You are viewing a plain text version of this content. The canonical link for it is here.
Posted to httpclient-users@hc.apache.org by Gerhard Sinne <GS...@orga-systems.com> on 2010/12/13 09:23:43 UTC
Trouble with TrustManager and TrustStrategy for self-signed-certificates
Hi all,
I've asked something similar before, so apologies if you feel its doubled.
I have a https- Server that I need to connect to using HTTPS and digest
authentication. This works perfect with plain HTTP.
Now for SSL, I implemented a TrustManager with its methods as empty ones
and connected it to the SSLFactory. But the methods
are not even called during the httpclient.execute() call.
Then I switched to TrustStrategy and connected this to the SSLFactory.
Again no way. The isTrusted()- method of TrustStrategy is not even called.
Instead both implementation just abort with
javax.net.ssl.SSLPeerUnverifiedException: peer not authenticated.
This is the essential code for TrustManager (X509TrustManager did not
work either)
==============================================================================================
public class ClientTrustManager {
public final static void main(String[] args) throws Exception{
SSLContext ctx = SSLContext.getInstance("TLS");
MyTrustManager tm = new MyTrustManager();
ctx.init (null, new TrustManager []{tm}, null);
SSLSocketFactory socketFactory = new SSLSocketFactory(ctx);
DefaultHttpClient httpclient = new DefaultHttpClient();
httpclient.getConnectionManager().getSchemeRegistry().register(new
Scheme("https", 443, socketFactory));
httpclient.getCredentialsProvider() .setCredentials(new
AuthScope(null, -1, null),
new
UsernamePasswordCredentials("...", "..."));
HttpGet httpget = new HttpGet("https://192.168.111.56/...");
HttpResponse response = httpclient.execute(httpget);
}
}
class MyTrustManager implements TrustManager {
public void checkClientTrusted(java.security.cert.X509Certificate[] xcs,
String string) throws CertificateException {
System.out.println("checkClientTrusted");
}
public java.security.cert.X509Certificate[] getAcceptedIssuers() {
System.out.println("getAcceptedIssuers");
return null;
}
public void checkServerTrusted(java.security.cert.X509Certificate[]
arg0, String arg1) throws CertificateException {
System.out.println("checkServerTrusted");
}
}
And this is the essential code for TrustStrategy:
====================================================================================
public class ClientTrustStrategy {
public final static void main(String[] args) throws Exception{
MyTrustStrategy ts = new MyTrustStrategy();
SSLSocketFactory socketFactory = new SSLSocketFactory(ts);
DefaultHttpClient httpclient = new DefaultHttpClient();
httpclient.getConnectionManager().getSchemeRegistry().register(new
Scheme("https", 443, socketFactory));
httpclient.getCredentialsProvider().setCredentials(new AuthScope(null,
-1, null),
new
UsernamePasswordCredentials("...", "..."));
HttpResponse response = httpclient.execute(httpget);
}
}
class MyTrustStrategy implements TrustStrategy {
public boolean isTrusted(X509Certificate[] arg0, String authString)
throws CertificateException {
System.out.println("MyTrustStrategy.isTrusted:" + authString);
return true;
}
}
====================================================================================
Can somebody sched a light on this ?
Thx for any help
Gerd
The information included in this e-mail and any files transmitted with it is strictly confidential and may be privileged or otherwise protected from disclosure. If you are not the intended recipient, please notify the sender immediately by e-mail and delete this e-mail as well as any attachment from your system. If you are not the intended recipient you are not authorized to use and/or copy this message and/or attachment and/or disclose the contents to any other person.
Re: Trouble with TrustManager and TrustStrategy for
self-signed-certificates
Posted by Oleg Kalnichevski <ol...@apache.org>.
On Fri, 2010-12-17 at 14:45 +0100, Gerhard Sinne wrote:
> Hi Oleg,
> may I raise this issue again ?
>
> > > > Gerd
> > > >
> > > > This looks like a SSL protocol compatibility issue. Try using a
> > > > different version of the protocol (SSLv1 or TLSv1) and see if that
> makes
> > > > any difference.
>
> I have now found out the correct protocol version (TLSv1) and succeed to
> connect to
> this server using WGET and CURL both. Still no luck with Apache HTTP.
>
HttpClient does not anything special as far as SSL is concerned. It
fully relies on the standard Java Security API (JSSE) for secure
communication. I presume WGET and CURL are using OpenSSL. It can well be
that the SSL protocol implementation used by the server is not fully
compatible with Oracle JSSE.
You can find out whether or not JSSE is capable of connecting to the
server at all by using the following test application:
http://hc.apache.org/httpclient-3.x/sslguide.html#Troubleshooting
...
>
>
> Looks like a server problem with Remote host closed connection during
> handshake. But why then do WGET and CURL work ?
They use a completely different SSL library.
Oleg
---------------------------------------------------------------------
To unsubscribe, e-mail: httpclient-users-unsubscribe@hc.apache.org
For additional commands, e-mail: httpclient-users-help@hc.apache.org
Re: Trouble with TrustManager and TrustStrategy for self-signed-certificates
Posted by Gerhard Sinne <GS...@orga-systems.com>.
Hi Oleg,
may I raise this issue again ?
> > > Gerd
> > >
> > > This looks like a SSL protocol compatibility issue. Try using a
> > > different version of the protocol (SSLv1 or TLSv1) and see if that
makes
> > > any difference.
I have now found out the correct protocol version (TLSv1) and succeed to
connect to
this server using WGET and CURL both. Still no luck with Apache HTTP.
Could you please take look to this stack and debug trace ?
....
trigger seeding of SecureRandom
done seeding SecureRandom
executing requestGET https://192.168.111.56/cgi-bin/read.xml?Meter.
HTTP/1.1
%% No cached client session
*** ClientHello, TLSv1
RandomCookie: GMT: 1292592736 bytes = { 66, 152, 166, 225, 89, 90, 205,
180, 21, 195, 3, 125, 219, 61, 94, 128, 39, 163, 28, 157, 180, 60, 43,
245, 218, 159, 255, 219 }
Session ID: {}
Cipher Suites: [SSL_RSA_WITH_RC4_128_MD5, SSL_RSA_WITH_RC4_128_SHA,
TLS_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_RSA_WITH_AES_128_CBC_SHA,
TLS_DHE_DSS_WITH_AES_128_CBC_SHA, SSL_RSA_WITH_3DES_EDE_CBC_SHA,
SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA, SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA,
SSL_RSA_WITH_DES_CBC_SHA, SSL_DHE_RSA_WITH_DES_CBC_SHA,
SSL_DHE_DSS_WITH_DES_CBC_SHA, SSL_RSA_EXPORT_WITH_RC4_40_MD5,
SSL_RSA_EXPORT_WITH_DES40_CBC_SHA, SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA,
SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA]
Compression Methods: { 0 }
***
[write] MD5 and SHA1 hashes: len = 73
0000: 01 00 00 45 03 01 4D 0B 66 60 42 98 A6 E1 59 5A ...E..M.f`B...YZ
0010: CD B4 15 C3 03 7D DB 3D 5E 80 27 A3 1C 9D B4 3C .......=^.'....<
0020: 2B F5 DA 9F FF DB 00 00 1E 00 04 00 05 00 2F 00 +............./.
0030: 33 00 32 00 0A 00 16 00 13 00 09 00 15 00 12 00 3.2.............
0040: 03 00 08 00 14 00 11 01 00 .........
main, WRITE: TLSv1 Handshake, length = 73
[write] MD5 and SHA1 hashes: len = 98
0000: 01 03 01 00 39 00 00 00 20 00 00 04 01 00 80 00 ....9... .......
0010: 00 05 00 00 2F 00 00 33 00 00 32 00 00 0A 07 00 ..../..3..2.....
0020: C0 00 00 16 00 00 13 00 00 09 06 00 40 00 00 15 ............@...
0030: 00 00 12 00 00 03 02 00 80 00 00 08 00 00 14 00 ................
0040: 00 11 4D 0B 66 60 42 98 A6 E1 59 5A CD B4 15 C3 ..M.f`B...YZ....
0050: 03 7D DB 3D 5E 80 27 A3 1C 9D B4 3C 2B F5 DA 9F ...=^.'....<+...
0060: FF DB ..
main, WRITE: SSLv2 client hello message, length = 98
[Raw write]: length = 100
0000: 80 62 01 03 01 00 39 00 00 00 20 00 00 04 01 00 .b....9... .....
0010: 80 00 00 05 00 00 2F 00 00 33 00 00 32 00 00 0A ....../..3..2...
0020: 07 00 C0 00 00 16 00 00 13 00 00 09 06 00 40 00 ..............@.
0030: 00 15 00 00 12 00 00 03 02 00 80 00 00 08 00 00 ................
0040: 14 00 00 11 4D 0B 66 60 42 98 A6 E1 59 5A CD B4 ....M.f`B...YZ..
0050: 15 C3 03 7D DB 3D 5E 80 27 A3 1C 9D B4 3C 2B F5 .....=^.'....<+.
0060: DA 9F FF DB ....
main, received EOFException: error
main, handling exception: javax.net.ssl.SSLHandshakeException: Remote host
closed connection during handshake
main, SEND TLSv1 ALERT: fatal, description = handshake_failure
main, WRITE: TLSv1 Alert, length = 2
[Raw write]: length = 7
0000: 15 03 01 00 02 02 28 ......(
main, called closeSocket()
main, IOException in getSession(): javax.net.ssl.SSLHandshakeException:
Remote host closed connection during handshake
main, called close()
main, called closeInternal(true)
Exception in thread "main" javax.net.ssl.SSLPeerUnverifiedException: peer
not authenticated
at
com.sun.net.ssl.internal.ssl.SSLSessionImpl.getPeerCertificates(Unknown
Source)
at org.apache.http.conn.ssl.AbstractVerifier.verify(
AbstractVerifier.java:128)
at org.apache.http.conn.ssl.SSLSocketFactory.connectSocket(
SSLSocketFactory.java:391)
at
org.apache.http.impl.conn.DefaultClientConnectionOperator.openConnection(
DefaultClientConnectionOperator.java:148)
at org.apache.http.impl.conn.AbstractPoolEntry.open(
AbstractPoolEntry.java:149)
at org.apache.http.impl.conn.AbstractPooledConnAdapter.open(
AbstractPooledConnAdapter.java:121)
at org.apache.http.impl.client.DefaultRequestDirector.tryConnect(
DefaultRequestDirector.java:562)
at org.apache.http.impl.client.DefaultRequestDirector.execute(
DefaultRequestDirector.java:415)
at org.apache.http.impl.client.AbstractHttpClient.execute(
AbstractHttpClient.java:700)
at org.apache.http.impl.client.AbstractHttpClient.execute(
AbstractHttpClient.java:625)
at org.apache.http.impl.client.AbstractHttpClient.execute(
AbstractHttpClient.java:603)
at ClientTrustManager.main(ClientTrustManager.java:56)
Looks like a server problem with Remote host closed connection during
handshake. But why then do WGET and CURL work ?
I have set socket and connect times long enough (30sec) as the server on
the other side is an embedded linux device and
therefore is not that fast.
If you still would be able to investigate in depth could you please come
to me via mailto:3ed@2010.temporarily.de for arranging
more details ?
Thx, regards
Gerd
The information included in this e-mail and any files transmitted with it is strictly confidential and may be privileged or otherwise protected from disclosure. If you are not the intended recipient, please notify the sender immediately by e-mail and delete this e-mail as well as any attachment from your system. If you are not the intended recipient you are not authorized to use and/or copy this message and/or attachment and/or disclose the contents to any other person.
Re: Trouble with TrustManager and TrustStrategy for self-signed-certificates
Posted by Gerhard Sinne <GS...@orga-systems.com>.
Oleg,
thanks for taking care.
What about my concern regarding
"ctx.contextSpi.trustManager" pointing to
"com.sun.net.ssl.internal.ssl.DummyX509TrustManager" ?
I have checked with the CURL utility in detail and compared it with a
successfull connection to some external
HTTPS- server and I guess there is an issue with the server. I donn't want
to bother you with details, but
the connection is broken once in the handshake procedure.
>....
* HTTP 1.0, assume close after body
< HTTP/1.0 401 Unauthorized
< WWW-Authenticate: Digest
realm="HTTPAccess",nonce="8BF95ABC4212FD4976EF5382AE58865E",algorithm="MD5",qop=
<
* SSLv3, TLS alert, Client hello (1):
* Closing connection #0
* SSLv3, TLS alert, Client hello (1):
* Issue another request to this URL:
'https://192.168.111.56/cgi-bin/xml/read?Meter.1'
* About to connect() to 192.168.111.56 port 443 (#0)
* Trying 192.168.111.56... connected
* Connected to 192.168.111.56 (192.168.111.56) port 443 (#0)
...
* SSLv3, TLS handshake, Finished (20):
* SSL connection using AES128-SHA
* Server certificate:
Let me clarify this first with the supplier of the server (or if you have
an idea, let me know...)
> If you can reproduce the problem with a test app that can be executed
> outside your local environment I'd happily take a look at it.
Thanks, much appreciated. Unfortunately, the server is inside our
companies LAN.
I'll try to arrange somehow to get the firewalls temporarely opened for
this incident.
Coming back with details if I got the permission.
Regards
/Gerd
The information included in this e-mail and any files transmitted with it is strictly confidential and may be privileged or otherwise protected from disclosure. If you are not the intended recipient, please notify the sender immediately by e-mail and delete this e-mail as well as any attachment from your system. If you are not the intended recipient you are not authorized to use and/or copy this message and/or attachment and/or disclose the contents to any other person.
Re: Trouble with TrustManager and TrustStrategy for
self-signed-certificates
Posted by Oleg Kalnichevski <ol...@apache.org>.
On Tue, 2010-12-14 at 11:51 +0100, Gerhard Sinne wrote:
> > > main, WRITE: TLSv1 Alert, length = 2
> >
> > Gerd
> >
> > This looks like a SSL protocol compatibility issue. Try using a
> > different version of the protocol (SSLv1 or TLSv1) and see if that makes
> > any difference.
>
> I inspected the CURL verbose output to see what SSL version was
> successfull.
> CURL says
> ...
>
> * SSLv3, TLS handshake, Finished (20):
> * SSL connection using AES128-SHA
> ...
>
> So I tried "SSLv3" first.
>
> SSLContext ctx = SSLContext.getInstance("SSLv3");
> MyTrustManager tm = new MyTrustManager();
> ctx.init (null, new MyTrustManager []{tm}, null);
> SSLSocketFactory socketFactory = new SSLSocketFactory(ctx);
>
> No way.
> Also tried
> TLS
> TLSv1/2
> SSLv1/2/3
> So all in all no difference. Problem persists.
>
> While debugging and inspecting the contents of classes, I found something
> appearing suspicious to me:
> After execution of the code section above,
> "ctx.contextSpi.trustManager" and
> "socketFactory.socketFactory.trustManager" both point to
> "com.sun.net.ssl.internal.ssl.DummyX509TrustManager"
>
> I would expect my "MyTrustManager" to appear in the socketFactory at that
> point.
>
>
> Regards
> Gerd
>
Gerd,
I have run out of ideas.
If you can reproduce the problem with a test app that can be executed
outside your local environment I'd happily take a look at it.
Oleg
---------------------------------------------------------------------
To unsubscribe, e-mail: httpclient-users-unsubscribe@hc.apache.org
For additional commands, e-mail: httpclient-users-help@hc.apache.org
Re: Trouble with TrustManager and TrustStrategy for self-signed-certificates
Posted by Gerhard Sinne <GS...@orga-systems.com>.
> > main, WRITE: TLSv1 Alert, length = 2
>
> Gerd
>
> This looks like a SSL protocol compatibility issue. Try using a
> different version of the protocol (SSLv1 or TLSv1) and see if that makes
> any difference.
I inspected the CURL verbose output to see what SSL version was
successfull.
CURL says
...
* SSLv3, TLS handshake, Finished (20):
* SSL connection using AES128-SHA
...
So I tried "SSLv3" first.
SSLContext ctx = SSLContext.getInstance("SSLv3");
MyTrustManager tm = new MyTrustManager();
ctx.init (null, new MyTrustManager []{tm}, null);
SSLSocketFactory socketFactory = new SSLSocketFactory(ctx);
No way.
Also tried
TLS
TLSv1/2
SSLv1/2/3
So all in all no difference. Problem persists.
While debugging and inspecting the contents of classes, I found something
appearing suspicious to me:
After execution of the code section above,
"ctx.contextSpi.trustManager" and
"socketFactory.socketFactory.trustManager" both point to
"com.sun.net.ssl.internal.ssl.DummyX509TrustManager"
I would expect my "MyTrustManager" to appear in the socketFactory at that
point.
Regards
Gerd
The information included in this e-mail and any files transmitted with it is strictly confidential and may be privileged or otherwise protected from disclosure. If you are not the intended recipient, please notify the sender immediately by e-mail and delete this e-mail as well as any attachment from your system. If you are not the intended recipient you are not authorized to use and/or copy this message and/or attachment and/or disclose the contents to any other person.
Re: Trouble with TrustManager and TrustStrategy for
self-signed-certificates
Posted by Oleg Kalnichevski <ol...@apache.org>.
On Tue, 2010-12-14 at 09:19 +0100, Gerhard Sinne wrote:
> >
> > Gerd
> >
> > I find it somewhat difficult to believe that the trust manager never
> > gets called. You might want to turn on the SSL debugging to find out
> > what certificates are trusted.
> >
> >
> http://download.oracle.com/javase/1.5.0/docs/guide/security/jsse/ReadDebug.html
>
> >
> > Oleg
> >
>
> Oleg,
>
> thanks for generous support and your valuable time. Really appreciate your
> help as I'm stuck with
> this problem for some time now.
>
> I suspected my server beeing faulty, but I can connect with CURL and WGET
> using HTTPS without
> a problem.
>
> Anyway, here is the important part of the Debug stack. The trustManager's
> method are definetely not called.
> ------------------------------------------------------------------------------------------------------------
> ...
> main, WRITE: SSLv2 client hello message, length = 98
> [Raw write]: length = 100
> ...
> main, received EOFException: error
> main, handling exception: javax.net.ssl.SSLHandshakeException: Remote host
> closed connection during handshake
> main, SEND TLSv1 ALERT: fatal, description = handshake_failure
> main, WRITE: TLSv1 Alert, length = 2
Gerd
This looks like a SSL protocol compatibility issue. Try using a
different version of the protocol (SSLv1 or TLSv1) and see if that makes
any difference.
Cheers
Oleg
---------------------------------------------------------------------
To unsubscribe, e-mail: httpclient-users-unsubscribe@hc.apache.org
For additional commands, e-mail: httpclient-users-help@hc.apache.org
Re: Trouble with TrustManager and TrustStrategy for self-signed-certificates
Posted by Gerhard Sinne <GS...@orga-systems.com>.
>
> Gerd
>
> I find it somewhat difficult to believe that the trust manager never
> gets called. You might want to turn on the SSL debugging to find out
> what certificates are trusted.
>
>
http://download.oracle.com/javase/1.5.0/docs/guide/security/jsse/ReadDebug.html
>
> Oleg
>
Oleg,
thanks for generous support and your valuable time. Really appreciate your
help as I'm stuck with
this problem for some time now.
I suspected my server beeing faulty, but I can connect with CURL and WGET
using HTTPS without
a problem.
Anyway, here is the important part of the Debug stack. The trustManager's
method are definetely not called.
------------------------------------------------------------------------------------------------------------
...
main, WRITE: SSLv2 client hello message, length = 98
[Raw write]: length = 100
...
main, received EOFException: error
main, handling exception: javax.net.ssl.SSLHandshakeException: Remote host
closed connection during handshake
main, SEND TLSv1 ALERT: fatal, description = handshake_failure
main, WRITE: TLSv1 Alert, length = 2
[Raw write]: length = 7
0000: 15 03 01 00 02 02 28 ......(
main, called closeSocket()
main, IOException in getSession(): javax.net.ssl.SSLHandshakeException:
Remote host closed connection during handshake
Exception in thread "main" javax.net.ssl.SSLPeerUnverifiedException: peer
not authenticated
at
com.sun.net.ssl.internal.ssl.SSLSessionImpl.getPeerCertificates(Unknown
Source)
at
org.apache.http.conn.ssl.AbstractVerifier.verify(AbstractVerifier.java:128)
at
org.apache.http.conn.ssl.SSLSocketFactory.connectSocket(SSLSocketFactory.java:391)
at
org.apache.http.impl.conn.DefaultClientConnectionOperator.openConnection(DefaultClientConnectionOperator.java:148)
at
org.apache.http.impl.conn.AbstractPoolEntry.open(AbstractPoolEntry.java:149)main,
called close()
main, called closeInternal(true)
at
org.apache.http.impl.conn.AbstractPooledConnAdapter.open(AbstractPooledConnAdapter.java:121)
at
org.apache.http.impl.client.DefaultRequestDirector.tryConnect(DefaultRequestDirector.java:562)
at
org.apache.http.impl.client.DefaultRequestDirector.execute(DefaultRequestDirector.java:415)
at
org.apache.http.impl.client.AbstractHttpClient.execute(AbstractHttpClient.java:700)
at
org.apache.http.impl.client.AbstractHttpClient.execute(AbstractHttpClient.java:625)
at
org.apache.http.impl.client.AbstractHttpClient.execute(AbstractHttpClient.java:603)
at ClientTrustManager.main(ClientTrustManager.java:46)
------------------------------------------------------------------------------------------------------------
What wonders me is this line:
main, IOException in getSession():
javax.net.ssl.SSLHandshakeException: Remote host closed connection during
handshake
but why then can I use CURL without a problem ?
Gerd
The information included in this e-mail and any files transmitted with it is strictly confidential and may be privileged or otherwise protected from disclosure. If you are not the intended recipient, please notify the sender immediately by e-mail and delete this e-mail as well as any attachment from your system. If you are not the intended recipient you are not authorized to use and/or copy this message and/or attachment and/or disclose the contents to any other person.
Re: Trouble with TrustManager and TrustStrategy for
self-signed-certificates
Posted by Oleg Kalnichevski <ol...@apache.org>.
On Mon, 2010-12-13 at 09:23 +0100, Gerhard Sinne wrote:
> Hi all,
> I've asked something similar before, so apologies if you feel its doubled.
>
> I have a https- Server that I need to connect to using HTTPS and digest
> authentication. This works perfect with plain HTTP.
>
> Now for SSL, I implemented a TrustManager with its methods as empty ones
> and connected it to the SSLFactory. But the methods
> are not even called during the httpclient.execute() call.
>
> Then I switched to TrustStrategy and connected this to the SSLFactory.
> Again no way. The isTrusted()- method of TrustStrategy is not even called.
>
> Instead both implementation just abort with
> javax.net.ssl.SSLPeerUnverifiedException: peer not authenticated.
>
> This is the essential code for TrustManager (X509TrustManager did not
> work either)
> ==============================================================================================
> public class ClientTrustManager {
>
> public final static void main(String[] args) throws Exception{
>
> SSLContext ctx = SSLContext.getInstance("TLS");
> MyTrustManager tm = new MyTrustManager();
> ctx.init (null, new TrustManager []{tm}, null);
> SSLSocketFactory socketFactory = new SSLSocketFactory(ctx);
>
> DefaultHttpClient httpclient = new DefaultHttpClient();
> httpclient.getConnectionManager().getSchemeRegistry().register(new
> Scheme("https", 443, socketFactory));
> httpclient.getCredentialsProvider() .setCredentials(new
> AuthScope(null, -1, null),
> new
> UsernamePasswordCredentials("...", "..."));
> HttpGet httpget = new HttpGet("https://192.168.111.56/...");
> HttpResponse response = httpclient.execute(httpget);
> }
> }
>
> class MyTrustManager implements TrustManager {
>
> public void checkClientTrusted(java.security.cert.X509Certificate[] xcs,
>
> String string) throws CertificateException {
> System.out.println("checkClientTrusted");
> }
> public java.security.cert.X509Certificate[] getAcceptedIssuers() {
> System.out.println("getAcceptedIssuers");
> return null;
> }
> public void checkServerTrusted(java.security.cert.X509Certificate[]
> arg0, String arg1) throws CertificateException {
> System.out.println("checkServerTrusted");
>
> }
> }
>
> And this is the essential code for TrustStrategy:
> ====================================================================================
> public class ClientTrustStrategy {
>
> public final static void main(String[] args) throws Exception{
>
> MyTrustStrategy ts = new MyTrustStrategy();
> SSLSocketFactory socketFactory = new SSLSocketFactory(ts);
> DefaultHttpClient httpclient = new DefaultHttpClient();
> httpclient.getConnectionManager().getSchemeRegistry().register(new
> Scheme("https", 443, socketFactory));
>
> httpclient.getCredentialsProvider().setCredentials(new AuthScope(null,
> -1, null),
> new
> UsernamePasswordCredentials("...", "..."));
> HttpResponse response = httpclient.execute(httpget);
> }
> }
> class MyTrustStrategy implements TrustStrategy {
>
> public boolean isTrusted(X509Certificate[] arg0, String authString)
> throws CertificateException {
> System.out.println("MyTrustStrategy.isTrusted:" + authString);
> return true;
> }
> }
> ====================================================================================
> Can somebody sched a light on this ?
>
> Thx for any help
> Gerd
>
Gerd
I find it somewhat difficult to believe that the trust manager never
gets called. You might want to turn on the SSL debugging to find out
what certificates are trusted.
http://download.oracle.com/javase/1.5.0/docs/guide/security/jsse/ReadDebug.html
Oleg
---------------------------------------------------------------------
To unsubscribe, e-mail: httpclient-users-unsubscribe@hc.apache.org
For additional commands, e-mail: httpclient-users-help@hc.apache.org