You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@hc.apache.org by Sven Köhler <sk...@upb.de> on 2003/11/12 15:10:27 UTC

SSL-Connection to unstrusted host

Well, the subject says it all:

I'd like to connect to a host with an untrusted SSL-certfictate. When 
trying to connect, i always get the following exception:

javax.net.ssl.SSLHandshakeException: 
sun.security.validator.ValidatorException:
No trusted certificate found
	at com.sun.net.ssl.internal.ssl.BaseSSLSocketImpl.a(DashoA6275)
	at com.sun.net.ssl.internal.ssl.SSLSocketImpl.a(DashoA6275)
	at com.sun.net.ssl.internal.ssl.SSLSocketImpl.a(DashoA6275)
	at com.sun.net.ssl.internal.ssl.SunJSSE_az.a(DashoA6275)
	at com.sun.net.ssl.internal.ssl.SunJSSE_az.a(DashoA6275)
	at com.sun.net.ssl.internal.ssl.SunJSSE_ax.a(DashoA6275)
	at com.sun.net.ssl.internal.ssl.SSLSocketImpl.a(DashoA6275)
	at com.sun.net.ssl.internal.ssl.SSLSocketImpl.j(DashoA6275)
	at com.sun.net.ssl.internal.ssl.SSLSocketImpl.a(DashoA6275)
	at com.sun.net.ssl.internal.ssl.AppOutputStream.write(DashoA6275)
	at 
org.apache.commons.httpclient.HttpConnection$WrappedOutputStream.write(HttpConnection.java:1351)
	at java.io.BufferedOutputStream.flushBuffer(BufferedOutputStream.java:66)
	at java.io.BufferedOutputStream.flush(BufferedOutputStream.java:124)
	at 
org.apache.commons.httpclient.HttpConnection.flushRequestOutputStream(HttpConnection.java:779)
	at 
org.apache.commons.httpclient.MultiThreadedHttpConnectionManager$HttpConnectionAdapter.flushRequestOutputStream(MultiThreadedHttpConnectionManager.java:1145)
	at 
org.apache.commons.httpclient.HttpMethodBase.writeRequest(HttpMethodBase.java:2257)
	at 
org.apache.commons.httpclient.HttpMethodBase.processRequest(HttpMethodBase.java:2629)
	at 
org.apache.commons.httpclient.HttpMethodBase.execute(HttpMethodBase.java:1085)
	at 
org.apache.commons.httpclient.HttpClient.executeMethod(HttpClient.java:674)
...

Is there any option to turn the check off?


---------------------------------------------------------------------
To unsubscribe, e-mail: commons-httpclient-dev-unsubscribe@jakarta.apache.org
For additional commands, e-mail: commons-httpclient-dev-help@jakarta.apache.org


Re: SSL-Connection to unstrusted host

Posted by Sven Köhler <sk...@upb.de>.
> http://jakarta.apache.org/commons/httpclient/sslguide.html

Here's a EasySSLProtocolSocketFactory that works with JDK1.4
Your source doesn't work because of some dependencies on com.sun.* 
classes. It's mainly the getSocketFactory-method that was changed.

import java.io.IOException;
import java.net.InetAddress;
import java.net.Socket;
import java.net.UnknownHostException;
import java.security.cert.CertificateException;
import java.security.cert.X509Certificate;

import javax.net.ssl.SSLContext;
import javax.net.ssl.SSLSocketFactory;
import javax.net.ssl.TrustManager;
import javax.net.ssl.X509TrustManager;

import org.apache.commons.httpclient.protocol.SecureProtocolSocketFactory;

public class SSLProtocolSocketFactory implements SecureProtocolSocketFactory
{
     private static class TM implements X509TrustManager
     {
         public X509Certificate[] getAcceptedIssuers()
         {
             return new X509Certificate[0];
         }

         public void checkClientTrusted(X509Certificate[] arg0, String 
arg1) throws CertificateException
         {
         }

         public void checkServerTrusted(X509Certificate[] arg0, String 
arg1) throws CertificateException
         {
         }
     }

     private static SSLSocketFactory getSocketFactory()
     {
         try
         {
             SSLContext context = SSLContext.getInstance("SSL");
             context.init(null, new TrustManager[] {new TM()}, null);
             return context.getSocketFactory();
         }
         catch (Exception e)
         {
             throw new RuntimeException(e);
         }
     }

     public Socket createSocket(String host, int port, InetAddress 
clientHost,
         int clientPort) throws IOException, UnknownHostException
     {
         return getSocketFactory().createSocket(host, port, clientHost, 
clientPort);
     }

     public Socket createSocket(String host, int port)
         throws IOException, UnknownHostException
     {
         return getSocketFactory().createSocket(host, port);
     }

     public Socket createSocket(Socket socket, String host, int port,
         boolean autoClose) throws IOException, UnknownHostException
     {
         return getSocketFactory().createSocket(socket, host, port, 
autoClose);
     }
}


---------------------------------------------------------------------
To unsubscribe, e-mail: commons-httpclient-dev-unsubscribe@jakarta.apache.org
For additional commands, e-mail: commons-httpclient-dev-help@jakarta.apache.org


RE: SSL-Connection to unstrusted host

Posted by Oleg Kalnichevski <ol...@apache.org>.
On Wed, 2003-11-12 at 17:24, Aaron Williams wrote:
> I've also recently been getting this error and was hoping someone could
> shed some light on it.
> 
> We're using the RC2 version of HttpClient and our JDK versions are all
> 1.4 or greater.  The client we are connecting to seems to have a
> Verisign certificate.  Initially our client worked, but we later began
> getting the SSLHandshakeException.  This occurred with no changes on the
> client side.
> 

Aaron, it all sounds a bit fishy to me. To my best knowledge
SSLHandshakeException (Could not find the trusted certificate) thrown
only in case of the target server's certificate having been signed with
a untrusted certificate. This is highly improbable that a certificate
would once of a sudden become untrusted (As far as I know JSSE does not
currently provide support for certificate revocation lists).

So, the problem could possibly indicate one of those:
- corruption of local certificate store (not impossible, but unlikely)
- the server certificate signed with a trusted root certificate has been
replaced with a self signed certificate.

In the latter case the EasySSLProtocolSocketFactory should do the trick.
However, I would encourage you not to copy in blindly, but rather take
it as a starting point and customise its functionality to better match
the requirements of your particular application.

Hope this helps somewhat

Oleg

> We do have the lines
> 
> Security.addProvider(new com.sun.net.ssl.internal.ssl.Provider());
> host.setHost(hostname, port, "https");
> client.setHostConfiguration(host);
> 
> Before we create PostMethod()
> 
> Here is the thrown exception
> 
> javax.net.ssl.SSLHandshakeException: Could not find the trusted
> certificate 	
> at com.sun.net.ssl.internal.ssl.SSLSocketImpl.b(DashoA6275) 	
> at com.sun.net.ssl.internal.ssl.SSLSocketImpl.a(DashoA6275) 	
> at com.sun.net.ssl.internal.ssl.ClientHandshaker.a(DashoA6275) 	
> at
> com.sun.net.ssl.internal.ssl.ClientHandshaker.processMessage(DashoA6275)
> 
> at com.sun.net.ssl.internal.ssl.Handshaker.process_record(DashoA6275) 	
> at com.sun.net.ssl.internal.ssl.SSLSocketImpl.a(DashoA6275) 	
> at com.sun.net.ssl.internal.ssl.SSLSocketImpl.a(DashoA6275) 	
> at com.sun.net.ssl.internal.ssl.AppOutputStream.write(DashoA6275) 	
> at
> org.apache.commons.httpclient.HttpConnection$WrappedOutputStream.write(H
> ttpConnection.java:1351) 	
> at java.io.BufferedOutputStream.flushBuffer(Unknown Source) 	
> at java.io.BufferedOutputStream.flush(Unknown Source) 	
> at
> org.apache.commons.httpclient.HttpConnection.flushRequestOutputStream(Ht
> tpConnection.java:779) 	
> at
> org.apache.commons.httpclient.HttpMethodBase.writeRequest(HttpMethodBase
> .java:2257) 	
> at
> org.apache.commons.httpclient.HttpMethodBase.processRequest(HttpMethodBa
> se.java:2629) 	
> at
> org.apache.commons.httpclient.HttpMethodBase.execute(HttpMethodBase.java
> :1085) 	
> at
> org.apache.commons.httpclient.HttpClient.executeMethod(HttpClient.java:6
> 74) 	
> at
> org.apache.commons.httpclient.HttpClient.executeMethod(HttpClient.java:5
> 29)
> 
> Can anyone help with this?  Would using EasySSLProtocolSocketFactory
> class fix this error?
> 
> Thanks,
> Aaron
>  
> 
> -----Original Message-----
> From: Marcus Crafter [mailto:crafterm@managesoft.com] 
> Sent: Wednesday, November 12, 2003 8:43 AM
> To: Commons HttpClient Project
> Subject: Re: SSL-Connection to unstrusted host
> 
> 
> H Sven, Roland,
> 
> There's an example socket factory available on the website:
> 
> http://jakarta.apache.org/commons/httpclient/sslguide.html
> 
> Have a look for the EasySSLProtocolSocketFactory class.
> 
> Hope that helps.
> 
> Cheers,
> 
> Marcus
> 
> On Wed, 2003-11-12 at 15:34, Roland Weber wrote:
> > Hello Sven,
> > 
> > you will have to register your own secure socket factory.
> > In that factory, you can establish SSL connections without verifying 
> > certificates. Alas, I don't remember whether such code is included in 
> > the examples or has been posted to the mailing list. But the topic 
> > itself pops up every few months, so you're likely to find sample code 
> > somewhere.
> > 
> > See interface SecureProtocolSocketFactory and class
> > Protocol (method registerProtocol) to get started.
> > 
> > regards,
> >   Roland
> > 
> > 
> > 
> > 
> > 
> > 
> > Sven Köhler <sk...@upb.de>
> > 12.11.2003 15:10
> > Please respond to "Commons HttpClient Project"
> >  
> >         To:     Commons HttpClient Project 
> > <co...@jakarta.apache.org>
> >         cc: 
> >         Subject:        SSL-Connection to unstrusted host
> > 
> > 
> > Well, the subject says it all:
> > 
> > I'd like to connect to a host with an untrusted SSL-certfictate. When
> > trying to connect, i always get the following exception:
> > 
> > javax.net.ssl.SSLHandshakeException:
> > sun.security.validator.ValidatorException:
> > No trusted certificate found
> >                  at 
> > com.sun.net.ssl.internal.ssl.BaseSSLSocketImpl.a(DashoA6275)
> >                  at 
> > com.sun.net.ssl.internal.ssl.SSLSocketImpl.a(DashoA6275)
> >                  at 
> > com.sun.net.ssl.internal.ssl.SSLSocketImpl.a(DashoA6275)
> >                  at
> com.sun.net.ssl.internal.ssl.SunJSSE_az.a(DashoA6275)
> >                  at
> com.sun.net.ssl.internal.ssl.SunJSSE_az.a(DashoA6275)
> >                  at
> com.sun.net.ssl.internal.ssl.SunJSSE_ax.a(DashoA6275)
> >                  at 
> > com.sun.net.ssl.internal.ssl.SSLSocketImpl.a(DashoA6275)
> >                  at 
> > com.sun.net.ssl.internal.ssl.SSLSocketImpl.j(DashoA6275)
> >                  at 
> > com.sun.net.ssl.internal.ssl.SSLSocketImpl.a(DashoA6275)
> >                  at 
> > com.sun.net.ssl.internal.ssl.AppOutputStream.write(DashoA6275)
> >                  at 
> >
> org.apache.commons.httpclient.HttpConnection$WrappedOutputStream.write(H
> ttpConnection.java:1351)
> >                  at 
> > java.io.BufferedOutputStream.flushBuffer(BufferedOutputStream.java:66)
> >                  at 
> > java.io.BufferedOutputStream.flush(BufferedOutputStream.java:124)
> >                  at 
> >
> org.apache.commons.httpclient.HttpConnection.flushRequestOutputStream(Ht
> tpConnection.java:779)
> >                  at 
> >
> org.apache.commons.httpclient.MultiThreadedHttpConnectionManager$HttpCon
> nectionAdapter.flushRequestOutputStream(MultiThreadedHttpConnectionManag
> er.java:1145)
> >                  at 
> >
> org.apache.commons.httpclient.HttpMethodBase.writeRequest(HttpMethodBase
> .java:2257)
> >                  at 
> >
> org.apache.commons.httpclient.HttpMethodBase.processRequest(HttpMethodBa
> se.java:2629)
> >                  at 
> >
> org.apache.commons.httpclient.HttpMethodBase.execute(HttpMethodBase.java
> :1085)
> >                  at 
> >
> org.apache.commons.httpclient.HttpClient.executeMethod(HttpClient.java:6
> 74)
> > ...
> > 
> > Is there any option to turn the check off?
> > 
> > 
> > ---------------------------------------------------------------------
> > To unsubscribe, e-mail:
> > commons-httpclient-dev-unsubscribe@jakarta.apache.org
> > For additional commands, e-mail: 
> > commons-httpclient-dev-help@jakarta.apache.org
> > 
> > 
> 
> 
> ---------------------------------------------------------------------
> To unsubscribe, e-mail:
> commons-httpclient-dev-unsubscribe@jakarta.apache.org
> For additional commands, e-mail:
> commons-httpclient-dev-help@jakarta.apache.org
> 
> 
> 
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: commons-httpclient-dev-unsubscribe@jakarta.apache.org
> For additional commands, e-mail: commons-httpclient-dev-help@jakarta.apache.org
> 


---------------------------------------------------------------------
To unsubscribe, e-mail: commons-httpclient-dev-unsubscribe@jakarta.apache.org
For additional commands, e-mail: commons-httpclient-dev-help@jakarta.apache.org


RE: SSL-Connection to unstrusted host

Posted by Aaron Williams <aw...@ntransit.com>.
I've also recently been getting this error and was hoping someone could
shed some light on it.

We're using the RC2 version of HttpClient and our JDK versions are all
1.4 or greater.  The client we are connecting to seems to have a
Verisign certificate.  Initially our client worked, but we later began
getting the SSLHandshakeException.  This occurred with no changes on the
client side.

We do have the lines

Security.addProvider(new com.sun.net.ssl.internal.ssl.Provider());
host.setHost(hostname, port, "https");
client.setHostConfiguration(host);

Before we create PostMethod()

Here is the thrown exception

javax.net.ssl.SSLHandshakeException: Could not find the trusted
certificate 	
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.b(DashoA6275) 	
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.a(DashoA6275) 	
at com.sun.net.ssl.internal.ssl.ClientHandshaker.a(DashoA6275) 	
at
com.sun.net.ssl.internal.ssl.ClientHandshaker.processMessage(DashoA6275)

at com.sun.net.ssl.internal.ssl.Handshaker.process_record(DashoA6275) 	
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.a(DashoA6275) 	
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.a(DashoA6275) 	
at com.sun.net.ssl.internal.ssl.AppOutputStream.write(DashoA6275) 	
at
org.apache.commons.httpclient.HttpConnection$WrappedOutputStream.write(H
ttpConnection.java:1351) 	
at java.io.BufferedOutputStream.flushBuffer(Unknown Source) 	
at java.io.BufferedOutputStream.flush(Unknown Source) 	
at
org.apache.commons.httpclient.HttpConnection.flushRequestOutputStream(Ht
tpConnection.java:779) 	
at
org.apache.commons.httpclient.HttpMethodBase.writeRequest(HttpMethodBase
.java:2257) 	
at
org.apache.commons.httpclient.HttpMethodBase.processRequest(HttpMethodBa
se.java:2629) 	
at
org.apache.commons.httpclient.HttpMethodBase.execute(HttpMethodBase.java
:1085) 	
at
org.apache.commons.httpclient.HttpClient.executeMethod(HttpClient.java:6
74) 	
at
org.apache.commons.httpclient.HttpClient.executeMethod(HttpClient.java:5
29)

Can anyone help with this?  Would using EasySSLProtocolSocketFactory
class fix this error?

Thanks,
Aaron
 

-----Original Message-----
From: Marcus Crafter [mailto:crafterm@managesoft.com] 
Sent: Wednesday, November 12, 2003 8:43 AM
To: Commons HttpClient Project
Subject: Re: SSL-Connection to unstrusted host


H Sven, Roland,

There's an example socket factory available on the website:

http://jakarta.apache.org/commons/httpclient/sslguide.html

Have a look for the EasySSLProtocolSocketFactory class.

Hope that helps.

Cheers,

Marcus

On Wed, 2003-11-12 at 15:34, Roland Weber wrote:
> Hello Sven,
> 
> you will have to register your own secure socket factory.
> In that factory, you can establish SSL connections without verifying 
> certificates. Alas, I don't remember whether such code is included in 
> the examples or has been posted to the mailing list. But the topic 
> itself pops up every few months, so you're likely to find sample code 
> somewhere.
> 
> See interface SecureProtocolSocketFactory and class
> Protocol (method registerProtocol) to get started.
> 
> regards,
>   Roland
> 
> 
> 
> 
> 
> 
> Sven Köhler <sk...@upb.de>
> 12.11.2003 15:10
> Please respond to "Commons HttpClient Project"
>  
>         To:     Commons HttpClient Project 
> <co...@jakarta.apache.org>
>         cc: 
>         Subject:        SSL-Connection to unstrusted host
> 
> 
> Well, the subject says it all:
> 
> I'd like to connect to a host with an untrusted SSL-certfictate. When
> trying to connect, i always get the following exception:
> 
> javax.net.ssl.SSLHandshakeException:
> sun.security.validator.ValidatorException:
> No trusted certificate found
>                  at 
> com.sun.net.ssl.internal.ssl.BaseSSLSocketImpl.a(DashoA6275)
>                  at 
> com.sun.net.ssl.internal.ssl.SSLSocketImpl.a(DashoA6275)
>                  at 
> com.sun.net.ssl.internal.ssl.SSLSocketImpl.a(DashoA6275)
>                  at
com.sun.net.ssl.internal.ssl.SunJSSE_az.a(DashoA6275)
>                  at
com.sun.net.ssl.internal.ssl.SunJSSE_az.a(DashoA6275)
>                  at
com.sun.net.ssl.internal.ssl.SunJSSE_ax.a(DashoA6275)
>                  at 
> com.sun.net.ssl.internal.ssl.SSLSocketImpl.a(DashoA6275)
>                  at 
> com.sun.net.ssl.internal.ssl.SSLSocketImpl.j(DashoA6275)
>                  at 
> com.sun.net.ssl.internal.ssl.SSLSocketImpl.a(DashoA6275)
>                  at 
> com.sun.net.ssl.internal.ssl.AppOutputStream.write(DashoA6275)
>                  at 
>
org.apache.commons.httpclient.HttpConnection$WrappedOutputStream.write(H
ttpConnection.java:1351)
>                  at 
> java.io.BufferedOutputStream.flushBuffer(BufferedOutputStream.java:66)
>                  at 
> java.io.BufferedOutputStream.flush(BufferedOutputStream.java:124)
>                  at 
>
org.apache.commons.httpclient.HttpConnection.flushRequestOutputStream(Ht
tpConnection.java:779)
>                  at 
>
org.apache.commons.httpclient.MultiThreadedHttpConnectionManager$HttpCon
nectionAdapter.flushRequestOutputStream(MultiThreadedHttpConnectionManag
er.java:1145)
>                  at 
>
org.apache.commons.httpclient.HttpMethodBase.writeRequest(HttpMethodBase
.java:2257)
>                  at 
>
org.apache.commons.httpclient.HttpMethodBase.processRequest(HttpMethodBa
se.java:2629)
>                  at 
>
org.apache.commons.httpclient.HttpMethodBase.execute(HttpMethodBase.java
:1085)
>                  at 
>
org.apache.commons.httpclient.HttpClient.executeMethod(HttpClient.java:6
74)
> ...
> 
> Is there any option to turn the check off?
> 
> 
> ---------------------------------------------------------------------
> To unsubscribe, e-mail:
> commons-httpclient-dev-unsubscribe@jakarta.apache.org
> For additional commands, e-mail: 
> commons-httpclient-dev-help@jakarta.apache.org
> 
> 


---------------------------------------------------------------------
To unsubscribe, e-mail:
commons-httpclient-dev-unsubscribe@jakarta.apache.org
For additional commands, e-mail:
commons-httpclient-dev-help@jakarta.apache.org



---------------------------------------------------------------------
To unsubscribe, e-mail: commons-httpclient-dev-unsubscribe@jakarta.apache.org
For additional commands, e-mail: commons-httpclient-dev-help@jakarta.apache.org


Re: SSL-Connection to unstrusted host

Posted by Marcus Crafter <cr...@managesoft.com>.
H Sven, Roland,

There's an example socket factory available on the website:

http://jakarta.apache.org/commons/httpclient/sslguide.html

Have a look for the EasySSLProtocolSocketFactory class.

Hope that helps.

Cheers,

Marcus

On Wed, 2003-11-12 at 15:34, Roland Weber wrote:
> Hello Sven,
> 
> you will have to register your own secure socket factory.
> In that factory, you can establish SSL connections without
> verifying certificates. Alas, I don't remember whether such
> code is included in the examples or has been posted to the
> mailing list. But the topic itself pops up every few months,
> so you're likely to find sample code somewhere.
> 
> See interface SecureProtocolSocketFactory and class
> Protocol (method registerProtocol) to get started.
> 
> regards,
>   Roland
> 
> 
> 
> 
> 
> 
> Sven Köhler <sk...@upb.de>
> 12.11.2003 15:10
> Please respond to "Commons HttpClient Project"
>  
>         To:     Commons HttpClient Project 
> <co...@jakarta.apache.org>
>         cc: 
>         Subject:        SSL-Connection to unstrusted host
> 
> 
> Well, the subject says it all:
> 
> I'd like to connect to a host with an untrusted SSL-certfictate. When 
> trying to connect, i always get the following exception:
> 
> javax.net.ssl.SSLHandshakeException: 
> sun.security.validator.ValidatorException:
> No trusted certificate found
>                  at 
> com.sun.net.ssl.internal.ssl.BaseSSLSocketImpl.a(DashoA6275)
>                  at 
> com.sun.net.ssl.internal.ssl.SSLSocketImpl.a(DashoA6275)
>                  at 
> com.sun.net.ssl.internal.ssl.SSLSocketImpl.a(DashoA6275)
>                  at com.sun.net.ssl.internal.ssl.SunJSSE_az.a(DashoA6275)
>                  at com.sun.net.ssl.internal.ssl.SunJSSE_az.a(DashoA6275)
>                  at com.sun.net.ssl.internal.ssl.SunJSSE_ax.a(DashoA6275)
>                  at 
> com.sun.net.ssl.internal.ssl.SSLSocketImpl.a(DashoA6275)
>                  at 
> com.sun.net.ssl.internal.ssl.SSLSocketImpl.j(DashoA6275)
>                  at 
> com.sun.net.ssl.internal.ssl.SSLSocketImpl.a(DashoA6275)
>                  at 
> com.sun.net.ssl.internal.ssl.AppOutputStream.write(DashoA6275)
>                  at 
> org.apache.commons.httpclient.HttpConnection$WrappedOutputStream.write(HttpConnection.java:1351)
>                  at 
> java.io.BufferedOutputStream.flushBuffer(BufferedOutputStream.java:66)
>                  at 
> java.io.BufferedOutputStream.flush(BufferedOutputStream.java:124)
>                  at 
> org.apache.commons.httpclient.HttpConnection.flushRequestOutputStream(HttpConnection.java:779)
>                  at 
> org.apache.commons.httpclient.MultiThreadedHttpConnectionManager$HttpConnectionAdapter.flushRequestOutputStream(MultiThreadedHttpConnectionManager.java:1145)
>                  at 
> org.apache.commons.httpclient.HttpMethodBase.writeRequest(HttpMethodBase.java:2257)
>                  at 
> org.apache.commons.httpclient.HttpMethodBase.processRequest(HttpMethodBase.java:2629)
>                  at 
> org.apache.commons.httpclient.HttpMethodBase.execute(HttpMethodBase.java:1085)
>                  at 
> org.apache.commons.httpclient.HttpClient.executeMethod(HttpClient.java:674)
> ...
> 
> Is there any option to turn the check off?
> 
> 
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: 
> commons-httpclient-dev-unsubscribe@jakarta.apache.org
> For additional commands, e-mail: 
> commons-httpclient-dev-help@jakarta.apache.org
> 
> 


---------------------------------------------------------------------
To unsubscribe, e-mail: commons-httpclient-dev-unsubscribe@jakarta.apache.org
For additional commands, e-mail: commons-httpclient-dev-help@jakarta.apache.org


Re: SSL-Connection to unstrusted host

Posted by Roland Weber <RO...@de.ibm.com>.
Hello Sven,

you will have to register your own secure socket factory.
In that factory, you can establish SSL connections without
verifying certificates. Alas, I don't remember whether such
code is included in the examples or has been posted to the
mailing list. But the topic itself pops up every few months,
so you're likely to find sample code somewhere.

See interface SecureProtocolSocketFactory and class
Protocol (method registerProtocol) to get started.

regards,
  Roland






Sven Köhler <sk...@upb.de>
12.11.2003 15:10
Please respond to "Commons HttpClient Project"
 
        To:     Commons HttpClient Project 
<co...@jakarta.apache.org>
        cc: 
        Subject:        SSL-Connection to unstrusted host


Well, the subject says it all:

I'd like to connect to a host with an untrusted SSL-certfictate. When 
trying to connect, i always get the following exception:

javax.net.ssl.SSLHandshakeException: 
sun.security.validator.ValidatorException:
No trusted certificate found
                 at 
com.sun.net.ssl.internal.ssl.BaseSSLSocketImpl.a(DashoA6275)
                 at 
com.sun.net.ssl.internal.ssl.SSLSocketImpl.a(DashoA6275)
                 at 
com.sun.net.ssl.internal.ssl.SSLSocketImpl.a(DashoA6275)
                 at com.sun.net.ssl.internal.ssl.SunJSSE_az.a(DashoA6275)
                 at com.sun.net.ssl.internal.ssl.SunJSSE_az.a(DashoA6275)
                 at com.sun.net.ssl.internal.ssl.SunJSSE_ax.a(DashoA6275)
                 at 
com.sun.net.ssl.internal.ssl.SSLSocketImpl.a(DashoA6275)
                 at 
com.sun.net.ssl.internal.ssl.SSLSocketImpl.j(DashoA6275)
                 at 
com.sun.net.ssl.internal.ssl.SSLSocketImpl.a(DashoA6275)
                 at 
com.sun.net.ssl.internal.ssl.AppOutputStream.write(DashoA6275)
                 at 
org.apache.commons.httpclient.HttpConnection$WrappedOutputStream.write(HttpConnection.java:1351)
                 at 
java.io.BufferedOutputStream.flushBuffer(BufferedOutputStream.java:66)
                 at 
java.io.BufferedOutputStream.flush(BufferedOutputStream.java:124)
                 at 
org.apache.commons.httpclient.HttpConnection.flushRequestOutputStream(HttpConnection.java:779)
                 at 
org.apache.commons.httpclient.MultiThreadedHttpConnectionManager$HttpConnectionAdapter.flushRequestOutputStream(MultiThreadedHttpConnectionManager.java:1145)
                 at 
org.apache.commons.httpclient.HttpMethodBase.writeRequest(HttpMethodBase.java:2257)
                 at 
org.apache.commons.httpclient.HttpMethodBase.processRequest(HttpMethodBase.java:2629)
                 at 
org.apache.commons.httpclient.HttpMethodBase.execute(HttpMethodBase.java:1085)
                 at 
org.apache.commons.httpclient.HttpClient.executeMethod(HttpClient.java:674)
...

Is there any option to turn the check off?


---------------------------------------------------------------------
To unsubscribe, e-mail: 
commons-httpclient-dev-unsubscribe@jakarta.apache.org
For additional commands, e-mail: 
commons-httpclient-dev-help@jakarta.apache.org