Depending on the exact certificate issue, you may get an error like one of the following, though I’m almost positive there are other manifestations:
java.security.cert.CertificateException: Untrusted Server Certificate Chain
javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
Getting around this often requires modifying JDK trust store files which can be painful and often you end up running into trouble. On top of that, every developer on your team will have to do the same thing, and every new environment you’ll have the same issues recurring.
Fortunately, there is a way to deal with the problem in a generic way that won’t put any burden on your developers. We’re going to focus on vanilla HttpURLConnection type connections since it is the most general and should still help you understand the direction to take with other libraries. If you are using Apache HttpClient, see here.
Warning: Know what you are doing!
Be aware of what using this code means: it means you don’t care at all about host verification and are using SSL just to encrypt communications. You are not preventing man-in-the-middle attacks or verifying you are connected to the host you think you are. This generally comes down to a few valid cases:
- you are operating in a locked down LAN environment. You are not susceptible to having your requests intercepted by an attacker (or if you are, you have bigger issues).
- You are in a test or development environment where securing communication isn’t important.
If this matches your needs, then go ahead and proceed. Otherwise, maybe think twice about what you are trying to accomplish.
Solution: Modifying Trust Managers
Now that we’re past that disclaimer, we can solve the actual problem at hand. Java allows us to control the objects responsible for verifying a host and certificate for a HttpsURLConnection. This can be done globally but I’m sure those of you with experience will cringe at the thought of making such a sweeping change. Luckily we can also do it on a per-request basis, and since examples of this are hard to find on the web, I’ve provided the code below. This approach is nice since you don’t need to mess with swapping out SSLSocketFactory implementations globally.
Feel free to grab it and use it in your project.
package com.mycompany.http;
import java.net.*;
import javax.net.ssl.*;
import java.security.*;
import java.security.cert.*;
public class TrustModifier {
private static final TrustingHostnameVerifier
TRUSTING_HOSTNAME_VERIFIER = new TrustingHostnameVerifier();
private static SSLSocketFactory factory;
/** Call this with any HttpURLConnection, and it will
modify the trust settings if it is an HTTPS connection. */
public static void relaxHostChecking(HttpURLConnection conn)
throws KeyManagementException, NoSuchAlgorithmException, KeyStoreException {
if (conn instanceof HttpsURLConnection) {
HttpsURLConnection httpsConnection = (HttpsURLConnection) conn;
SSLSocketFactory factory = prepFactory(httpsConnection);
httpsConnection.setSSLSocketFactory(factory);
httpsConnection.setHostnameVerifier(TRUSTING_HOSTNAME_VERIFIER);
}
}
static synchronized SSLSocketFactory
prepFactory(HttpsURLConnection httpsConnection)
throws NoSuchAlgorithmException, KeyStoreException, KeyManagementException {
if (factory == null) {
SSLContext ctx = SSLContext.getInstance("TLS");
ctx.init(null, new TrustManager[]{ new AlwaysTrustManager() }, null);
factory = ctx.getSocketFactory();
}
return factory;
}
private static final class TrustingHostnameVerifier implements HostnameVerifier {
public boolean verify(String hostname, SSLSession session) {
return true;
}
}
private static class AlwaysTrustManager implements X509TrustManager {
public void checkClientTrusted(X509Certificate[] arg0, String arg1) throws CertificateException { }
public void checkServerTrusted(X509Certificate[] arg0, String arg1) throws CertificateException { }
public X509Certificate[] getAcceptedIssuers() { return null; }
}
}
Usage
To use the above code, just call the relaxHostChecking() method before you open the stream:
URL someUrl = ... // may be HTTPS or HTTP HttpURLConnection connection = (HttpURLConnection) someUrl.openConnection(); TrustModifier.relaxHostChecking(connection); // here's where the magic happens // Now do your work! // This connection will now live happily with expired or self-signed certificates connection.setDoOutput(true); OutputStream out = connection.getOutputStream(); ...
There you have it, a complete example of a localized approach to supporting self-signed certificates. This does not affect the rest of your application which will continue to have strict hosting checking semantics. This example could be extended to use a configuration setting to determine whether relaxed host checking should be used, and I recommend you do so if using this code is primarily a way to facilitate development with self-signed certificates.
Reference: Ignoring Self-Signed Certificates in Java from our JCG partners at Carfey Software Blog.
