Problem when accessing website with Java using HTTPS (not trusted certificate)

Question

I try to access a site using HTTP from a Java application. Since the application is running in a development environment, the corresponding certificate isn't trusted.

When using javax.net.ssl package, I try to define a custom TrustManager implementation that allows everything and pass it within the second parameter of the init method of the SslContext, but this doesn't work.

Does anybody make work something like that? Thanks very much for your help! Thierry

Dit you use -Djavax.net.debug=all (or auth) to see what was happening? And how did you use your newly created context? And - of course- as certs are supposed to be public, why not just trust the certificate? — Maarten Bodewes
– Maarten Bodewes, Commented May 2, 2011 at 8:28
Thanks very much for your answer! When using the debugging hints, I can see that: SEND TLSv1 ALERT: fatal, description= certificate_unknow. In fact, I can trust the certificate because it's a development server from a third-part company. — Thierry Templier
– Thierry Templier, Commented May 2, 2011 at 8:46

Jcs · Accepted Answer · 2011-05-02 09:50:50Z

1

It is pretty easy to implement a TrustManager which does not verify anything (works on both client and server side):

public class NoVerifyTM implements X509TrustManager
{
  void checkClientTrusted(X509Certificate[] chain, String authType) {
    /* Accept All */
  }

  void checkServerTrusted(X509Certificate[] chain, String authType) {
    /* Accept All */
  }

  X509Certificate[] getAcceptedIssuers() {
    return new X509Certificate[0]
  }
}

To use this TrustManager:

SSLContext ctx = SSLContext.getDefault();
ctx.init(null, new TrustManager[] { new NoVerifyTM() }, null);
SSLSocketFactory sf = ctx.getSocketFactory();

Please note that (as said by @hanwg) such a trust manager should only be used for testing/prototyping purposes.

answered May 2, 2011 at 9:50

Jcs

13.8k5 gold badges57 silver badges71 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Thierry Templier Over a year ago

Hello, Thanks very much for your answer. Unfortunately, this doesn't solve my problem... In fact, I think that there is something more to do. Perhaps at the key manager level?

Jcs Over a year ago

Can you give us some code snippet you wrote, or the exception you get? It will be much easier to help :)

happymeal · Accepted Answer · 2011-05-02 09:18:35Z

0

if you trust the certificate, you should add it to your application server's truststore. implementing a trust manager that doesn't perform certificate checking is a security vulnerability.

answered May 2, 2011 at 9:18

happymeal

1,4131 gold badge15 silver badges24 bronze badges

1 Comment

Thierry Templier Over a year ago

Hello, Thanks very much for your help. Yes, I agree with you! It's only for a development environment...

Collectives™ on Stack Overflow

Problem when accessing website with Java using HTTPS (not trusted certificate)

2 Answers 2

2 Comments

1 Comment

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

2 Comments

1 Comment

Related