RE: unable to authenticate against company-generated certificate

["Bodycombe, Andrew" <an...@siemens.com>]

OK. So the HTTPS site you connect to does not require a client certificate?
Good. That only makes things more complicated!

You don't need to validate the server certificate. The system does this for
you. You just need to make sure that the certificate received (and all the
other certificates in the chain) are trusted entries in your keystore. You
say that the server certificate is imported into your keystore (I presume as
a trusted entry), so you may need to import the rest of the certificate
chain too.

When starting tomcat, set the CATALINA_OPTS variable to `
"-Djavax.net.debug=all"
You will see all sorts of debugging info in the output. This may help.

Also, I know a way to ignore the validation process. I wouldn't advise using
this in a production environment, because you will end up accepting
certificates from ALL sites. I will probably get slated on this list for
this, because of the security implications, but here goes. This code is
based on one of the SSL tutorials provided with the JSSE package:

public class DummyTrustManager implements X509TrustManager
{
    public boolean isClientTrusted(X509Certificate[] certChain)
    { return true; }

    public boolean isServerTrusted(X509Certificate[] certChain)
    { return true; }

    public X509Certificate[] getAcceptedIssuers()
    { return new X509Certificate(0); }
} 

and before you create any HttpsURLConnections....

TrustManager trustMan = new DummyTrustManager();
TrustManager[] trustArray = {trustMan};
SSLContext ctx = SSLContext.getInstance("SSL");
ctx.init(null, trustArray, null);
SSLSocketFactory factory = ctx.getSocketFactory();
HttpsURLConnection.setDefaultSSLSocketFactory(factory);

The next time you create an HttpsURLConnection, it will use the
DummyTrustManager, therefore accepting certificates from anyone, regardless
of where it came from. This should allow you to continue, while you find the
cause of your problem. You could add some code in the "isServerTrusted"
method to examine the certificates you have received from the server, maybe
printing the details to the log. Then you can use keytool to print out the
details of the certificates in your keystore, and make sure the certificates
you receive are trusted...

Andy

-----Original Message-----
From: Becky Phaneuf
To: andrew.bodycombe@siemens.com
Sent: 19/11/2002 16:05
Subject: RE: unable to authenticate against company-generated	certificate

Hi Andrew,

I don't think the server validates anything on my end.  I could be
wrong, but I'm fairly certain the problem lies with my inability, in a
Java servlet, (a browser does works) to validate the server's
certificate.  The program (my program - on the client side) throws an
exception.  If the server couldn't validate my certificate the program
wouldn't throw an exception - it would only lag and the server would
return a HTTP 4xx or 5xx error.

Thanks,
-Becky

>>> "Bodycombe, Andrew" <an...@siemens.com> 11/19/02 12:03AM
>>>
Hi Becky,

The site you connect to - this may be validating your client
certificate,
which was fine while you had your old certificate, but you have
generated a
new certificate which the server does not recognise.

If this is the case, you have to contact the administrator of the
secure
site, and tell them you are not using the old certificate. They will
know
what to do. They probably just need to add your new certificate to
their
list of trusted certificates. Alternatively, you could return to using
your
old certificate, if that works fine...

One more question - has your new certificate been signed?

Regards, 
Andy

-----Original Message-----
From: Becky Phaneuf
To: <"Tomcat Users List"
Sent: 19/11/2002 02:25
Subject: unable to authenticate against company-generated certificate


Hi everyone,

I have a servlet that is tasked to download various files from a
secure
site.   It uses an HttpsURLConnection to connect to the site's root
and
passes my Authenticator class (w/ username and password) as the
default
authenticator.   It used to work fine until the site's admin replaced
their verisign certificate with an in-house-generated one.  Now my
servlet receives a java.security.cert.CertificateException stating
that
it cannot find a trusted certificate.

I tried adding the server's certificate to my server's keystore, but
I'm
afraid that didn't work.  I believe I have to obtain the certificate
and
somehow validate it.  If anyone has experience with this I'd greatly
appreciated it.

Thanks in advance,
-Becky


--
To unsubscribe, e-mail:
<ma...@jakarta.apache.org>
For additional commands, e-mail:
<ma...@jakarta.apache.org>

--
To unsubscribe, e-mail:   <ma...@jakarta.apache.org>
For additional commands, e-mail: <ma...@jakarta.apache.org>