1. Problem
Set up a localhost Tomcat to support SSL and deployed this web service for testing. While connecting to the deployed web service over SSL connection via this URL : https://localhost:8443/HelloWorld/hello?wsdl, it hits
Terminal
javax.net.ssl.SSLHandshakeException:
sun.security.validator.ValidatorException: PKIX path building failed:
sun.security.provider.certpath.SunCertPathBuilderException:
unable to find valid certification path to requested target
Caused by: sun.security.validator.ValidatorException:
PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException:
unable to find valid certification path to requested target
Caused by: sun.security.provider.certpath.SunCertPathBuilderException:
unable to find valid certification path to requested target
2. Solution
The caused of the problem and solution are both well explained in this article
No more SUN
It’s on Github Now https://github.com/escline/InstallCert
It’s on Github Now https://github.com/escline/InstallCert
P.S Creadit to users : Charles and Lúthien
2.1 Get InstallCert.java
2.2 Add Trusted Keystore
Run InstallCert.java, with your hostname and https port, and press 1 when ask for input. It will add your localhost as a trusted keystore, and generates a file jssecacerts
Terminal
C:\>java InstallCert localhost:8443
Loading KeyStore C:\Program Files\Java\jre6\lib\security\cacerts...
Opening connection to localhost:8443...
Starting SSL handshake...
javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.
provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
at com.sun.net.ssl.internal.ssl.Alerts.getSSLException(Unknown Source)
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.fatal(Unknown Source)
at com.sun.net.ssl.internal.ssl.Handshaker.fatalSE(Unknown Source)
at com.sun.net.ssl.internal.ssl.Handshaker.fatalSE(Unknown Source)
at com.sun.net.ssl.internal.ssl.ClientHandshaker.serverCertificate(Unknown Source)
at com.sun.net.ssl.internal.ssl.ClientHandshaker.processMessage(Unknown Source)
at com.sun.net.ssl.internal.ssl.Handshaker.processLoop(Unknown Source)
at com.sun.net.ssl.internal.ssl.Handshaker.process_record(Unknown Source)
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.readRecord(Unknown Source)
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.performInitialHandshake(Unknown Source)
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(Unknown Source)
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(Unknown Source)
at InstallCert.main(InstallCert.java:87)
Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertP
athBuilderException: unable to find valid certification path to requested target
at sun.security.validator.PKIXValidator.doBuild(Unknown Source)
at sun.security.validator.PKIXValidator.engineValidate(Unknown Source)
at sun.security.validator.Validator.validate(Unknown Source)
at com.sun.net.ssl.internal.ssl.X509TrustManagerImpl.validate(Unknown Source)
at com.sun.net.ssl.internal.ssl.X509TrustManagerImpl.checkServerTrusted(Unknown Source)
at InstallCert$SavingTrustManager.checkServerTrusted(InstallCert.java:182)
... 9 more
Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to reques
ted target
at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(Unknown Source)
at java.security.cert.CertPathBuilder.build(Unknown Source)
... 15 more
Server sent 1 certificate(s):
1 Subject CN=yong mook kim, OU=mkyong, O=mkyong, L=puchong, ST=PJ, C=my
Issuer CN=yong mook kim, OU=mkyong, O=mkyong, L=puchong, ST=PJ, C=my
sha1 32 3e 15 42 96 ba e9 4d 9c 5d e7 5e 6b 0f 30 23 b4 e3 f4 98
md5 c8 dd a1 af 9f 55 a0 7f 6e 98 10 de 8c 63 1b a5
Enter certificate to add to trusted keystore or 'q' to quit: [1]
1
[
[
Version: V3
Subject: CN=yong mook kim, OU=mkyong, O=mkyong, L=puchong, ST=PJ, C=my
Signature Algorithm: SHA1withRSA, OID = 1.2.840.113549.1.1.5
Key: Sun RSA public key, 1024 bits
modulus: 1129473579651954554552730664834664064459539051598864058082387115962631728819634110255367718769683451438528187
923246533854744470790959477657386037636238098777089479256059697784394926741427654735994678054030193662669088404706890444
59364523220747231216704221781747262219695262340353839314222273672957748320603247
public exponent: 65537
Validity: [From: Tue Dec 14 15:13:51 SGT 2010,
To: Mon Mar 14 15:13:51 SGT 2011]
Issuer: CN=yong mook kim, OU=mkyong, O=mkyong, L=puchong, ST=PJ, C=my
SerialNumber: [ 4d07192f]
]
Algorithm: [SHA1withRSA]
Signature:
0000: 38 E4 F4 D9 51 B1 5F C1 01 13 32 79 DE 97 26 58 8...Q._...2y..&X
0010: 13 08 F1 A0 33 DB B9 90 AF EE 9E AE B9 9B 68 7D ....3.........h.
0020: DF E8 7D 79 9D 92 24 4A 76 C9 4C 28 DA 68 B0 62 ...y..$Jv.L(.h.b
0030: FF AB 27 03 5C DD 1F C8 77 A2 25 18 DF 0C DC FD ..'.\...w.%.....
0040: D3 39 5D 18 B4 BA 4B 36 8C FD C5 80 FF F2 E3 4D .9]...K6.......M
0050: 0A 28 57 B9 04 D8 25 F6 FB CA DA 13 0C 36 FB 02 .(W...%......6..
0060: 9A B3 B1 28 46 D1 8E C7 D9 1A 5B CE BB A6 6F FD ...(F.....[...o.
0070: 6D F2 35 D9 95 43 6E 38 2A 56 E7 31 21 D9 F0 90 m.5..Cn8*V.1!...
]
Added certificate to keystore 'jssecacerts' using alias 'localhost-1'
2.3 Verify Trusted Keystore
Try run the InstallCert command again, the connection should be ok now.
C:\>java InstallCert localhost:8443
Loading KeyStore jssecacerts...
Opening connection to localhost:8443...
Starting SSL handshake...
No errors, certificate is already trusted
Server sent 1 certificate(s):
1 Subject CN=yong mook kim, OU=mkyong, O=mkyong, L=puchong, ST=PJ, C=my
Issuer CN=yong mook kim, OU=mkyong, O=mkyong, L=puchong, ST=PJ, C=my
sha1 32 3e 15 42 96 ba e9 4d 9c 5d e7 5e 6b 0f 30 23 b4 e3 f4 98
md5 c8 dd a1 af 9f 55 a0 7f 6e 98 10 de 8c 63 1b a5
Enter certificate to add to trusted keystore or 'q' to quit: [1]
q
KeyStore not changed
C:\>
2.4 Copy jssecacerts
Copy the generated jssecacerts file to your $JAVA_HOME\jre\lib\security folder.
Run your web service client again, it should be working now.
Not sure if I understand everything mentioned in this article, but it worked for me. I was improving existing code to call a REST service to get a token, but could not test it on my local environment. After following the steps, it just worked. However, why it was working when pointing to JDK 18? I got the errors shown in the article above only when pointing to JDK 1.8. Can anyone explain why?
great work
Certificate for <veishydcnt00718> doesn’t match any of the subject alternative names: []
i am facing above error after the above steps
There is a problem which i am facing while implementing this :
PS C:\certificates> java InstallCert localhost:8080
Error: Could not find or load main class InstallCert
PS C:\certificates> java InstallCert.java localhost:8080
Error: Could not find or load main class InstallCert.java
I am using windows.
Thank you very much! I really don’t have experience configuring HTTP server. So do you know where I can get more info about https, ssl within IIS server?
Thanks a lot man
Thank you very much… I waste one hour of my time googling and trying different not working solutions… This only one that helped.
Thank you Mkyong. I am occasionally reading your blog for a 5 years and your posts are really helpful most of the times, you compete with Baeldong 🙂
java InstallCert localhost : 8084
Loading KeyStore C:\Program Files\Java\jre1.8.0_192\lib\security\cacerts…
Opening connection to localhost:8084
Exception in thread “main” java.net.ConnectException: Connection refused: connect
at java.net.DualStackPlainSocketImpl.connect0(Native Method)
at java.net.DualStackPlainSocketImpl.socketConnect(Unknown Source)
at java.net.AbstractPlainSocketImpl.doConnect(Unknown Source)
at java.net.AbstractPlainSocketImpl.connectToAddress(Unknown Source)
at java.net.AbstractPlainSocketImpl.connect(Unknown Source)
at java.net.PlainSocketImpl.connect(Unknown Source)
at java.net.SocksSocketImpl.connect(Unknown Source)
at java.net.Socket.connect(Unknown Source)
at sun.security.ssl.SSLSocketImpl.connect(Unknown Source)
at sun.security.ssl.SSLSocketImpl.(Unknown Source)
at sun.security.ssl.SSLSocketFactoryImpl.createSocket(Unknown Source)
at InstallCert.main(InstallCert.java:94)
could you plase help me in this
Please update the blog
D:\>java InstallCert 165.225.104.32:10223
Loading KeyStore C:\Program Files\Java\jre1.8.0_181\lib\security\cacerts…
Opening connection to 165.225.104.32:10223…
Starting SSL handshake…
Exception in thread “main” java.net.SocketTimeoutException: Read timed out
at java.net.SocketInputStream.socketRead0(Native Method)
at java.net.SocketInputStream.socketRead(Unknown Source)
at java.net.SocketInputStream.read(Unknown Source)
at java.net.SocketInputStream.read(Unknown Source)
at sun.security.ssl.InputRecord.readFully(Unknown Source)
at sun.security.ssl.InputRecord.read(Unknown Source)
at sun.security.ssl.SSLSocketImpl.readRecord(Unknown Source)
at sun.security.ssl.SSLSocketImpl.performInitialHandshake(Unknown Source)
at sun.security.ssl.SSLSocketImpl.startHandshake(Unknown Source)
at sun.security.ssl.SSLSocketImpl.startHandshake(Unknown Source)
at InstallCert.main(InstallCert.java:98)
Can u please resolve this issue
thanks guru…love your solution. it saved my life
Hi mkyong, I have read the above article and it has solved the problem at my workplace. Thank you!
But I have just followed the steps. I did not understand the cause of this issue. Could you please help me understand it in a detailed way.
http://blogs.sun.com/andreas/resource/InstallCert.java
404
We are using Quovadis certifcate on server and their validity is only one year i.e it always renew every year.
We are creating certificate on client side by using InstallCert but this client side certificate is also valid for one year. How we can create cleint side certifcate that is not dependent upon duration.
Hello, I am facing issue
C:\>java InstallCert localhost:8082
Loading KeyStore C:\Program Files (x86)\Java\jre1.8.0_151\lib\security\cacerts..
.
Opening connection to localhost:8082…
Starting SSL handshake…
Exception in thread “main” java.net.SocketTimeoutException: Read timed out
at java.net.SocketInputStream.socketRead0(Native Method)
at java.net.SocketInputStream.socketRead(Unknown Source)
at java.net.SocketInputStream.read(Unknown Source)
at java.net.SocketInputStream.read(Unknown Source)
at sun.security.ssl.InputRecord.readFully(Unknown Source)
at sun.security.ssl.InputRecord.read(Unknown Source)
at sun.security.ssl.SSLSocketImpl.readRecord(Unknown Source)
at sun.security.ssl.SSLSocketImpl.performInitialHandshake(Unknown Source
)
at sun.security.ssl.SSLSocketImpl.startHandshake(Unknown Source)
at sun.security.ssl.SSLSocketImpl.startHandshake(Unknown Source)
at InstallCert.main(InstallCert.java:98)
great i got it!!!!thanks
java.net.ConnectException: Connection refused error
Brilliant! This issue fazed me for some time, but got it fixed via this article .. just update the link to the utility, it’s on Github now: https://github.com/escline/InstallCert/issues
Quick question — I run this and it generates a certificate but it’s an expired certificate with unknown values for the Issuer and Subject. Any ideas as to why this would be?
Hello, this work perfectly in netbeans, but it doesn’t work when I execute the command: java -jar … pls help me
https://github.com/escline/InstallCert
I have used this generator and works fine!
The above steps returns me error once I executed InsertCert as
Loading KeyStore /Library/Java/JavaVirtualMachines/jdk1.8.0_60.jdk/Contents/Home/jre/lib/security/cacerts...Opening connection to localhost:8443...
Exception in thread "main" java.net.ConnectException: Connection refused
at java.net.PlainSocketImpl.socketConnect(Native Method)
at java.net.AbstractPlainSocketImpl.doConnect(AbstractPlainSocketImpl.java:350)
at java.net.AbstractPlainSocketImpl.connectToAddress(AbstractPlainSocketImpl.java:206)
at java.net.AbstractPlainSocketImpl.connect(AbstractPlainSocketImpl.java:188)
at java.net.SocksSocketImpl.connect(SocksSocketImpl.java:392)
at java.net.Socket.connect(Socket.java:589)
at sun.security.ssl.SSLSocketImpl.connect(SSLSocketImpl.java:668)
at sun.security.ssl.SSLSocketImpl.<init>(SSLSocketImpl.java:427)
at sun.security.ssl.SSLSocketFactoryImpl.createSocket(SSLSocketFactoryImpl.java:88)
at programs.General.InstallCert.main(InstallCert.java:87)
can any one please share soltion to above I am also experiencing same issue
https://stackoverflow.com/questions/35639384/java-ssl-connection-refused
these links
http://blogs.sun.com/andreas/entry/no_more_unable_to_find
http://blogs.sun.com/andreas/resource/InstallCert.java
are no more available…
Sorry for the late update, it’s on Github now – https://github.com/escline/InstallCert
After lot of struggling get this links and this methods works well.. thanks for sharing
This guy and his tutorials always make me smiles.
This tutorial works fine with me.
Thanks for sharing
May I know how long does this Cert can last for?
Nice tutorial! Found that the default valid period of the Cert is 1 year. How can I change the default period?
getting a 404 on all the links 🙁
Hi MK, Can u please update the link http://blogs.sun.com/andreas/resource/InstallCert.java .because it shows 404
Thank you
As sun;s link is down, one can find the InstallCert.java here
https://java-use-examples.googlecode.com/svn/trunk/src/com/aw/ad/util/InstallCert.java
Link for InstallCert is no longer active, this is the new link: https://code.google.com/p/java-use-examples/source/browse/trunk/src/com/aw/ad/util/InstallCert.java
https://java-use-examples.goog…
G:>java InstallCert localhost:7070
Hi Guys am getting this error. please help me..
Loading KeyStore G:JDK7.0jrelibsecuritycacerts…
Opening connection to localhost:7070…
Starting SSL handshake…
javax.net.ssl.SSLException: Unrecognized SSL message, plaintext connection?
at sun.security.ssl.InputRecord.handleUnknownRecord(InputRecord.java
)
at sun.security.ssl.InputRecord.read(InputRecord.java:504)
at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:927)
at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketI
java:1312)
at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:
)
at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:
)
at InstallCert.main(InstallCert.java:57)
Could not obtain server certificate chain
G:>
Dead link. Maybe this helps: https://code.google.com/p/java-use-examples/source/browse/trunk/src/com/aw/ad/util/InstallCert.java
I am running the webservice call in my workspace. It works the first time. Next day I come, somehow I have to do it again. Not sure why it not taking it permanent .???
This is awesome!!!!Thanks much. It works good now for me.
https://blogs.oracle.com/gc/entry/unable_to_find_valid_certification
Unfortunely link to the article is broken. Without this link its hard to understand what was the cause and an approach of solution.
Thanks for help
hello everyone !
anyone who has been working on EJBCA Webservices ?
i am trying to call my webservice methods from a client machine and i am getting the below exceptions :
javax.xml.ws.WebServiceException: Failed to access the WSDL at:https://example.com:8442/ejbca/ejbcaws/ejbcaws?wsdl. It failed with:
sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target.
can anyone tell me a working solution for this : Your Effort would be appreciated greately .
I have the Issue while using the solution you have mention above
C:Users291767>java InstallCert localhost:8443
Loading KeyStore C:Program FilesJavajre7libsecuritycacerts…
Opening connection to localhost:8443…
Exception in thread “main” java.net.ConnectException: Connection refused: connec
t
at java.net.DualStackPlainSocketImpl.connect0(Native Method)
at java.net.DualStackPlainSocketImpl.socketConnect(Unknown Source)
at java.net.AbstractPlainSocketImpl.doConnect(Unknown Source)
at java.net.AbstractPlainSocketImpl.connectToAddress(Unknown Source)
at java.net.AbstractPlainSocketImpl.connect(Unknown Source)
at java.net.PlainSocketImpl.connect(Unknown Source)
at java.net.SocksSocketImpl.connect(Unknown Source)
at java.net.Socket.connect(Unknown Source)
at sun.security.ssl.SSLSocketImpl.connect(Unknown Source)
at sun.security.ssl.SSLSocketImpl.(Unknown Source)
at sun.security.ssl.SSLSocketFactoryImpl.createSocket(Unknown Source)
at InstallCert.main(InstallCert.java:94)
Am getting this above exception can u please give me a solution?
Thanks it works! Now I can continue doing JSON posts in SSL.
Thanks and very useful
Thank you very much . U saved my life 🙂 . Works as a magic .
thankyou that works me
I owe you man.. I shouldn’t have overlooked your solution. None of the keytool -import solutions worked for me.
I’m not sure what InstallCert buys you. Is there a difference between using this and just using keytool? I normally:
1) keytool s_client -connect : -showcerts
2) copy the text from cert you want into a file
3) keytool -import -trustcacerts -file [-keystore mystore]
pretty simple.
Thanks for the tip! I assume that you meant openssl on (1):
openssl s_client -connect : -showcertswhile running the InstallCert.java
I am getting the following exception
C:>java InstallCert localhost:8080
Loading KeyStore C:Program FilesJavajre1.7.0libsecuritycacerts…
Opening connection to localhost:8080…
Starting SSL handshake…
Exception in thread “main” java.net.SocketException: Connection reset
at java.net.SocketInputStream.read
at com.sun.net.ssl.internal.ssl.InputRecord.readFully
Hi,
when I tried to give the hostname as parameter for Installcerts.java, its giving unknown hostname error , but If I try with IP address it works but at later stage when I try to login into my application I am facing the error ” javax.net.ssl.SSLHandshakeException: java.security.cert.CertificateException: No subject alternative names present “. I could not understand how to resolve it . I
tried a lot to search in google but was unsuccessful. I am a
master’s student and quite new to all these.
Where can I get help regarding this ? Any help is appreciated.
Thanks for the code. I built on top of this code in an attempt to automatically install the certificate to get up and running quickly with the JIRA rest API.
You can use SSLHandler to do this.
The code sample is available at: http://scottizu.wordpress.com/2014/04/04/using-webresource-and-jirarestclient-to-connect-to-jira/
Always the first place I look for when stuck technically!!!! Awesome.
Thanks.. The solution is really helpfull
I have added the certificates to jssecacerts and checked the jssecacerts and my certificates are listed . but i still get the same error.
is there any way to generate the certificate
https://github.com/escline/InstallCert
Can someone please add the steps for Configuring the SSL in Jetty.Please……………
Eres un chingon pinche mkyong
Jajaja Saludos desde México DF
works like charm. monitoring your posts, really valid ones – kudos 2 u.
You have to modify your InstallCert.java like file should be change cacerts because If you use jsscacerts it your previous certificate will lost.
Hi Mkyong,
Thank you very much for the helpful tutorial. By following given steps it was able to successfully avoid the below exception we got when reading inbox via mail.pop3.ssl.
javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
Thanks Again,
Jayasiri
it worked with me only with following command: java InstallCert localhost:443
While running second time, I am getting below error. This is SVN connection host:port
C:\syntran>java InstallCert webeaen22l.nam.nsroot.net:9050
Loading KeyStore jssecacerts…
Opening connection to webeaen22l.nam.nsroot.net:9050…
Starting SSL handshake…
javax.net.ssl.SSLException: Received fatal alert: bad_record_mac
at com.sun.net.ssl.internal.ssl.Alerts.getSSLException(Alerts.java:190
at com.sun.net.ssl.internal.ssl.Alerts.getSSLException(Alerts.java:136
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.recvAlert(SSLSocketImpl.
va:1657)
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.readRecord(SSLSocketImpl
ava:932)
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.performInitialHandshake(
LSocketImpl.java:1096)
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(SSLSocket
pl.java:1123)
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(SSLSocket
pl.java:1107)
at InstallCert.main(InstallCert.java:87)
Server sent 1 certificate(s):
highly appriecite you
Loading KeyStore C:\Program Files (x86)\Java\jre7\lib\security\cacerts…
Exception in thread “main” java.io.IOException: Keystore was tampered with, or password was incorrect
at sun.security.provider.JavaKeyStore.engineLoad(Unknown Source)
at sun.security.provider.JavaKeyStore$JKS.engineLoad(Unknown Source)
at java.security.KeyStore.load(Unknown Source)
at InstallCert.main(InstallCert.java:81)
Caused by: java.security.UnrecoverableKeyException: Password verification failed
… 4 more
What could be course by this?
Looks like the password you tried for your keystore file was wrong. The default password is “changeit”. Try that.
thanks for your great tutorial
I did step 1 correctly for host:pop.gmail.com with port 995
but when i do step 2
i get this error
javan.net.SocketException:connection reset
at java.net.Socket input Stream.read
…
please please help me
javax.net.ssl.SSLException: java.lang.UnsupportedOperationException
at sun.security.ssl.Alerts.getSSLException(Alerts.java:208)
at sun.security.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1886)
at sun.security.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1844)
at sun.security.ssl.SSLSocketImpl.handleException(SSLSocketImpl.java:182
7)
at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1346
)
at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1323
)
at InstallCert.main(InstallCert.java:56)
Caused by: java.lang.UnsupportedOperationException
at InstallCert$SavingTrustManager.getAcceptedIssuers(InstallCert.java:14
0)
at sun.security.ssl.AbstractTrustManagerWrapper.checkAlgorithmConstraint
s(SSLContextImpl.java:926)
at sun.security.ssl.AbstractTrustManagerWrapper.checkAdditionalTrust(SSL
ContextImpl.java:872)
at sun.security.ssl.AbstractTrustManagerWrapper.checkServerTrusted(SSLCo
ntextImpl.java:814)
at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.
java:1323)
at sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.jav
a:153)
at sun.security.ssl.Handshaker.processLoop(Handshaker.java:868)
at sun.security.ssl.Handshaker.process_record(Handshaker.java:804)
at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1016)
at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.
java:1312)
at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1339
)
… 2 more
Have you resolved your error??even i am getting the same error and don’t know how to resolve that!!! 🙁
You should implement the getAcceptedIssuers(), e.g.:
private static class SavingTrustManager implements X509TrustManager {
private final X509TrustManager tm;
private X509Certificate[] chain;
SavingTrustManager(X509TrustManager tm) {
this.tm = tm;
}
public X509Certificate[] getAcceptedIssuers() {
return tm.getAcceptedIssuers();
}
public void checkClientTrusted(X509Certificate[] chain, String authType) throws CertificateException {
return tm.checkClientTrusted(chain, authType);
}
public void checkServerTrusted(X509Certificate[] chain, String authType) throws CertificateException {
this.chain = chain;
tm.checkServerTrusted(chain, authType);
}
}
Your tomcat’s digital certificate’s Common Name (CN) must be ‘localhost’ rather then anything else. Prior to using InstallCert you was supposed to create digital certificate for tomcat – this certificate’s common name (‘CN’) you need to set to ‘localhost’. After that use InstallCert, install jssecacerts to …jrelibsecurity – and it will work.
Solution to javax.net.ssl.SSLException: java.lang.UnsupportedOperationException
can be found here http://infposs.blogspot.ca/2013/06/installcert-and-java-7.html
IT states that you need to modify the InstallCert.java file and recompile it for Java7.
Worked like a charm for me.
Thanks This helped me to fix the cert issue 🙂
pleasure
Kindly change your method as below , this will remove error.
public X509Certificate[] getAcceptedIssuers() {
return new X509Certificate[0];
//throw new UnsupportedOperationException();
}
Hello Mr.
Thank you for your explanation, i have done the two steps you provided.
FIRST
1. i type
java -cp classes/ com/fxdx/framework/util/InstallCert testservices.dms.ferrari.com:64003
Loading KeyStore /home/andi-mra/jdk1.7.0_25/jre/lib/security/cacerts…
Opening connection to testservices.dms.ferrari.com:64003…
Starting SSL handshake…
javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
at sun.security.ssl.Alerts.getSSLException(Alerts.java:192)
.
.
.
Added certificate to keystore ‘jssecacerts’ using alias ‘testservices.dms.ferrari.com-1’
SECOND
2.
i doing again
java -cp classes/ com/fxdx/framework/util/InstallCert testservices.dms.ferrari.com:64003
and get error message
Loading KeyStore jssecacerts…
Opening connection to testservices.dms.ferrari.com:64003…
Starting SSL handshake…
javax.net.ssl.SSLException: java.lang.UnsupportedOperationException
at sun.security.ssl.Alerts.getSSLException(Alerts.java:208)
Please help me.
iam using java 7 sir. please help me
Hi,
After executing the java file, i am getting the below exception
javax.net.ssl.SSLHandshakeException: Received fatal alert: bad_certificate
at com.sun.net.ssl.internal.ssl.Alerts.getSSLException(Alerts.java:174)
at com.sun.net.ssl.internal.ssl.Alerts.getSSLException(Alerts.java:136)
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.recvAlert(SSLSocketImpl.java:1839)
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1019)
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1203)
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1230)
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1214)
at InstallCert.main(InstallCert.java:97)
any help will be highly appreciated.
great post!
thanks.
however, you should update the broken links in it…
Thanks for this post.It worked very fine for me with single server.
I need to generate certificate for more than one server. Is it possible to keep generated certificates inside a single jssecacert file?? Or what is the way to keep generated certificates otherwise??
Hello Balwant Chauhan ,
Did you generate one Certificate file for more than one server at a time?
Your reply is much appreciated
Thanks a lot it is working like a gem:)
I have created a trustServerCertificate() which basically trust the certificate of the requested server at runtime.
For that i do the following step
1)Create a keystore and import the certificate into this keystore file
2)put it into my project class path
3)Write a method trustServerCertificate() which trust the keystore file
static Properties properties = new Properties();
void trustServerCertificate(){
try {
properties.load(ThisClass.class.getClassLoader().getResourceAsStream(“keystore.properties”));
System.out.println(“Properties loaded successfully”);
} catch (IOException e) {
properties = null;
System.out.println(“Properties not loaded: ” + e.getMessage());
e.printStackTrace();
}
String keyStore = Util.class.getClassLoader().getResource(ThisClass.getProperties(“KeyStoreLocation”)).getFile();
System.out.println(“KS path :” + keyStore);
System.setProperty(“javax.net.ssl.trustStore”, keyStore);
Security.addProvider(new com.sun.net.ssl.internal.ssl.Provider());
}
public static String getProperties(String key) {
return properties.getProperty(key);
}
I am getting the same only when i trying to access the method for trust the certificate of the requested server from another method or constructor or init,but not from main method.
Please help
Getting below mention error
main, WRITE: TLSv1 Handshake, length = 32
main, READ: TLSv1 Alert, length = 2
main, RECV TLSv1 ALERT: warning, close_notify
main, SEND TLSv1 ALERT: fatal, description = unexpected_message
main, WRITE: TLSv1 Alert, length = 18
javax.net.ssl.SSLException: Received close_notify during handshake
C:\cert>java InstallCert localhost:8080
Loading KeyStore C:\Program Files\Java\jre7\lib\security\cacerts…
Opening connection to localhost:8080…
Starting SSL handshake…
Exception in thread “main” java.net.SocketTimeoutException: Read timed out
at java.net.SocketInputStream.socketRead0(Native Method)
at java.net.SocketInputStream.read(Unknown Source)
at java.net.SocketInputStream.read(Unknown Source)
at sun.security.ssl.InputRecord.readFully(Unknown Source)
at sun.security.ssl.InputRecord.read(Unknown Source)
at sun.security.ssl.SSLSocketImpl.readRecord(Unknown Source)
at sun.security.ssl.SSLSocketImpl.performInitialHandshake(Unknown Source
)
at sun.security.ssl.SSLSocketImpl.startHandshake(Unknown Source)
at sun.security.ssl.SSLSocketImpl.startHandshake(Unknown Source)
at InstallCert.main(InstallCert.java:87)
I have got the above exception can any one help?
port 8080 is down that’s why it is given exception.
server must running on port 8080.
Hi Yong,
I followed your steps as mentioned in the above.
Now i am able to create the certificate. I did Copy the generated “jssecacerts” file to your “$JAVA_HOME\jre\lib\security” folder.
Still i am getting same error:
D:\MyStuff\TestCIMSweb>wsimport -p com.merge.cims.plugin -s src -d bin https://192.168.5.22/bah1100203_test/cimsservices/viewjob.svc?wsdl
error: failed to parse document at “https://192.168.5.22/bah1100203_test/cimsservices/viewjob.svc?wsdl”: javax.net.ssl.SSLHandshakeExcept
ion: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unabl
e to find valid certification path to requested target
can you any suggestions if i miss any thing.
Thank You
Hey guys!
Can anybody tell me how to resolve this issue?
Thanks,
Igor
C:\Users\291767>java InstallCert localhost:8443
Loading KeyStore C:\Program Files\Java\jre7\lib\security\cacerts…
Opening connection to localhost:8443…
Exception in thread “main” java.net.ConnectException: Connection refused: connec
t
at java.net.DualStackPlainSocketImpl.connect0(Native Method)
at java.net.DualStackPlainSocketImpl.socketConnect(Unknown Source)
at java.net.AbstractPlainSocketImpl.doConnect(Unknown Source)
at java.net.AbstractPlainSocketImpl.connectToAddress(Unknown Source)
at java.net.AbstractPlainSocketImpl.connect(Unknown Source)
at java.net.PlainSocketImpl.connect(Unknown Source)
at java.net.SocksSocketImpl.connect(Unknown Source)
at java.net.Socket.connect(Unknown Source)
at sun.security.ssl.SSLSocketImpl.connect(Unknown Source)
at sun.security.ssl.SSLSocketImpl.(Unknown Source)
at sun.security.ssl.SSLSocketFactoryImpl.createSocket(Unknown Source)
at InstallCert.main(InstallCert.java:94)
Am getting this above exception can u please give me a solution?
While running with the following command
C:\>java InstallCert localhost:8443
I am getting the following exception
C:\>java InstallCert localhost:8080
Loading KeyStore C:\Program Files\Java\jre1.7.0\lib\security\cacerts…
Opening connection to localhost:8080…
Starting SSL handshake…
javax.net.ssl.SSLException: Unrecognized SSL message, plaintext connection?
at sun.security.ssl.InputRecord.handleUnknownRecord(Unknown Source)
at sun.security.ssl.InputRecord.read(Unknown Source)
at sun.security.ssl.SSLSocketImpl.readRecord(Unknown Source)
at sun.security.ssl.SSLSocketImpl.performInitialHandshake(Unknown Source)
at sun.security.ssl.SSLSocketImpl.startHandshake(Unknown Source)
at sun.security.ssl.SSLSocketImpl.startHandshake(Unknown Source)
at InstallCert.main(InstallCert.java:87)
Could not obtain server certificate chain
Please attach the solution for this exception?
This is because you are passing wrong host and port
can you explain the correct one please.,
Please update the links, these display 404 not found messages
While running with the following command
I am getting the following exception
Loading KeyStore C:\Program Files\Java\jre7\lib\security\cacerts... Exception in thread "main" java.lang.NoClassDefFoundError: InstallCert$SavingTrustManager at InstallCert.main(InstallCert.java:88) Caused by: java.lang.ClassNotFoundException: InstallCert$SavingTrustManager at java.net.URLClassLoader$1.run(Unknown Source) at java.net.URLClassLoader$1.run(Unknown Source) at java.security.AccessController.doPrivileged(Native Method) at java.net.URLClassLoader.findClass(Unknown Source) at java.lang.ClassLoader.loadClass(Unknown Source) at sun.misc.Launcher$AppClassLoader.loadClass(Unknown Source) at java.lang.ClassLoader.loadClass(Unknown Source) ... 1 moreYou can find the file here :
http://code.google.com/p/java-use-examples/source/browse/trunk/src/com/aw/ad/util/InstallCert.java
Thanks for this, it was really useful to me 🙂
The web links are not working.
Thanks a lot. As always, you’ve been a great help.
Hi, Yong:
thanks for this post. but I still get problem even though I totally follow your post to import a secured wsdl file. Here is our wsdl https://dev-tam.exim.gov:444/apps/bap/services/DocumentManagement/wsdl/DocumentManagement.wsdl. All the steps following your post went through well, however, to the last when I try to import the wsdl, I got error as follows:
C:\Documents and Settings\Zhangx\Desktop>wsimport https://dev-tam.exim.gov:444/a
pps/bap/services/DocumentManagement/wsdl/DocumentManagement.wsdl
parsing WSDL…
[ERROR] java.security.cert.CertificateException: No name matching dev-tam.exim.g
ov found
Failed to read the WSDL document: https://dev-tam.exim.gov:444/apps/bap/services
I hope you could help me to figure out this problem
Thank you very much in advance
Hi Yong,
Nice Tutorial.But I am still getting the same problem. My client is able to connect to server without any error/exception. In My application we are generating a pdf from a Html file. Now, when this pdf is generated error is coming at that point.
No certificate error is coming on Web Browser.
Please provide your valuable suggestions.
Thanks.
When connecting to our client production server from our production server over https, we are getting exception as java.net.SocketException: java.lang.ClassNotFoundException: org.ab
logic.search.AllTrustSSLSocketFactory
Please help on this.
Hello,
Is the “Java InstallCert” command need to run on the webserver where the JSP page is running OR on the user machine where the user is accessing the JSP page.
Thank you.
Satya
Nice tutorial Yong!
The website “http://blogs.sun.com/andreas/resource/InstallCert.java” doesn’t work anymore, though. Try this one instead: http://code.google.com/p/java-use-examples/source/browse/#svn%2Ftrunk%2Fsrc%2Fcom%2Faw%2Fad%2Futil%253Fstate%253Dclosed
My bad….
http://code.google.com/p/java-use-examples/source/browse/trunk/src/com/aw/ad/util/InstallCert.java
Thanks for link.
Yong, thanks for the tutorial can you please update the link as well.
I want java program connect to VMware Ubuntu PostgreSQL database using JDBC with SSL.
String url = “jdbc:postgresql://192.168.235.128:5432/lincdoc”;
Properties props = new Properties();
props.setProperty(“user”,”demo.data”);
props.setProperty(“password”,”aCTqjR3H”);
props.setProperty(“ssl”,”true”);
connection = DriverManager.getConnection(url, props);
But hit error :
Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
So i follow this post to solve the problem
https://mkyong.com/webservices/jax-ws/suncertpathbuilderexception-unable-to-find-valid-certification-path-to-requested-target/comment-page-1/#comment-72715
But hit another error :
D:\Project\InstallCert\src>java com.aw.ad.util.InstallCert 192.168.235.128:8443
Loading KeyStore C:\Program Files\Java\jre6\lib\security\cacerts…
Opening connection to 192.168.235.128:8443…
Exception in thread “main” java.net.ConnectException: Connection refused: connec
t
at java.net.PlainSocketImpl.socketConnect(Native Method)
at java.net.PlainSocketImpl.doConnect(Unknown Source)
at java.net.PlainSocketImpl.connectToAddress(Unknown Source)
at java.net.PlainSocketImpl.connect(Unknown Source)
at java.net.SocksSocketImpl.connect(Unknown Source)
at java.net.Socket.connect(Unknown Source)
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.connect(Unknown Source)
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.(Unknown Source)
at com.sun.net.ssl.internal.ssl.SSLSocketFactoryImpl.createSocket(Unknow
n Source)
at com.aw.ad.util.InstallCert.main(InstallCert.java:94)
NOTE : 192.168.235.128 is VMware IP address. Should i run the InstallCert.java inside VMware – Ubuntu instead of Windows Command Prompt ?
I copy the InstalCert.java from here :
http://code.google.com/p/java-use-examples/source/browse/trunk/src/com/aw/ad/util/InstallCert.java
Appreciate for any help !
I try
java com.aw.ad.util.InstallCert localhost:8443
also same error
hello ,
the server must be running in this port when you call InstallCert,
you can start tomcat at the port 8443 , after that call the class
Hi,
I wan to run this in Linux server and after the certificates are generated I stored in security folder of JRE. But when I execute command “wget https://10.63.25.44:443/ProvisioningGateway/services/SPMLHlrSubscriber453Service?wsdl” I get below error:
Connecting to 10.63.25.44:443… connected.
ERROR: cannot verify 10.63.25.44âs certificate, issued by â/C=DE/ST=none/L=Munich/O=Siemens A.G./OU=COM/CN=srnpgw3â
Self-signed certificate encountered.
ERROR: certificate common name âsrnpgw3â10.63.25.44â
To connect to 10.63.25.44 insecurely, use â–no-check-certificateâ.
Could any one of you explain how to solve this problem?
Great ! Smart How To.