title: Weblogic Server 10.3.0 keystore error: inconsistent security configuration
body: <p>Apologies I am a little out of my element with this one so hopefully have all the needed information here...</p>
  
  <p>We run the following on our local developer test system: Weblogic Server 10.3.0 with Java 1.6.0_38.</p>
  
  <p>I have a developer who is developing some code with a new payment processor and they need to import a self-signed certificate from the vendor, into the java keystore for Weblogic. </p>
  
  <p>The Weblogic system is pretty out of the box. SSL doesn't even run on the managed servers. Our CMS vendor installed it (poorly) and there are a lot of defaults. </p>
  
  <p>The developer attempted to import the cert a few times by doing the following...</p>
  
  <ul>
  <li>He was provided a certificate from the vendor</li>
  <li>He put it in a text file on the weblogic server (I checked this and it looked good)</li>
  <li>He found the keystore (JKS) in the managed server config so he knew where to import it to</li>
  <li>Got the keystore password (on second attempt)</li>
  <li><p>He ran the following command to import the certificate into the keystore...</p>
  
  <pre><code>C:\Java\jdk1.6.0_20\bin\keytool -import -alias moneris_test_java -file K:\Java\jdk1.6.0_20\test_cert.der -keystore K:\apps\core\appserver\weblogic\config\teststore.jks
  </code></pre></li>
  </ul>
  
  <p>The password was correct and I can see both certificates (this one and one other) in the keystore.</p>
  
  <p>I believe he had tried to recreate the keystore as well when there was no password found for the old one. He then went into the WLS console and updated the keystore passphrases to the new one he created. </p>
  
  <p>I found him the password, we renamed the original keystore back to the original naming and we were able to import the new certificate. Doing a keytool -list we can see that both certificates are installed there. We also went back into WLS console and updated the passphrases to the correct one and also checked the file path was the same in Weblogic as what we had for the keystore.</p>
  
  <p>Now whenever he tries to start his managed server we get he following. The ms starts but complains it cannot load the key and the application is unable to make a connection to the vendor.</p>
  
  <pre><code>&lt;Aug 20, 2013 4:03:23 PM PDT&gt; &lt;Notice&gt; &lt;Log Management&gt; &lt;BEA-170027&gt; &lt;The Server has established connection with the Domain level Diagnostic Service successfully.&gt;
  
  &lt;Aug 20, 2013 4:03:23 PM PDT&gt; &lt;Notice&gt; &lt;WebLogicServer&gt; &lt;BEA-000365&gt; &lt;Server state changed to ADMIN&gt;
  
  &lt;Aug 20, 2013 4:03:23 PM PDT&gt; &lt;Notice&gt; &lt;WebLogicServer&gt; &lt;BEA-000365&gt; &lt;Server state changed to RESUMING&gt;
  
  &lt;Aug 20, 2013 4:03:23 PM PDT&gt; &lt;Notice&gt; &lt;Security&gt; &lt;BEA-090171&gt; &lt;Loading the identity certificate and private key stored under the alias testcert from the jks keystore file K:\bmapps\core\appserver\web
  logic\config\teststore.jks.&gt;
  
  &lt;Aug 20, 2013 4:03:23 PM PDT&gt; &lt;Alert&gt; &lt;Security&gt; &lt;BEA-090716&gt; &lt;Failed to retrieve identity key/certificate from keystore K:\bmapps\core\appserver\weblogic\config\teststore.jks under alias testcert on
  server mec&gt;
  
  &lt;Aug 20, 2013 4:03:23 PM PDT&gt; &lt;Error&gt; &lt;WebLogicServer&gt; &lt;BEA-000297&gt; &lt;Inconsistent security configuration, weblogic.management.configuration.ConfigurationException: Failed to retrieve identity key/cert
  ificate from keystore K:\bmapps\core\appserver\weblogic\config\teststore.jks under alias testcert on server mec&gt;
  
  &lt;Aug 20, 2013 4:03:23 PM PDT&gt; &lt;Emergency&gt; &lt;Security&gt; &lt;BEA-090034&gt; &lt;Not listening for SSL, java.io.IOException: Failed to retrieve identity key/certificate from keystore K:\bmapps\core\appserver\weblog
  ic\config\teststore.jks under alias testcert on server mec.&gt;
  
  &lt;Aug 20, 2013 4:03:23 PM PDT&gt; &lt;Notice&gt; &lt;Security&gt; &lt;BEA-090171&gt; &lt;Loading the identity certificate and private key stored under the alias testcert from the jks keystore file K:\bmapps\core\appserver\web
  logic\config\teststore.jks.&gt;
  
  &lt;Aug 20, 2013 4:03:23 PM PDT&gt; &lt;Alert&gt; &lt;Security&gt; &lt;BEA-090716&gt; &lt;Failed to retrieve identity key/certificate from keystore K:\bmapps\core\appserver\weblogic\config\teststore.jks under alias testcert on
  server mec&gt;
  
  &lt;Aug 20, 2013 4:03:23 PM PDT&gt; &lt;Error&gt; &lt;WebLogicServer&gt; &lt;BEA-000297&gt; &lt;Inconsistent security configuration, weblogic.management.configuration.ConfigurationException: Failed to retrieve identity key/cert
  ificate from keystore K:\bmapps\core\appserver\weblogic\config\teststore.jks under alias testcert on server mec&gt;
  
  &lt;Aug 20, 2013 4:03:23 PM PDT&gt; &lt;Emergency&gt; &lt;Security&gt; &lt;BEA-090034&gt; &lt;Not listening for SSL, java.io.IOException: Failed to retrieve identity key/certificate from keystore K:\bmapps\core\appserver\weblog
  ic\config\teststore.jks under alias testcert on server mec.&gt;
  
  &lt;Aug 20, 2013 4:03:23 PM PDT&gt; &lt;Warning&gt; &lt;Server&gt; &lt;BEA-002611&gt; &lt;Hostname "8LG63M1.mecnet.lcl", maps to multiple IP addresses: 172.16.79.6, 127.0.0.1&gt;
  
  &lt;Aug 20, 2013 4:03:23 PM PDT&gt; &lt;Notice&gt; &lt;Server&gt; &lt;BEA-002613&gt; &lt;Channel "Default" is now listening on 172.16.79.6:7010 for protocols iiop, t3, ldap, snmp, http.&gt;
  
  &lt;Aug 20, 2013 4:03:23 PM PDT&gt; &lt;Warning&gt; &lt;Server&gt; &lt;BEA-002611&gt; &lt;Hostname "local.mec.ca", maps to multiple IP addresses: 172.16.79.6, 127.0.0.1&gt;
  
  &lt;Aug 20, 2013 4:03:23 PM PDT&gt; &lt;Notice&gt; &lt;Server&gt; &lt;BEA-002613&gt; &lt;Channel "Default[1]" is now listening on 127.0.0.1:7010 for protocols iiop, t3, ldap, snmp, http.&gt;
  
  &lt;Aug 20, 2013 4:03:23 PM PDT&gt; &lt;Notice&gt; &lt;WebLogicServer&gt; &lt;BEA-000332&gt; &lt;Started WebLogic Managed Server "mec" for domain "bluemartini" running in Development Mode&gt;
  &lt;Aug 20, 2013 4:03:23 PM PDT&gt; &lt;Notice&gt; &lt;WebLogicServer&gt; &lt;BEA-000365&gt; &lt;Server state changed to RUNNING&gt;
  &lt;Aug 20, 2013 4:03:23 PM PDT&gt; &lt;Notice&gt; &lt;WebLogicServer&gt; &lt;BEA-000360&gt; &lt;Server started in RUNNING mode&gt;
  </code></pre>