Java 7 - How SSL trusts all certificates


Uri Lukach

I'm writing a Java proxy that uses SSL to communicate with other servers. With ServerSocketFactory and keystore and truststore populated by server certificate everything works perfectly.

I was wondering, is there a way in Java 7 to disable authentication and trust all servers? (yes, I know it's risky - this proxy is for internal use only)

I've seen some examples of using X509TrustManager implementations to implement TrustManager, although apparently Java 7 doesn't support these contracts and X509TrustManager itself is deprecated.

Thanks for the suggestions and all the code samples that work on Java 7.

Uri Lukach

What I did is to implement java.security.Provider using the code mentioned in this article

https://code.google.com/p/misc-utils/wiki/JavaHttpsUrl

Note: This is the second solution offered.

The post doesn't mention that you should also add the keystore to get things working. Therefore, these VM parameters should also be set (unless you will get a " no cipher suites in common" error message ):

                -Djavax.net.ssl.keyStore=KEYSTORE LOCATION
                -Djavax.net.ssl.keyStorePassword=YOUR PASS

I hope this helps you as it's not mentioned anywhere I've looked.

Related


Java 7 - How SSL trusts all certificates

Uri Lukach I'm writing a Java proxy that uses SSL to communicate with other servers. With ServerSocketFactory and keystore and truststore populated by server certificate everything works perfectly. I was wondering, is there a way in Java 7 to disable authentic

How spring boot ssl trusts all valid certificates

Haizang-kun I have enabled ssl in my spring boot application and whenever i want to use a Rest service like googleapis or facebook i have to add a certificate in the truststore. I use openssl to get the certificate: openssl s_client -connect googleapis.com:443

Trust all SSL certificates in Java Playframework 2.2

asvignesh: I'm trying to call a web service (with a self-signed SSL certificate) in the Play framework using the following function: public static play.libs.F.Promise<Result> webcall() { String feedUrl = "https://10.0.1.1/client/api"; final play.

Trust all SSL certificates in Java Playframework 2.2

asvignesh: I'm trying to call a web service (with a self-signed SSL certificate) in the Play framework using the following function: public static play.libs.F.Promise<Result> webcall() { String feedUrl = "https://10.0.1.1/client/api"; final play.

Trust all SSL certificates in Java Playframework 2.2

Avines I'm trying to call a web service (with a self-signed SSL certificate) in the Play framework using the following function: public static play.libs.F.Promise<Result> webcall() { String feedUrl = "https://10.0.1.1/client/api"; final play.libs

Trust all SSL certificates in Java Playframework 2.2

asvignesh: I'm trying to call a web service (with a self-signed SSL certificate) in the Play framework using the following function: public static play.libs.F.Promise<Result> webcall() { String feedUrl = "https://10.0.1.1/client/api"; final play.

How to have multiple SSL certificates for Java server

Lawrence Dol: I have an internal HTTP server written in Java; the full source code is at my disposal. The HTTP server can be configured with any number of websites, each with a separate listening socket, which is created with the following command: skt=SSLServ

How to load multiple SSL certificates in Java KeyStore?

Peter I have two SSL certificate files. The first is labeled "OU=Certificate Authority" and the second is labeled "OU=Root Certificate". Our C++ application loads both certificates for proper client/server handshake. Now, I need to use these certificates in my

How to load multiple SSL certificates in Java KeyStore?

Peter I have two SSL certificate files. The first is labeled "OU=Certificate Authority" and the second is labeled "OU=Root Certificate". Our C++ application loads both certificates for proper client/server handshake. Now, I need to use these certificates in my

How to Use SSL Certificates in Java on Mac

beitseeb I found this question: Import Windows Certificates into Java , which gives the answer for Windows machines. I haven't been able to find a -Djavax.net.ssl.trustStoreType=WINDOWS-ROOTMacOS equivalent . beitseeb Jacob Blanton provided the solution in the

How to have multiple SSL certificates for Java server

Lawrence Dol: I have an internal HTTP server written in Java; the full source code is at my disposal. The HTTP server can be configured with any number of websites, each with a separate listening socket, which is created with the following command: skt=SSLServ

How to load multiple SSL certificates in Java KeyStore?

Peter I have two SSL certificate files. The first is labeled "OU=Certificate Authority" and the second is labeled "OU=Root Certificate". Our C++ application loads both certificates for proper client/server handshake. Now, I need to use these certificates in my

How to have multiple SSL certificates for Java server

Lawrence Dol: I have an internal HTTP server written in Java; the full source code is at my disposal. The HTTP server can be configured with any number of websites, each with a separate listening socket, which is created with the following command: skt=SSLServ

How to Use SSL Certificates in Java on Mac

beitseeb I found this question: Import Windows Certificates into Java , which gives the answer for Windows machines. I haven't been able to find a -Djavax.net.ssl.trustStoreType=WINDOWS-ROOTMacOS equivalent . beitseeb Jacob Blanton provided the solution in the

How to Use SSL Certificates in Java on Mac

beitseeb I found this question: Import Windows Certificates into Java , which gives the answer for Windows machines. I haven't been able to find a -Djavax.net.ssl.trustStoreType=WINDOWS-ROOTMacOS equivalent . beitseeb Jacob Blanton provided the solution in the

Java and SSL certificates

Andy: I'm trying to use Secure Sockets Layer (HTTPS) to connect to a PHP script in Java, but I've found that for maximum security/validity I have to import the SSL certificate used by the website into my application. ..I do not know what to do. If it helps, my

Java and SSL certificates

Andy: I'm trying to use Secure Sockets Layer (HTTPS) to connect to a PHP script in Java, but I've found that for maximum security/validity I have to import the SSL certificate used by the website into my application. ..I do not know what to do. If it helps, my

Java and SSL certificates

Andy: I'm trying to use Secure Sockets Layer (HTTPS) to connect to a PHP script in Java, but I've found that for maximum security/validity I have to import the SSL certificate used by the website into my application. ..I do not know what to do. If it helps, my

SSL sockets - Java and certificates?

bob I am trying to implement SSL sockets between an Android application and a Python API. The code below... SSLSocketFactory ssf = (SSLSocketFactory) SSLSocketFactory.getDefault(); Socket s = ssf.createSocket("10.0.2.2", 5001); DataOutputStream myDataOut = new

How to list all available SSL CA certificates on CentOS 6?

Nathan Basanese After installing the certificate, it's hard to tell if I've successfully trusted a given certificate, especially for the root CA. To check if I have successfully installed a certificate without making an SSL request to a server that may or may

How to list all available SSL CA certificates on CentOS 6?

Nathan Basanese After installing the certificate, it's hard to tell if I've successfully trusted a given certificate, especially for the root CA. To check if I have successfully installed a certificate without making an SSL request to a server that may or may

How to list all available SSL CA certificates on CentOS 6?

Nathan Basanese After installing the certificate, it's hard to tell if I've successfully trusted a given certificate, especially for the root CA. To check if I have successfully installed a certificate without making an SSL request to a server that may or may

Are Java code signing certificates the same as SSL certificates?

Expect: I'm looking for a Java code signing certificate so my Java applet doesn't throw such scary security warnings. However, I found that all the places they offered were charging too much (I think) like over $200 a year. While doing research, code signing c

Are Java code signing certificates the same as SSL certificates?

Expect: I'm looking for a Java code signing certificate so my Java applet doesn't throw such scary security warnings. However, I find that all the places they offer are charging too much (I think) like over $200 a year. While doing research, code signing certi

java - Ignore expired SSL certificates

Dick Braz: URL myUrl = new URL("https://www....."); The website's SSL certificate has expired. How to avoid it and make URL() work? Bruno: You should build one that TrustManagerwraps the default trust manager, catch it and ignore it.CertificiateExpiredExcepti

java - Ignore expired SSL certificates

Dick Braz: URL myUrl = new URL("https://www....."); The website's SSL certificate has expired. How to avoid it and make URL() work? Bruno: You should build one that TrustManagerwraps the default trust manager, catch it and ignore it.CertificiateExpiredExcepti

java - Ignore expired SSL certificates

Dick Braz: URL myUrl = new URL("https://www....."); The website's SSL certificate has expired. How to avoid it and make URL() work? Bruno: You should build one that TrustManagerwraps the default trust manager, catch it and ignore it.CertificiateExpiredExcepti