SSL (HTTPS) with self-signed certificate: keytool -import? Custom TrustManager? No trusted certificate found

Thread view:

Dave Briccetti - 14 Jun 2004 17:35 GMT

Hi. What is required to make an HTTPS connection to a server with a
self-signed certificate? Must the certificate be imported into the
client's .keystore or cacerts keystore? Is a custom TrustManager necessary?

(Why can I make an HTTPS connection to www.sun.com, without importing a
certificate? Is it because the certificate that www.sun.com provides is
signed by an authority that Java recognizes?)

Here's my code:

System.setProperty("javax.net.ssl.keyStore", (tried both home dir
.keystore and .../lib/security/cacerts after importing into both)
System.setProperty("javax.net.ssl.keyStorePassword","foo");
try {
java.net.URL url = new java.net.URL("https://a-web-server");
url.getContent();
} ...

It fails with:

javax.net.ssl.SSLHandshakeException:
sun.security.validator.ValidatorException: No trusted certificate found

Thanks in advance!

Dave Briccetti
www.davebsoft.com

Reply to this Message

Roedy Green - 14 Jun 2004 22:13 GMT

>Must the certificate be imported into the
>client's .keystore or cacerts keystore?

http://mindprod.com/jgloss/keytool.html#EXPORTING

Signature

Canadian Mind Products, Roedy Green.
Coaching, problem solving, economical contract programming.
See http://mindprod.com/jgloss/jgloss.html for The Java Glossary.

Reply to this Message

Dave Briccetti - 15 Jun 2004 01:42 GMT

>>Must the certificate be imported into the
>>client's .keystore or cacerts keystore?
>
> http://mindprod.com/jgloss/keytool.html#EXPORTING

Hi Roedy. Thanks for this reply (and another recent one). What you
pointed me to talks of private keys, which makes me think I didn't
explain clearly. The server end is working. This is the client, which
just needs the server's public key (in its certificate), right?

Reply to this Message

Roedy Green - 15 Jun 2004 01:57 GMT

>Hi Roedy. Thanks for this reply (and another recent one). What you
>pointed me to talks of private keys, which makes me think I didn't
>explain clearly. The server end is working. This is the client, which
>just needs the server's public key (in its certificate), right?

Nope. That would be an impossibly big job. All the browser needs is
the signing authority's public key, the root certificate. That is all
it needs to validate a public key of its certificate presented by the
server when challenged.

See http://mindprod.com/jgloss/certificate.html#ROOT

Signature

Canadian Mind Products, Roedy Green.
Coaching, problem solving, economical contract programming.
See http://mindprod.com/jgloss/jgloss.html for The Java Glossary.

Reply to this Message

Dave Briccetti - 15 Jun 2004 06:36 GMT

>>Hi Roedy. Thanks for this reply (and another recent one). What you
>>pointed me to talks of private keys, which makes me think I didn't
[quoted text clipped - 7 lines]
>
> See http://mindprod.com/jgloss/certificate.html#ROOT

I appreciate your help but your latest reply doesn't seem to address my
situation. This document you recommended talks about signing authorities
and getting updated root certificates, but this is a self-signed
certificate. Are you misunderstanding me, or am I misunderstanding you?

:-) Again, I appreciate your trying to help.

Reply to this Message

Roedy Green - 15 Jun 2004 06:41 GMT

>I appreciate your help but your latest reply doesn't seem to address my
>situation. This document you recommended talks about signing authorities
>and getting updated root certificates, but this is a self-signed
>certificate. Are you misunderstanding me, or am I misunderstanding you?

That's the disadvantage of self-signed certs. You have to get the
public key in all the browsers. This is only practical for in house
use or if you don't care that many people will not bother to
communicate with you.

See http://mindprod.com/jgloss/certificate.html#REAL

Signature

Canadian Mind Products, Roedy Green.
Coaching, problem solving, economical contract programming.
See http://mindprod.com/jgloss/jgloss.html for The Java Glossary.

Reply to this Message

Roedy Green - 15 Jun 2004 07:09 GMT

>That's the disadvantage of self-signed certs. You have to get the
>public key in all the browsers. This is only practical for in house
>use or if you don't care that many people will not bother to
>communicate with you.
>
>See http://mindprod.com/jgloss/certificate.html#REAL

I you are willing to use Applets or JWS, instead of browser FORMS, I
have devised a scheme for secure transmission that does not require
any SSL certificate at all.

See http://mindprod.com/products.html#WRAPPER.

Signature

Canadian Mind Products, Roedy Green.
Coaching, problem solving, economical contract programming.
See http://mindprod.com/jgloss/jgloss.html for The Java Glossary.

Reply to this Message

Dave Briccetti - 15 Jun 2004 08:05 GMT

>>That's the disadvantage of self-signed certs. You have to get the
>>public key in all the browsers. This is only practical for in house
[quoted text clipped - 8 lines]
>
> See http://mindprod.com/products.html#WRAPPER.

I never mentioned browser forms, but I did say I wanted this code to work:

java.net.URL url = new java.net.URL("https://a-web-server");
url.getContent();

"a-web-server" is an in-house development server which gives a
self-signed certificate.

I'll save your excellent tips for the future, when I might be doing the
things that they relate to. Thanks again, Roedy.

Any ideas from other folks?

Reply to this Message

Roedy Green - 15 Jun 2004 21:01 GMT

>"a-web-server" is an in-house development server which gives a
>self-signed certificate.

one more idea for you to reject.

http://mindprod.com/projects/rootcertinstaller.html

Signature

Canadian Mind Products, Roedy Green.
Coaching, problem solving, economical contract programming.
See http://mindprod.com/jgloss/jgloss.html for The Java Glossary.

Reply to this Message

SSL (HTTPS) with self-signed certificate: keytool -import? Custom TrustManager? No trusted certificate found

Free Magazines