Trouble with HTTPS connection (certificate problem)

[robert.dodier]

Hello,

I know this is a FAQ, but after searching, reading, and trying several
things,
I am still running into this problem. Thanks in advance for your help.

I'm attempting to connect to a server via HTTPS from a Java client.
I have downloaded the server's certificate using IE and saved it in a
file.
I have (I believe) imported the certificate into my keystore:

keytool -keystore ~/.keystore -import -file FOO.cer -alias BAR
-trustcacerts

keytool -list does show the certificate is in the ~/.keystore file.

I execute my Java client with options

-Djavax.net.ssl.keyStore=/path/to/.keystore
-Djavax.net.ssl.keyStorePassword=***

When I try to connect via HTTPS, I get two errors: one for an expired
certificate (which I expected, because the certificate is indeed
expired,
and I am trying to solve that separately by installing a custom SSL
socket factory), and the second error is
"java.security.cert.CertificateException:
Untrusted Server Certificate Chain", which I didn't expect.

I have also tried putting
-Djavax.net.ssl.trustStore=/usr/java/jdk1.5.0_06/jre/lib/security/cacerts
-Djavax.net.ssl.trustStorePassword=***
on the command line -- no effect. What else can I try?

I have also implemented a custom SSL socket factory and custom trust
manager in an attempt to work around the expired certificate,
and in the Java client put

java.security.Security.setProperty ("ssl.SocketFactory.provider",
"my.customFactory");

and also tried -Dssl.SocketFactory.provider=my.customFactory, both
to no effect. What else can I try here?
Do I also need a setting for the trust manager?

Thanks a lot for your help.

Robert Dodier

 

[EJP]

I'm attempting to connect to a server via HTTPS from a Java client.
I have downloaded the server's certificate using IE and saved it in a
file.
I have (I believe) imported the certificate into my keystore:

keytool -keystore ~/.keystore -import -file FOO.cer -alias BAR
-trustcacerts

keytool -list does show the certificate is in the ~/.keystore file.

I execute my Java client with options

-Djavax.net.ssl.keyStore=/path/to/.keystore
-Djavax.net.ssl.keyStorePassword=***

All the above should refer to 'truststore' instead of 'keystore'
including the system property name. A keystore is a source for your
*own* cert when sending to others; a truststore is a place to check
incoming certs against.

I have also tried putting
-Djavax.net.ssl.trustStore=/usr/java/jdk1.5.0_06/jre/lib/security/cacerts
-Djavax.net.ssl.trustStorePassword=***
on the command line -- no effect. What else can I try?

But have you put the server's cert into there? That's where it belongs.

java.security.Security.setProperty ("ssl.SocketFactory.provider",
"my.customFactory");

and also tried -Dssl.SocketFactory.provider=my.customFactory, both
to no effect. What else can I try here?

You don't need to do this. Just get yourself an SSLContext and
initialize it appropriately with implementations of your own
TrustManager, then get your SSLSocketFactory/SSLServerSocketFactory from
that SSLContext. There's some guidance on this in the Javadoc Guide to
Features/Security/JSSE Reference.

 

[Rogan Dawes]

All the above should refer to 'truststore' instead of 'keystore'
including the system property name. A keystore is a source for your
*own* cert when sending to others; a truststore is a place to check
incoming certs against.


But have you put the server's cert into there? That's where it belongs.


You don't need to do this. Just get yourself an SSLContext and
initialize it appropriately with implementations of your own
TrustManager, then get your SSLSocketFactory/SSLServerSocketFactory from
that SSLContext. There's some guidance on this in the Javadoc Guide to
Features/Security/JSSE Reference.

For what it is worth, there is a short program demonstrating various
aspects of the Java SSL implementation (with some 1.5 specific features)
on my website at <http://dawes.za.net/rogan/PKCS11Test.java>

It demonstrates using a PKCS#11 provider, using a TrustManager, using a
KeyManager, using a HostnameVerifier, etc.

Some of it may be useful to you.

However, I think that EJP's hit the nail on the head, with the
truststore vs keystore.

Rogan