SSL connection using Java standalone app

Question

I have created a standalone executable JAR program that needs to send private information over a SSL connection.
I was not able to establish the SSL connection using certificates. Was getting this:

javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path `building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target`

So I found some code somewhere that creates a trust manager that does not validate certificate chains:

// Create a trust manager that does not validate certificate chains
TrustManager[] trustAllCerts = new TrustManager[]{
            new X509TrustManager() {
                public java.security.cert.X509Certificate[] getAcceptedIssuers() {
                    return null;
                }
                public void checkClientTrusted(
                    java.security.cert.X509Certificate[] certs, String authType) {
                }
                public void checkServerTrusted(
                    java.security.cert.X509Certificate[] certs, String authType) {
                }
            }
        };

That did the trick and I was able to establish SSL connection without any certificates.

My concern is if the data will still be encrypted when exchanging private information. This is an execute JAR file that clients will be downloading to their computers.

So is a certificate really necessary for this case?

Thanks.

Answer 1

Yes, it's still encrypted.

Essentially, SSL provides 2 types of security: trust and confidentiality.

You're bypassing the trust part, but the confidentiality is still valid.

Essentially, the TrustManager you've created stops Java from checking that the server is who it says it is. If the transmission was intercepted, and IF the intercepting party had the necessary private key to decrypt the message, then you'd have a problem.

It's a big IF. In most cases, this is fine, but really you should look at downloading the server certificate and putting it into a keystore.

See "keytool". The keytol executable comes with the JDK, and you can use this command-line tool to create a 'keystore' (in this case, aka 'truststore').

http://java.sun.com/javase/6/docs/technotes/tools/windows/keytool.html

There are many ways to tell Java to use a keystore, and your choice depends on what libraries etc you're using to make the SSL connection. One method is to use startup options, e.g.:

-Djavax.net.ssl.trustStore=mySrvKeystore -Djavax.net.ssl.trustStorePassword=123456

Best to google for "keystore java" plus your library name (if you're using one)

hth