You are viewing a plain text version of this content. The canonical link for it is here.
Posted to httpclient-users@hc.apache.org by Terehoff Alex <te...@bah.com> on 2006/04/26 00:32:53 UTC
HttpClient with certificate issued by Oracle OCA
We are using HttpClient with EasySSLProtocolSocketFactory and
EasyX509TrustManager over SSL enabled on Oracle Application Server 10g
and we are getting the following error:
java.security.cert.CertificateException: Untrusted Server Certificate
Chain
We are using Oracle OCA (Certificate Authority) and Wallet manager.
Sertificate is configured correctly and works OK when using Web Browser
(IE, Mozilla, Netscape). The issue however comes when we are attempting
to use HttpClient to make a call to one of the SSL protected resources
on the AS, as the certificate is self-signed and untrusted.
I wonder if sombody can give an advise how to resolve this issue.
In production release we are planning to use self-signed certificates.
Here is a trace from the log generated by HttpClient about the
certificate including the error:
[
Version: V3
Subject: CN=Trac2es Dev Certificate Authority, OU=Trac2es, O=BAH, C=US
Signature Algorithm: MD5withRSA, OID = 1.2.840.113549.1.1.4
Key: SunJSSE RSA public key:
public exponent:
010001
modulus:
bdd87896 e39e7d15 43bb636c 1c5fa020 7cf144fe 619eac75 07f5d9bb
c936b556
8bc5af9b fc4b65c3 5c3d7077 2030247e 859cca23 b3ae0b48 338cb143
df83b2e1
ea1098a9 af7c95b8 bc07e521 ef7c8fc2 86d9723c 3ccbd9c8 9d18b668
0dcb8bc2
8138417a cc86fca8 0f0967ba b6755492 1420319c b64b053f add3dada
7ddf5d96
1ce1cfdf 76916073 89e503bd 95c3a7d4 08ae5561 c30e19fa 864ff0b3
dcc70b10
27049610 cbe30a67 043e4509 6a60aba2 c41ebae8 11ce3860 c4941a59
e75946a8
b5e01781 fc2aa006 f398a8ce 1f83469f 6f0b09b4 c5fe699c aca02d57
87868cd8
86dfe9bf a3e50cc2 801de477 ee035a40 584af458 8256ac2a cfccbeec
2c81dbc9
Validity: [From: Fri Mar 24 11:27:24 EST 2006,
To: Mon Mar 21 11:27:24 EST 2016]
Issuer: CN=Trac2es Dev Certificate Authority, OU=Trac2es, O=BAH, C=US
SerialNumber: [ 01]
Certificate Extensions: 2
[1]: ObjectId: 2.5.29.15 Criticality=true
KeyUsage [
Key_CertSign
Crl_Sign
]
[2]: ObjectId: 2.5.29.19 Criticality=true
BasicConstraints:[
CA:true
PathLen:3
]
]
Algorithm: [MD5withRSA]
Signature:
0000: 68 C3 DE 5A 79 71 CA C0 3B 48 2C F1 AB 75 5C 28
h..Zyq..;H,..u\(
0010: B2 2D 10 E9 B3 79 47 FB AD 1C BF 8F 20 BE E3 67 .-...yG.....
..g
0020: 70 88 95 4A 68 48 60 D0 7F AD 28 A9 6F 15 A4 0C
p..JhH`...(.o...
0030: CE 1F CC 3B 5C 6C E1 71 5A CF FE 74 C6 D1 47 D9
...;\l.qZ..t..G.
0040: 2C C1 CC 7D 5C F0 37 53 11 87 22 6E A8 E9 B8 A2
,...\.7S.."n....
0050: C3 22 99 D1 2D 09 3C 23 1D CE C2 84 1B 32 21 F6
."..-.<#.....2!.
0060: 17 DB D0 B3 B2 A6 AF D5 99 85 6F BF 7F D5 FC 1A
..........o.....
0070: 1A 60 49 B5 9A 82 17 E6 03 B1 51 8A 8A DA 43 AB
.`I.......Q...C.
0080: F4 67 EB 99 77 60 51 4E 60 5B 5C 72 F6 B7 48 3C
.g..w`QN`[\r..H<
0090: DD A7 0E 3D 9D 01 54 7A 2D 9E C7 E7 70 70 29 F5
...=..Tz-...pp).
00A0: 34 6D AA C6 30 34 8F FC 9F 7B 83 ED 95 17 60 5F
4m..04........`_
00B0: 52 8B D3 74 33 13 A7 5A 23 5B 69 D0 05 10 19 B6
R..t3..Z#[i.....
00C0: 93 49 AF 83 3B E8 47 85 3A D7 3A CD B1 BD 7D CA
.I..;.G.:.:.....
00D0: 14 01 32 CF 3C 59 02 A6 D3 2E 46 8B 44 FA C2 ED
..2.<Y....F.D...
00E0: 0B 44 5D B8 D3 F8 72 7A 04 0E AB AA 10 46 D0 2B
.D]...rz.....F.+
00F0: EC 30 75 6E 1B 03 EB 02 9B 19 DB 97 8C D2 AE A9
.0un............
]
DEBUG AJPRequestHandler-ApplicationServerThread-16
org.apache.commons.httpclient.HttpMethodDirector - Closing the
connection.
DEBUG AJPRequestHandler-ApplicationServerThread-16
org.apache.commons.httpclient.HttpConnection - enter
HttpConnection.close()
DEBUG AJPRequestHandler-ApplicationServerThread-16
org.apache.commons.httpclient.HttpConnection - enter
HttpConnection.closeSockedAndStreams()
DEBUG AJPRequestHandler-ApplicationServerThread-16
org.apache.commons.httpclient.HttpMethodDirector - Method retry handler
returned false. Automatic recovery will not be attempted
DEBUG AJPRequestHandler-ApplicationServerThread-16
org.apache.commons.httpclient.HttpConnection - enter
HttpConnection.releaseConnection()
DEBUG AJPRequestHandler-ApplicationServerThread-16
org.apache.commons.httpclient.HttpConnection - Releasing connection back
to connection manager.
INFO AJPRequestHandler-ApplicationServerThread-16
mil.transcom.trac2es.portal.util.CustomSocketConnector - AGT:[LOGON]
Error: java.security.cert.CertificateException: Untrusted Server
Certificate Chain
Re: HttpClient with certificate issued by Oracle OCA
Posted by Julius Davies <ju...@cucbc.com>.
Hi, Alex,
Here's an old email I wrote in February about this. It might help.
On Fri, 2006-17-02 at 14:21 -0800, Julius Davies wrote:
>
> I'm working on a solution to this. I have to improve the comments and
> code style, but other than that, I think this should work for you!
>
> http://juliusdavies.ca/httpclient-contrib/
>
> You can compile the code yourself, or you can put
> "httpclient-contrib.jar" in your classpath:
>
> http://juliusdavies.ca/httpclient-contrib/httpclient-contrib.jar
>
> Here are the instructions for use:
>
> ===================================================
>
> TrustSSLProtocolSocketFactory allows you exercise full control over the
> HTTPS server certificates you are going to trust. Instead of relying on
> the Certificate Authorities already present in
> "jre/lib/security/cacerts", TrustSSLProtocolSocketFactory only trusts
> the public certificates you provide to its constructor.
>
> TrustSSLProtocolSocketFactory can be used to create SSLSockets that
> accept self-signed certificates. Unlike EasySSLProtocolSocketFactory,
> TrustSSLProtocolSocketFactory can be used in production. This is because
> it forces you to pre-install (on your local machine) the self-signed
> certificate you are going to trust.
>
> TrustSSLProtocolSocketFactory can parse both Java Keystore Files (*.jks)
> and base64 PEM encoded public certificates (*.pem).
>
> Example of using TrustSSLProtocolSocketFactory
>
> 1. First we must find the certificate we want to trust. In this example
> we'll use gmail.google.com's certificate.
>
> openssl s_client -showcerts -connect gmail.google.com:443
>
> 2. Cut & paste into a "cert.pem" any certificates you are interested in
> trusting in accordance with your security policies. In this example I'll
> actually use the current "gmail.google.com" certificate (instead of the
> Thawte CA certificate that signed the gmail certificate - that would be
> too boring) - but it expires on June 7th, 2006, so this example won't be
> useful for very long!
>
> Here's what my "cert.pem" file looks like:
>
> -----BEGIN CERTIFICATE-----
> MIIDFjCCAn+gAwIBAgIDP3PeMA0GCSqGSIb3DQEBBAUAMEwxCzAJBgNVBAYTAlpB
> MSUwIwYDVQQKExxUaGF3dGUgQ29uc3VsdGluZyAoUHR5KSBMdGQuMRYwFAYDVQQD
> Ew1UaGF3dGUgU0dDIENBMB4XDTA1MDYwNzIyMTI1N1oXDTA2MDYwNzIyMTI1N1ow
> ajELMAkGA1UEBhMCVVMxEzARBgNVBAgTCkNhbGlmb3JuaWExFjAUBgNVBAcTDU1v
> dW50YWluIFZpZXcxEzARBgNVBAoTCkdvb2dsZSBJbmMxGTAXBgNVBAMTEGdtYWls
> Lmdvb2dsZS5jb20wgZ8wDQYJKoZIhvcNAQEBBQADgY0AMIGJAoGBALoRiWYW0hZw
> 9TSn3s9912syZg1CP2TaC86PU1Ao2qf3pVu7Mx10Wl8W+aKZrQlvrYjTwku4sEh+
> 9uI+gWnfmCd0OyVcXr1eFOGCYiiyaPv79Wtb0m0d8GuiRSJhYkZGzGlgFViws2vR
> BAMCD2fdp7WGJUVGYOO+s52dgAMUHQXxAgMBAAGjgecwgeQwKAYDVR0lBCEwHwYI
> KwYBBQUHAwEGCCsGAQUFBwMCBglghkgBhvhCBAEwNgYDVR0fBC8wLTAroCmgJ4Yl
> aHR0cDovL2NybC50aGF3dGUuY29tL1RoYXd0ZVNHQ0NBLmNybDByBggrBgEFBQcB
> AQRmMGQwIgYIKwYBBQUHMAGGFmh0dHA6Ly9vY3NwLnRoYXd0ZS5jb20wPgYIKwYB
> BQUHMAKGMmh0dHA6Ly93d3cudGhhd3RlLmNvbS9yZXBvc2l0b3J5L1RoYXd0ZV9T
> R0NfQ0EuY3J0MAwGA1UdEwEB/wQCMAAwDQYJKoZIhvcNAQEEBQADgYEAktM1l1cV
> ebi+Uo6fCE/eLnvvY6QbNNCsU5Pi9B5E1BlEUG+AGpgzE2cSPw1N4ZZb+2AWWwjx
> H8/IrJ143KZZXM49ri3Z2e491Jj8qitrMauT7/hb16Jw6I02/74/do4TtHu/Eifr
> EZCaSOobSHGeufHjlqlC3ehC4Bx4mLexIMk=
> -----END CERTIFICATE-----
>
> 3. Run "openssl x509" to analyze the certificate more deeply. This helps
> us answer questions like "Do we really want to trust it? When does it
> expire? What's the value of the CN (Common Name) field?".
>
> "openssl x509" is also super cool, and will impress all your friends,
> coworkers, family, and that cute girl at the starbucks. :-)
>
> If you dig through "man x509" you'll find this example. Run it:
>
> openssl x509 -in cert.pem -noout -text
>
> 4. Rename "cert.pem" to "gmail.pem" so that step 5 works.
>
> 5. Setup the TrustSSLProtocolSocketFactory to trust "gmail.google.com"
> for URLS of the form "https-gmail://" - but don't trust anything else
> when using "https-gmail://":
>
> TrustSSLProtocolSocketFactory sf = new TrustSSLProtocolSocketFactory( "/path/to/gmail.pem" );
> Protocol trustHttps = new Protocol("https-gmail", sf, 443);
> Protocol.registerProtocol("https-gmail", trustHttps);
>
> HttpClient client = new HttpClient();
> GetMethod httpget = new GetMethod("https-gmail://gmail.google.com/");
> client.executeMethod(httpget);
>
> 6. Notice that "https-gmail://" cannot connect to "www.wellsfargo.com" -
> the server's certificate isn't trusted! It would still work using
> regular "https://" because Java would use the "jre/lib/security/cacerts"
> file.
>
> httpget = new GetMethod("https-gmail://www.wellsfargo.com/");
> client.executeMethod(httpget);
>
> javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: No trusted certificate found
>
>
> 7. Of course "https-gmail://" cannot connect to hosts where the CN field
> in the certificate doesn't match the hostname. The same is supposed to
> be true of regular "https://", but HTTPClient is a bit lenient.
>
> httpget = new GetMethod("https-gmail://gmail.com/");
> client.executeMethod(httpget);
>
> javax.net.ssl.SSLException: hostname in certificate didn't match: <gmail.com> != <gmail.google.com>
>
>
> 8. You can use "*.jks" files instead of "*.pem" if you prefer. Use the 2nd constructor
> in that case to pass along the JKS password:
>
> new TrustSSLProtocolSocketFactory( "/path/to/gmail.jks", "my_password".toCharArray() );
>
>
>
> On Fri, 2006-17-02 at 10:54 -0500, jwa@urbancode.com wrote:
> > I have a site using a self-signed certificate.
> > Is there a default local trustStore (and default password) that httpclient
> > will use without having to set the javax.net.ssl.trusStore systemProperty?
> >
> > ---------------------------------------------------------------------
> > To unsubscribe, e-mail: httpclient-user-unsubscribe@jakarta.apache.org
> > For additional commands, e-mail: httpclient-user-help@jakarta.apache.org
> >
>
On Tue, 2006-25-04 at 18:32 -0400, Terehoff Alex wrote:
> We are using HttpClient with EasySSLProtocolSocketFactory and
> EasyX509TrustManager over SSL enabled on Oracle Application Server 10g
> and we are getting the following error:
>
>
> java.security.cert.CertificateException: Untrusted Server Certificate
> Chain
>
> We are using Oracle OCA (Certificate Authority) and Wallet manager.
> Sertificate is configured correctly and works OK when using Web Browser
> (IE, Mozilla, Netscape). The issue however comes when we are attempting
> to use HttpClient to make a call to one of the SSL protected resources
> on the AS, as the certificate is self-signed and untrusted.
>
> I wonder if sombody can give an advise how to resolve this issue.
>
> In production release we are planning to use self-signed certificates.
>
> Here is a trace from the log generated by HttpClient about the
> certificate including the error:
>
--
Julius Davies
Senior Application Developer, Technology Services
Credit Union Central of British Columbia
http://www.cucbc.com/
Tel: 604-730-6385
Cel: 604-868-7571
Fax: 604-737-5910
1441 Creekside Drive
Vancouver, BC
Canada
V6J 4S7
http://juliusdavies.ca/
---------------------------------------------------------------------
To unsubscribe, e-mail: httpclient-user-unsubscribe@jakarta.apache.org
For additional commands, e-mail: httpclient-user-help@jakarta.apache.org