ansaurus

Question

HttpClient and SSL

Answer 1

+1 A:

https://mms.nw.ru likely uses a certificate not issued by a certification authority. Consequently, you need to add the certificate to your trusted Java key store as explained in unable to find valid certification path to requested target:

When working on a client that works with an SSL enabled server running in https protocol, you could get error 'unable to find valid certification path to requested target' if the server certificate is not issued by certification authority, but a self signed or issued by a private CMS.

Don't panic. All you need to do is to add the server certificate to your trusted Java key store if your client is written in Java. You might be wondering how as if you can not access the machine where the server is installed. There is a simple program can help you. Please download the Java program and run
% java InstallCert _web_site_hostname_
This program opened a connection to the specified host and started an SSL handshake. It printed the exception stack trace of the error that occured and shows you the certificates used by the server. Now it prompts you add the certificate to your trusted KeyStore.

If you've changed your mind, enter 'q'. If you really want to add the certificate, enter '1', or other numbers to add other certificates, even a CA certificate, but you usually don't want to do that. Once you have made your choice, the program will display the complete certificate and then added it to a Java KeyStore named 'jssecacerts' in the current directory.

To use it in your program, either configure JSSE to use it as its trust store or copy it into your $JAVA_HOME/jre/lib/security directory. If you want all Java applications to recognize the certificate as trusted and not just JSSE, you could also overwrite the cacerts file in that directory.

After all that, JSSE will be able to complete a handshake with the host, which you can verify by running the program again.

To get more details, you can check out Leeland's blog No more 'unable to find valid certification path to requested target'

Pascal Thivent 2009-12-01 20:52:01

Answer 2

+7 A:

https://mms.nw.ru uses a self-signed certificate which obviously isn't contained in the default set of trust managers.

You'll need to either:

Configure the SSLContext with a TrustManager that accepts any cert
Configure the SSLContext with an appropriate trust store that includes your cert
Add the cert for that site to the default java trust store.

Here is a sample program that creates a (mostly worthless) SSL Context that accepts any cert:

import java.net.URL;
import java.security.SecureRandom;
import java.security.cert.CertificateException;
import java.security.cert.X509Certificate;
import javax.net.ssl.HostnameVerifier;
import javax.net.ssl.HttpsURLConnection;
import javax.net.ssl.KeyManager;
import javax.net.ssl.SSLContext;
import javax.net.ssl.SSLSession;
import javax.net.ssl.TrustManager;
import javax.net.ssl.X509TrustManager;

public class SSLTest {

    public static void main(String [] args) throws Exception {
        SSLContext ctx = SSLContext.getInstance("TLS");
        ctx.init(new KeyManager[0], new TrustManager[] {new DefaultTrustManager()}, new SecureRandom());
        SSLContext.setDefault(ctx);

        URL url = new URL("https://mms.nw.ru");
        HttpsURLConnection conn = (HttpsURLConnection) url.openConnection();
        conn.setHostnameVerifier(new HostnameVerifier() {
            @Override
            public boolean verify(String arg0, SSLSession arg1) {
                return true;
            }
        });
        System.out.println(conn.getResponseCode());

        conn.disconnect();
    }

    private static class DefaultTrustManager implements X509TrustManager {

        @Override
        public void checkClientTrusted(X509Certificate[] arg0, String arg1) throws CertificateException {}

        @Override
        public void checkServerTrusted(X509Certificate[] arg0, String arg1) throws CertificateException {}

        @Override
        public X509Certificate[] getAcceptedIssuers() {
            return null;
        }

    }

}

Kevin 2009-12-01 20:52:31

Can this approach be integrated with HttpClient instead of a URLConnection?

stormin986 2010-04-29 20:23:08

Yeah, the HttpClient docs should tell you how to plug in your own SSLContext

Kevin 2010-04-30 11:06:51

You can plug in an `SSLContext` with Apache HTTP Client 3.x using this: http://code.google.com/p/jsslutils/wiki/ApacheHttpClientUsage There's native support for using an `SSLContext` in Apache HTTP Client 4.x now.

Bruno 2010-09-13 23:38:03

Answer 3

+1 A:

That particular site's SSL cert isn't setup correctly. When I go to https://mms.nw.ru, I get a error screen in Chrome.

Trevor Harrison 2009-12-01 20:53:30

Answer 4

+2 A:

From http://hc.apache.org/httpclient-3.x/sslguide.html:

Protocol.registerProtocol("https", 
new Protocol("https", new MySSLSocketFactory(), 443));
HttpClient httpclient = new HttpClient();
GetMethod httpget = new GetMethod("https://www.whatever.com/");
try {
  httpclient.executeMethod(httpget);
      System.out.println(httpget.getStatusLine());
} finally {
      httpget.releaseConnection();
}

Where MySSLSocketFactory example can be found here. It references a TrustManager, which you can modify to trust everything (although you must consider this!)

Bozho 2009-12-01 20:53:35

Answer 5

+1 A:

Once you have a Java Cert Store (by using the great InstallCert class created above), you can get java to use it by passing the "javax.net.ssl.trustStore" param at java startup.

Ex:

java -Djavax.net.ssl.trustStore=/path/to/jssecacerts MyClassName

Brian M. Carr 2009-12-01 21:52:39

ansaurus

tags:

views:

answers:

HttpClient and SSL

related questions