 步骤 9 将 pxgrid 客户端证书导入到身份密钥库中 keytool -import -alias pxgridclient -keystore self2.jks -file self2.cer Enter keystore password: cisco123 Certifice already exists in keystore under alias <1> Do you still want to add it? [no: no Certifice was not added to keystroke 步骤 10 将 CA Root 证书添加至信任密钥库中 两个证书都需要驻留在信任密钥库中 keytool -import -alias root -keystore root.jks -file ca_root.cer Enter keystore password: cisco123 Owner: CN=lab6-WIN-BG7GPQ053ID-CA, DC=lab6, DC=com Issuer: CN=lab6-WIN-BG7GPQ053ID-CA, DC=lab6, DC=com Serial number: 448a6d6486c91cb14c6888c127d16c4e Valid from: Thu Nov 13 17:47:06 PST 2014 until: Wed Nov 13 17:57:06 PST 2019 Certifice fingerprints: MD5: 41:10:8A:F5:36:76:79:9C:2C:00:03:47:55:F8:CF:7B SHA1: 9D:DA:06:AF:06:3F:8F:5E:84:C7:F4:58:50:95:03:22:64:48:96:9F SHA256: DB:28:50:D6:47:CA:C0:6A:E9:7B:87:B4:0E:9C:3A:C1:A2:61:EA:D1:29:8B:45:B4:76:4B:DA:2A:F1:D8:E0:A3 Signure algorithm name: SHA256withRSA Version: 3 Extensions: #1: ObjectId: Criticality=false 0000: 思科系统公司第 11 页

12 #2: ObjectId: Criticality=true BasicConstraints:[ CA:true PhLen: #3: ObjectId: Criticality=false KeyUsage [ DigitalSignure Key_CertSign Crl_Sign #4: ObjectId: Criticality=false SubjectKeyIdentifier [ KeyIdentifier [ 0000: A9 C7 8E 26 9C F5 37 0A E6 5A D4 A &..7..Z.6& : 6A C8 79 2C j.y, Trust this certifice? [no: yes Certifice was added to keystore 步骤 11 将身份密钥库 ( 例如 self2.jks) 和信任密钥库 ( 例如 root.jks) 复制至 /samples/bin 文件夹 测试 pxgrid 客户端和 ISE pxgrid 节点 系统将运行样本 pxgrid 脚本 register.sh 和 session_download.sh 来确保 pxgrid 客户端连接和 pxgrid 注册 会话下载将确保 ISE MNT 证书和 pxgrid 客户端没有问题 步骤 1 注册 pxgrid 客户端./register.sh -keystorefilename self2.jks -keystorepassword cisco123 -truststorefilename root.jks - truststorepassword cisco123 -group Session -description test -hostname username JohnMACbook properties version=1.0.0 hostnames= username=johnmacbook descriptipon=test keystorefilename=self2.jks keystorepassword=cisco123 truststorefilename=root.jks truststorepassword=cisco registering... connecting... connected. done registering. connection closed 2015 思科系统公司第 12 页

13 步骤 2 运行会话下载./session_download.sh -keystorefilename self2.jks -keystorepassword cisco123 -truststorefilename root.jks - truststorepassword cisco123 -hostname username JohnMACbook properties version=1.0.0 hostnames= username=johnmacbook keystorefilename=self2.jks keystorepassword=cisco123 truststorefilename=root.jks truststorepassword=cisco123 filter=null start=null end=null connecting... connected. starting Wed Dec 10 09:55:36 PST session (ip= , Audit Session Id=0A B006E1086, User Name=jeppich, AD User DNS Domain=lab6.com, AD Host DNS Domain=null, AD User NetBIOS Name=LAB6, AD Host NETBIOS Name=null, Calling stion id=00:0c:29:d1:8d:90, Session ste= STARTED, Epsstus=null, Security Group=null, Endpoint Profile=VMWare-Device, NAS IP= , NAS Port=GigabitEthernet1/0/15, RADIUSAVPairs=[ Acct-Session- Id= , Posture Stus=null, Posture Timestamp=, Session Last Upde Time=Wed Dec 10 08:27:59 PST 2014 )... ending : Wed Dec 10 09:55:36 PST downloaded 1 sessions in 100 milliseconds connection closed 查看密钥库条目 通过查看密钥库条目, 可以查看身份和信任密钥库的受信任证书条目 keytool -list -v -keystore self2.jks Enter keystore password: Keystore type: JKS Keystore provider: SUN Your keystore contains 2 entries Alias name: isecert Creion de: Dec 10, 2014 Entry type: trustedcertentry Owner: CN=ise.lab6.com Issuer: CN=ise.lab6.com Serial number: f ec27e53c1dd64f46 Valid from: Sun Dec 07 17:46:29 PST 2014 until: Mon Dec 07 17:46:29 PST 2015 Certifice fingerprints: MD5: 04:7D:67:04:EC:D2:F5:BC:DC:79:4D:0A:FF:62:09:FD SHA1: 5A:7B:02:E4:07:A1:D2:0B:7D:A5:AE:83:27:3B:E7:33:33:30:1E:32 SHA256: C4:21:6C:6F:5B:06:F3:2C:D7:26:35:CB:BE:2B:1B:FF:0E:EE:09:91:F6:B6:54:0C:6F:63:CB:43:1F:77:F2:37 Signure algorithm name: SHA1withRSA Version: 3 Extensions: #1: ObjectId: Criticality=false BasicConstraints:[ 2015 思科系统公司第 13 页

14 CA:true PhLen: #2: ObjectId: Criticality=false ExtendedKeyUsages [ serverauth clientauth #3: ObjectId: Criticality=false KeyUsage [ DigitalSignure Key_Encipherment Key_Agreement Key_CertSign #4: ObjectId: Criticality=false NetscapeCertType [ SSL server #5: ObjectId: Criticality=false SubjectKeyIdentifier [ KeyIdentifier [ 0000: C4 F3 1A 9E 7B 1B 14 4F 51 9E A A AC...OQ...3.z. 0010: D4 u76. ******************************************* ******************************************* Alias name: 1 Creion de: Dec 10, 2014 Entry type: PriveKeyEntry Certifice chain length: 2 Certifice[1: Owner: O=Internet Widgits Pty Ltd, ST=Some-Ste, C=AU Issuer: CN=lab6-WIN-BG7GPQ053ID-CA, DC=lab6, DC=com Serial number: 6105dce a Valid from: Wed Dec 10 09:01:44 PST 2014 until: S Dec 10 09:11:44 PST 2016 Certifice fingerprints: MD5: 76:3E:43:48:A7:FD:2C:5B:A3:FD:76:3F:6E:DF:2D:B8 SHA1: A9:E4:66:D9:34:C6:62:67:2B:C0:AF:E1:68:83:EA:36:3D:2A:23:CC SHA256: 0E:D8:04:30:39:3E:0B:06:D5:3E:29:94:ED:C7:76:7A:5E:27:1C:14:CF:CD:1E:4D:10:AF:22:A7:54:E5:52:7B Signure algorithm name: SHA256withRSA Version: 3 Extensions: #1: ObjectId: Criticality=false 0000: E A F7 0D *.H : E A F7 0D *.H : B 0E A A * 0030: F7 0D H... #2: ObjectId: Criticality=false 0000: A B A : B A B : C 06 0A 2B : 37 0A #3: ObjectId: Criticality=false 0000: 30 2D B DC FD 1A 0-.% : 87 CB EB D 2D 86 E6 FC A y S : 5E 86 D1 B FC EF ^...#...@..d 思科系统公司第 14 页

15 #4: ObjectId: Criticality=false AuthorityInfoAccess [ [ accessmethod: caissuers accesslocion: URIName: ldap:///cn=lab6-win-bg7gpq053id- CA,CN=AIA,CN=Public%20Key%20Services,CN=Services,CN=Configurion,DC=lab6,DC=com?cACertifice?base?objectCla ss=certificionauthority #5: ObjectId: Criticality=false AuthorityKeyIdentifier [ KeyIdentifier [ 0000: A9 C7 8E 26 9C F5 37 0A E6 5A D4 A &..7..Z.6& : 6A C8 79 2C j.y, #6: ObjectId: Criticality=false CRLDistributionPoints [ [DistributionPoint: [URIName: ldap:///cn=lab6-win-bg7gpq053id-ca,cn=win- BG7GPQ053ID,CN=CDP,CN=Public%20Key%20Services,CN=Services,CN=Configurion,DC=lab6,DC=com?certificeRevoci onlist?base?objectclass=crldistributionpoint #7: ObjectId: Criticality=false CertificePolicies [ [CertificePolicyId: [ [ #8: ObjectId: Criticality=false ExtendedKeyUsages [ serverauth clientauth protection #9: ObjectId: Criticality=true KeyUsage [ DigitalSignure Key_Encipherment #10: ObjectId: Criticality=false SubjectKeyIdentifier [ KeyIdentifier [ 0000: 36 E2 1A 09 D D C3 6A 18 C1 C4 EB AE B5 6...QrM.j : E E.H9N Certifice[2: Owner: CN=lab6-WIN-BG7GPQ053ID-CA, DC=lab6, DC=com Issuer: CN=lab6-WIN-BG7GPQ053ID-CA, DC=lab6, DC=com Serial number: 448a6d6486c91cb14c6888c127d16c4e Valid from: Thu Nov 13 17:47:06 PST 2014 until: Wed Nov 13 17:57:06 PST 2019 Certifice fingerprints: MD5: 41:10:8A:F5:36:76:79:9C:2C:00:03:47:55:F8:CF:7B SHA1: 9D:DA:06:AF:06:3F:8F:5E:84:C7:F4:58:50:95:03:22:64:48:96:9F SHA256: DB:28:50:D6:47:CA:C0:6A:E9:7B:87:B4:0E:9C:3A:C1:A2:61:EA:D1:29:8B:45:B4:76:4B:DA:2A:F1:D8:E0:A3 Signure algorithm name: SHA256withRSA Version: 3 Extensions: #1: ObjectId: Criticality=false 0000: 思科系统公司第 15 页

16 #2: ObjectId: Criticality=true BasicConstraints:[ CA:true PhLen: #3: ObjectId: Criticality=false KeyUsage [ DigitalSignure Key_CertSign Crl_Sign #4: ObjectId: Criticality=false SubjectKeyIdentifier [ KeyIdentifier [ 0000: A9 C7 8E 26 9C F5 37 0A E6 5A D4 A &..7..Z.6& : 6A C8 79 2C j.y, ******************************************* ******************************************* keytool -list -v -keystore root.jks Enter keystore password: Keystore type: JKS Keystore provider: SUN Your keystore contains 2 entries Alias name: root Creion de: Dec 10, 2014 Entry type: trustedcertentry Owner: CN=lab6-WIN-BG7GPQ053ID-CA, DC=lab6, DC=com Issuer: CN=lab6-WIN-BG7GPQ053ID-CA, DC=lab6, DC=com Serial number: 448a6d6486c91cb14c6888c127d16c4e Valid from: Thu Nov 13 17:47:06 PST 2014 until: Wed Nov 13 17:57:06 PST 2019 Certifice fingerprints: MD5: 41:10:8A:F5:36:76:79:9C:2C:00:03:47:55:F8:CF:7B SHA1: 9D:DA:06:AF:06:3F:8F:5E:84:C7:F4:58:50:95:03:22:64:48:96:9F SHA256: DB:28:50:D6:47:CA:C0:6A:E9:7B:87:B4:0E:9C:3A:C1:A2:61:EA:D1:29:8B:45:B4:76:4B:DA:2A:F1:D8:E0:A3 Signure algorithm name: SHA256withRSA Version: 3 Extensions: #1: ObjectId: Criticality=false 0000: #2: ObjectId: Criticality=true BasicConstraints:[ CA:true PhLen: #3: ObjectId: Criticality=false KeyUsage [ DigitalSignure Key_CertSign Crl_Sign 2015 思科系统公司第 16 页

17 #4: ObjectId: Criticality=false SubjectKeyIdentifier [ KeyIdentifier [ 0000: A9 C7 8E 26 9C F5 37 0A E6 5A D4 A &..7..Z.6& : 6A C8 79 2C j.y, ******************************************* ******************************************* Alias name: mnt Creion de: Dec 10, 2014 Entry type: trustedcertentry Owner: CN=ise.lab6.com Issuer: CN=ise.lab6.com Serial number: f ec27e53c1dd64f46 Valid from: Sun Dec 07 17:46:29 PST 2014 until: Mon Dec 07 17:46:29 PST 2015 Certifice fingerprints: MD5: 04:7D:67:04:EC:D2:F5:BC:DC:79:4D:0A:FF:62:09:FD SHA1: 5A:7B:02:E4:07:A1:D2:0B:7D:A5:AE:83:27:3B:E7:33:33:30:1E:32 SHA256: C4:21:6C:6F:5B:06:F3:2C:D7:26:35:CB:BE:2B:1B:FF:0E:EE:09:91:F6:B6:54:0C:6F:63:CB:43:1F:77:F2:37 Signure algorithm name: SHA1withRSA Version: 3 Extensions: #1: ObjectId: Criticality=false BasicConstraints:[ CA:true PhLen: #2: ObjectId: Criticality=false ExtendedKeyUsages [ serverauth clientauth #3: ObjectId: Criticality=false KeyUsage [ DigitalSignure Key_Encipherment Key_Agreement Key_CertSign #4: ObjectId: Criticality=false NetscapeCertType [ SSL server #5: ObjectId: Criticality=false SubjectKeyIdentifier [ KeyIdentifier [ 0000: C4 F3 1A 9E 7B 1B 14 4F 51 9E A A AC...OQ...3.z. 0010: D4 u76. ******************************************* ******************************************* 2015 思科系统公司第 17 页

18 故障排除 本节介绍一些故障排除提示 : 通过验证 pxgrid 客户端主机名和 ISE pxgrid 是否可通过 DNS 进行解析, 避免出现 pxgrid 脚本错误消息 如果信任库有更改, 并且收到类似的错误消息, 请从 ISE VM 停止并重新启动 ISE 应用./register.sh -keystorefilename self1.jks -keysrepassword cisco123 -truststorefilename root1.jks - truststorepassword cisco123 -username pxgridclient -hostname group Session -description test properties version=1.0.0 hostnames= username=pxgridclient descriptipon=test1 keystorefilename=self1.jks keystorepassword=cisco123 truststorefilename=root1.jks truststorepassword=cisco registering... connecting... javax.net.ssl.sslhandshakeexception: Received fal alert: unknown_ca sun.security.ssl.alerts.getsslexception(alerts.java:192) sun.security.ssl.alerts.getsslexception(alerts.java:154) sun.security.ssl.sslsocketimpl.recvalert(sslsocketimpl.java:1991) sun.security.ssl.sslsocketimpl.readrecord(sslsocketimpl.java:1104) sun.security.ssl.sslsocketimpl.performinitialhandshake(sslsocketimpl.java:1343) sun.security.ssl.sslsocketimpl.starthandshake(sslsocketimpl.java:1371) sun.security.ssl.sslsocketimpl.starthandshake(sslsocketimpl.java:1355) org.jivesoftware.smack.xmppconnection.proceedtlsreceived(xmppconnection.java:806) org.jivesoftware.smack.packetreader.parsepackets(packetreader.java:267) org.jivesoftware.smack.packetreader.access$000(packetreader.java:43) org.jivesoftware.smack.packetreader$1.run(packetreader.java:70) Exception in thread "main" com.cisco.pxgrid.gclexception: SASL authenticion failed: com.cisco.pxgrid.gridconnection.connect(gridconnection.java:197) com.cisco.pxgrid.samples.ise.register.main(register.java:99) Caused by: SASL authenticion failed: org.jivesoftware.smack.saslauthenticion.authentice(saslauthenticion.java:281) org.jivesoftware.smack.xmppconnection.login(xmppconnection.java:206) com.cisco.pxgrid.configurion.connect(configurion.java:194) com.cisco.pxgrid.gridconnection.connect(gridconnection.java:134)... 1 more 重新启动 ISE 服务 applicion stop ise applicion start ise 验证 pxgrid 进程是否正在初始化 sh applicion stus ise 2015 思科系统公司第 18 页

19 如果您看到类似的错误消息, 则需要将 root 证书添加至 truststorefilename 密钥库中, 在本示例中例如添加至 root3.jks./register.sh -keystorefilename pxgridclient.jks -keystorepassword cisco123 -truststorefilename root3.jks - truststorepassword cisco123 -group Session -description MACBOOK -username Macbook_PRO -hostname properties version=1.0.0 hostnames= username=macbook_pro descriptipon=macbook keystorefilename=pxgridclient.jks keystorepassword=cisco123 truststorefilename=root3.jks truststorepassword=cisco registering... connecting... javax.net.ssl.sslhandshakeexception: java.security.cert.certificeexception: root certifice not trusted of [ise.lab6.com sun.security.ssl.alerts.getsslexception(alerts.java:192) sun.security.ssl.sslsocketimpl.fal(sslsocketimpl.java:1917) sun.security.ssl.handshaker.false(handshaker.java:301) sun.security.ssl.handshaker.false(handshaker.java:295) sun.security.ssl.clienthandshaker.servercertifice(clienthandshaker.java:1471) sun.security.ssl.clienthandshaker.processmessage(clienthandshaker.java:212) sun.security.ssl.handshaker.processloop(handshaker.java:936) sun.security.ssl.handshaker.process_record(handshaker.java:871) sun.security.ssl.sslsocketimpl.readrecord(sslsocketimpl.java:1043) sun.security.ssl.sslsocketimpl.performinitialhandshake(sslsocketimpl.java:1343) sun.security.ssl.sslsocketimpl.starthandshake(sslsocketimpl.java:1371) sun.security.ssl.sslsocketimpl.starthandshake(sslsocketimpl.java:1355) org.jivesoftware.smack.xmppconnection.proceedtlsreceived(xmppconnection.java:806) org.jivesoftware.smack.packetreader.parsepackets(packetreader.java:267) org.jivesoftware.smack.packetreader.access$000(packetreader.java:43) org.jivesoftware.smack.packetreader$1.run(packetreader.java:70) Caused by: java.security.cert.certificeexception: root certifice not trusted of [ise.lab6.com org.jivesoftware.smack.servertrustmanager.checkservertrusted(servertrustmanager.java:144) sun.security.ssl.abstracttrustmanagerwrapper.checkservertrusted(sslcontextimpl.java:865) sun.security.ssl.clienthandshaker.servercertifice(clienthandshaker.java:1453) more 如果您看到以下错误消息, 请确保 pxgrid 客户端和 ISE pxgrid FQDN 名称可通过 DNS 解析./session_download.sh -keystorefilename jeppich.jks -keystorepassword cisco123 -truststorefilename trust007.jks -truststorepassword cisco123 -hostname username mac properties version=1.0.0 hostnames= username=mac2 keystorefilename=jeppich.jks keystorepassword=cisco123 truststorefilename=trust007.jks truststorepassword=cisco123 filter=null start=null end=null connecting... connected. 20:18: [main WARN o.a.cxf.phase.phaseinterceptorchain - Interceptor for { has thrown exception, unwinding now org.apache.cxf.interceptor.fault: Could not send Message. org.apache.cxf.interceptor.messagesenderinterceptor$messagesenderendinginterceptor.handlemessage(messagesende rinterceptor.java:64) ~[cxf-api jar:2.7.3 org.apache.cxf.phase.phaseinterceptorchain.dointercept(phaseinterceptorchain.java:271) ~[cxf-api jar: 思科系统公司第 19 页

20 org.apache.cxf.jaxrs.client.abstractclient.doruninterceptorchain(abstractclient.java:581) [cxf-rtfrontend-jaxrs jar:2.7.3 org.apache.cxf.jaxrs.client.webclient.dochainedinvocion(webclient.java:904) [cxf-rt-frontendjaxrs jar:2.7.3 org.apache.cxf.jaxrs.client.webclient.doinvoke(webclient.java:772) [cxf-rt-frontend-jaxrs jar:2.7.3 org.apache.cxf.jaxrs.client.webclient.doinvoke(webclient.java:759) [cxf-rt-frontend-jaxrs jar:2.7.3 org.apache.cxf.jaxrs.client.webclient.invoke(webclient.java:355) [cxf-rt-frontend-jaxrs jar:2.7.3 org.apache.cxf.jaxrs.client.webclient.post(webclient.java:381) [cxf-rt-frontend-jaxrs jar:2.7.3 com.cisco.pxgrid.stub.identity.impl.sessioniterorimpl.open(sessioniterorimpl.java:128) [pxgrid-identity-client-stub jar:1.0.0 com.cisco.pxgrid.samples.ise.sessiondownload.main(sessiondownload.java:132) [pxgrid-sdk jar:1.0.0 Caused by: java.net.unknownhostexception: UnknownHostException invoking ise.lab6.com sun.reflect.niveconstructoraccessorimpl.newinstance0(nive Method) ~[na:1.8.0_25 sun.reflect.niveconstructoraccessorimpl.newinstance(niveconstructoraccessorimpl.java:62) ~[na:1.8.0_25 sun.reflect.delegingconstructoraccessorimpl.newinstance(delegingconstructoraccessorimpl.java:45) ~[na:1.8.0_25 java.lang.reflect.constructor.newinstance(constructor.java:408) ~[na:1.8.0_25 org.apache.cxf.transport.http.httpconduit$wrappedoutputstream.mapexception(httpconduit.java:1338) ~[cxf-rt-transports-http jar:2.7.3 org.apache.cxf.transport.http.httpconduit$wrappedoutputstream.close(httpconduit.java:1322) ~[cxfrt-transports-http jar:2.7.3 org.apache.cxf.transport.abstractconduit.close(abstractconduit.java:56) ~[cxf-api jar:2.7.3 org.apache.cxf.transport.http.httpconduit.close(httpconduit.java:622) ~[cxf-rt-transports-http jar:2.7.3 org.apache.cxf.interceptor.messagesenderinterceptor$messagesenderendinginterceptor.handlemessage(messagesende rinterceptor.java:62) ~[cxf-api jar: common frames omitted Caused by: java.net.unknownhostexception: ise.lab6.com java.net.abstractplainsocketimpl.connect(abstractplainsocketimpl.java:184) ~[na:1.8.0_25 java.net.sockssocketimpl.connect(sockssocketimpl.java:392) ~[na:1.8.0_25 java.net.socket.connect(socket.java:589) ~[na:1.8.0_25 sun.security.ssl.sslsocketimpl.connect(sslsocketimpl.java:649) ~[na:1.8.0_25 sun.net.networkclient.doconnect(networkclient.java:175) ~[na:1.8.0_25 sun.net. ~[na:1.8.0_25 sun.net. ~[na:1.8.0_25 sun.net. ~[na:1.8.0_25 sun.net. ~[na:1.8.0_25 sun.net. tion.java:191) ~[na:1.8.0_25 sun.net. ~[na:1.8.0_25 sun.net. ~[na:1.8.0_25 sun.net. :177) ~[na:1.8.0_25 sun.net. ~[na:1.8.0_25 sun.net. ~[na:1.8.0_25 sun.net. ~[na:1.8.0_25 org.apache.cxf.transport.http.urlconnectionhttpconduit$urlconnectionwrappedoutputstream.setupwrappedstream(ur LConnectionHTTPConduit.java:170) ~[cxf-rt-transports-http jar:2.7.3 org.apache.cxf.transport.http.httpconduit$wrappedoutputstream.handleheaderstrustcaching(httpconduit.java:1282) ~[cxf-rt-transports-http jar:2.7.3 org.apache.cxf.transport.http.httpconduit$wrappedoutputstream.onfirstwrite(httpconduit.java:1233) ~[cxf-rt-transports-http jar:2.7.3 org.apache.cxf.transport.http.urlconnectionhttpconduit$urlconnectionwrappedoutputstream.onfirstwrite(urlconne ctionhttpconduit.java:183) ~[cxf-rt-transports-http jar: 思科系统公司第 20 页

21 org.apache.cxf.io.abstractwrappedoutputstream.write(abstractwrappedoutputstream.java:47) ~[cxfapi jar:2.7.3 org.apache.cxf.io.abstractthresholdoutputstream.write(abstractthresholdoutputstream.java:69) ~[cxf-api jar:2.7.3 org.apache.cxf.transport.http.httpconduit$wrappedoutputstream.close(httpconduit.java:1295) ~[cxfrt-transports-http jar: common frames omitted 20:18: [main WARN c.c.p.s.i.impl.sessioniterorimpl - unsuccessful tempt made to session directory ise.lab6.com javax.ws.rs.client.clientexception: javax.ws.rs.client.clientexception: org.apache.cxf.interceptor.fault: Could not send Message. org.apache.cxf.jaxrs.client.webclient.doresponse(webclient.java:946) ~[cxf-rt-frontend-jaxrs jar:2.7.3 org.apache.cxf.jaxrs.client.webclient.dochainedinvocion(webclient.java:905) ~[cxf-rt-frontendjaxrs jar:2.7.3 org.apache.cxf.jaxrs.client.webclient.doinvoke(webclient.java:772) ~[cxf-rt-frontend-jaxrs jar:2.7.3 org.apache.cxf.jaxrs.client.webclient.doinvoke(webclient.java:759) ~[cxf-rt-frontend-jaxrs jar:2.7.3 org.apache.cxf.jaxrs.client.webclient.invoke(webclient.java:355) ~[cxf-rt-frontend-jaxrs jar:2.7.3 org.apache.cxf.jaxrs.client.webclient.post(webclient.java:381) ~[cxf-rt-frontend-jaxrs jar:2.7.3 com.cisco.pxgrid.stub.identity.impl.sessioniterorimpl.open(sessioniterorimpl.java:128) ~[pxgrid-identity-client-stub jar:1.0.0 com.cisco.pxgrid.samples.ise.sessiondownload.main(sessiondownload.java:132) [pxgrid-sdk jar:1.0.0 Caused by: javax.ws.rs.client.clientexception: org.apache.cxf.interceptor.fault: Could not send Message. org.apache.cxf.jaxrs.client.abstractclient.checkclientexception(abstractclient.java:522) ~[cxf-rtfrontend-jaxrs jar:2.7.3 org.apache.cxf.jaxrs.client.abstractclient.preprocessresult(abstractclient.java:508) ~[cxf-rtfrontend-jaxrs jar:2.7.3 org.apache.cxf.jaxrs.client.webclient.doresponse(webclient.java:941) ~[cxf-rt-frontend-jaxrs jar: common frames omitted Caused by: org.apache.cxf.interceptor.fault: Could not send Message. org.apache.cxf.interceptor.messagesenderinterceptor$messagesenderendinginterceptor.handlemessage(messagesende rinterceptor.java:64) ~[cxf-api jar:2.7.3 org.apache.cxf.phase.phaseinterceptorchain.dointercept(phaseinterceptorchain.java:271) ~[cxf-api jar:2.7.3 org.apache.cxf.jaxrs.client.abstractclient.doruninterceptorchain(abstractclient.java:581) ~[cxfrt-frontend-jaxrs jar:2.7.3 org.apache.cxf.jaxrs.client.webclient.dochainedinvocion(webclient.java:904) ~[cxf-rt-frontendjaxrs jar: common frames omitted Caused by: java.net.unknownhostexception: UnknownHostException invoking ise.lab6.com sun.reflect.niveconstructoraccessorimpl.newinstance0(nive Method) ~[na:1.8.0_25 sun.reflect.niveconstructoraccessorimpl.newinstance(niveconstructoraccessorimpl.java:62) ~[na:1.8.0_25 sun.reflect.delegingconstructoraccessorimpl.newinstance(delegingconstructoraccessorimpl.java:45) ~[na:1.8.0_25 java.lang.reflect.constructor.newinstance(constructor.java:408) ~[na:1.8.0_25 org.apache.cxf.transport.http.httpconduit$wrappedoutputstream.mapexception(httpconduit.java:1338) ~[cxf-rt-transports-http jar:2.7.3 org.apache.cxf.transport.http.httpconduit$wrappedoutputstream.close(httpconduit.java:1322) ~[cxfrt-transports-http jar:2.7.3 org.apache.cxf.transport.abstractconduit.close(abstractconduit.java:56) ~[cxf-api jar:2.7.3 org.apache.cxf.transport.http.httpconduit.close(httpconduit.java:622) ~[cxf-rt-transports-http jar:2.7.3 org.apache.cxf.interceptor.messagesenderinterceptor$messagesenderendinginterceptor.handlemessage(messagesende rinterceptor.java:62) ~[cxf-api jar: common frames omitted Caused by: java.net.unknownhostexception: ise.lab6.com java.net.abstractplainsocketimpl.connect(abstractplainsocketimpl.java:184) ~[na:1.8.0_25 java.net.sockssocketimpl.connect(sockssocketimpl.java:392) ~[na:1.8.0_25 java.net.socket.connect(socket.java:589) ~[na:1.8.0_25 sun.security.ssl.sslsocketimpl.connect(sslsocketimpl.java:649) ~[na:1.8.0_25 sun.net.networkclient.doconnect(networkclient.java:175) ~[na:1.8.0_25 sun.net. ~[na:1.8.0_ 思科系统公司第 21 页

22 sun.net. ~[na:1.8.0_25 sun.net. ~[na:1.8.0_25 sun.net. ~[na:1.8.0_25 sun.net. tion.java:191) ~[na:1.8.0_25 sun.net. ~[na:1.8.0_25 sun.net. ~[na:1.8.0_25 sun.net. :177) ~[na:1.8.0_25 sun.net. ~[na:1.8.0_25 sun.net. ~[na:1.8.0_25 sun.net. ~[na:1.8.0_25 org.apache.cxf.transport.http.urlconnectionhttpconduit$urlconnectionwrappedoutputstream.setupwrappedstream(ur LConnectionHTTPConduit.java:170) ~[cxf-rt-transports-http jar:2.7.3 org.apache.cxf.transport.http.httpconduit$wrappedoutputstream.handleheaderstrustcaching(httpconduit.java:1282 ) ~[cxf-rt-transports-http jar:2.7.3 org.apache.cxf.transport.http.httpconduit$wrappedoutputstream.onfirstwrite(httpconduit.java:1233) ~[cxf-rt-transports-http jar:2.7.3 org.apache.cxf.transport.http.urlconnectionhttpconduit$urlconnectionwrappedoutputstream.onfirstwrite(urlconne ctionhttpconduit.java:183) ~[cxf-rt-transports-http jar:2.7.3 org.apache.cxf.io.abstractwrappedoutputstream.write(abstractwrappedoutputstream.java:47) ~[cxfapi jar:2.7.3 org.apache.cxf.io.abstractthresholdoutputstream.write(abstractthresholdoutputstream.java:69) ~[cxf-api jar:2.7.3 org.apache.cxf.transport.http.httpconduit$wrappedoutputstream.close(httpconduit.java:1295) ~[cxfrt-transports-http jar: common frames omitted Exception in thread "main" java.io.ioexception: unsuccessful tempts made to all session directories com.cisco.pxgrid.stub.identity.impl.sessioniterorimpl.open(sessioniterorimpl.java:148) com.cisco.pxgrid.samples.ise.sessiondownload.main(sessiondownload.java:132) 2015 思科系统公司第 22 页