Java - Standard SSL certificate all trust codes fail


Mints 97

I think that almost every Java programmer who has experience with SSL certificate trust errors by now has used or at least encountered the following code:

    // Create a trust manager that does not validate certificate chains
    TrustManager[] trustAllCerts;
    trustAllCerts = new TrustManager[] {
        new X509TrustManager() {
            @Override
            public java.security.cert.X509Certificate[] getAcceptedIssuers() {
                return null;
            }
            @Override
            public void checkClientTrusted(X509Certificate[] certs, String authType) {
            }
            @Override
            public void checkServerTrusted(X509Certificate[] certs, String authType) {
            }
        }
    };

    // Install the all-trusting trust manager
    SSLContext sc = SSLContext.getInstance("SSL");
    sc.init(null, trustAllCerts, new java.security.SecureRandom());
    HttpsURLConnection.setDefaultSSLSocketFactory(sc.getSocketFactory());

    // Create all-trusting host name verifier
    HostnameVerifier allHostsValid = new HostnameVerifier() {
        @Override
        public boolean verify(String hostname, SSLSession session) {
    return true;
        }
};

    // Install the all-trusting host verifier
    HttpsURLConnection.setDefaultHostnameVerifier(allHostsValid);

So far I've successfully used this code to eliminate certificate mismatches when accessing HTTP sites via their IP address (don't ask me why, it's a completely different story). However, I tried to do the same with another HTTPs site and it turns out that this code fails with the following exception:

javax.net.ssl.SSLHandshakeException: java.security.cert.CertificateException: Certificates does not conform to algorithm constraints

So, the question is, where is the problem and what can I do?

Mints 97

I have solved this problem. It looks like the server is using MD2 in the certificate. So far the only way I know to fix this is to find the jre/lib/security/java.security file in the JDK path and change jdk.certpath.disabledAlgorithms=MD2 to jdk.certpath.disabledAlgorithms= so that The MD2 algorithm becomes not disabled. This does seem nasty, but sadly I can't find a way to enable MD2 programmatically.

Looking back, I remember accessing it now, but it kills java.security file editing only before updating Java.

Related


Trust all SSL certificates in Java Playframework 2.2

asvignesh: I'm trying to call a web service (with a self-signed SSL certificate) in the Play framework using the following function: public static play.libs.F.Promise<Result> webcall() { String feedUrl = "https://10.0.1.1/client/api"; final play.

Trust all SSL certificates in Java Playframework 2.2

asvignesh: I'm trying to call a web service (with a self-signed SSL certificate) in the Play framework using the following function: public static play.libs.F.Promise<Result> webcall() { String feedUrl = "https://10.0.1.1/client/api"; final play.

Trust all SSL certificates in Java Playframework 2.2

Avines I'm trying to call a web service (with a self-signed SSL certificate) in the Play framework using the following function: public static play.libs.F.Promise<Result> webcall() { String feedUrl = "https://10.0.1.1/client/api"; final play.libs

Trust all SSL certificates in Java Playframework 2.2

asvignesh: I'm trying to call a web service (with a self-signed SSL certificate) in the Play framework using the following function: public static play.libs.F.Promise<Result> webcall() { String feedUrl = "https://10.0.1.1/client/api"; final play.

How to make browser trust local SSL certificate?

x-yuri Although, there are similar questions and even good answers , they either don't care about themselves with localhost explicitly, or ask about a specific option/solution (self-signed VS CA). What are the options? How do they compare? what should I do? x-

Trust SSL certificate with IPv6 address

Mr Zuger I have an IIS application with HTTPS binding using a self-signed certificate. The certificate contains the DNS name of the server hostname, IPv4 address, and IPv6 address. I have installed the certificate in my local machine's Trusted Root Certificati

How to make browser trust local SSL certificate?

x-yuri Although, there are similar questions and even good answers , they either don't care about themselves with localhost explicitly, or ask about a specific option/solution (self-signed VS CA). What are the options? How do they compare? what should I do? x-

Trust the SSL certificate to the local system account

Matteo Mosca I have the following needs: The Windows service needs to connect to the svn repository via https. The service also needs to run as the local system account to get IO permissions on the computer. Now, when the service tries to connect to SVN, it th

JavaMail SSL without authentication trust certificate, anyway

gtgaxiola I have a local mail server (hMailServer) with SSL (port 465) and self signed certificate. Domain is "foobar.com" I have set Propertiesto enable ssl, disable authentication and trust any host props.put("mail.smtp.auth", "false"); props.put("ma

How to make browser trust local SSL certificate?

x-yuri Although, there are similar questions and even good answers , they either don't care about themselves with localhost explicitly, or ask about a specific option/solution (self-signed VS CA). What are the options? How do they compare? what do I do? x-yuri

Trust the SSL certificate to the local system account

Matteo Mosca I have the following needs: The Windows service needs to connect to the svn repository via https. The service also needs to run as the local system account to get IO permissions on the computer. Now when the service tries to connect to the SVN it

Programmatically trust Hoverfly Java certificate

Amr Lotfy: Using Hoverfly-java to mock a web service in a unit test, and using HttpClient as the web client, found that the Hoverfly proxy settings are propagated correctly using Hoverfly, useSystemProperties()but I still get the TLS error: Unknown certificate

Programmatically trust Hoverfly Java certificate

Amr Lotfy: Using Hoverfly-java to mock a web service in a unit test, and using HttpClient as the web client, found that the Hoverfly proxy settings are propagated correctly using Hoverfly, useSystemProperties()but I still get the TLS error: Unknown certificate

Programmatically trust Hoverfly Java certificate

Amr Lotfy: Using Hoverfly-java to mock a web service in a unit test, and using HttpClient as the web client, found that the Hoverfly proxy settings are propagated correctly using Hoverfly, useSystemProperties()but I still get the TLS error: Unknown certificate

Programmatically trust Hoverfly Java certificate

Amr Lotfy: Using Hoverfly-java to mock a web service in a unit test, and using HttpClient as the web client, found that the Hoverfly proxy settings are propagated correctly using Hoverfly, useSystemProperties()but I still get the TLS error: Unknown certificate

How to trust a certificate authority in Java?

and My application connects to an SSL web service, which uses a certificate to verify its identity. Recently this certificate has been changed and part of my application is failing because it is not signed by a trusted authority. The service recommends that to

Programmatically trust Hoverfly Java certificate

Amr Lotfy: Using Hoverfly-java to mock a web service in a unit test, and using HttpClient as the web client, found that the Hoverfly proxy settings are propagated correctly using Hoverfly, useSystemProperties()but I still get the TLS error: Unknown certificate

Java Webstart Trust Store SSL

SPD: Need some guidance. I have a Java Webstart application and I want it to connect to a server via SSL. Just add a property like: System.setProperty("javax.net.ssl.trustStore", "my.keystore"); however, it doesn't work since the JAWS program is downloading th

Java Webstart Trust Store SSL

SPD: Need some guidance. I have a Java Webstart application and I want it to connect to a server via SSL. Just add a property like: System.setProperty("javax.net.ssl.trustStore", "my.keystore"); however, it doesn't work since the JAWS program is downloading th