2

I'm trying to set up a connection with an https url, but since it's still in testing, the url redirects to the test environment, causing a browser to prompt the user with a message saying roughly that the certificate is trusted, valid, but doesn't match the domainname, and if they want to continue. I'm having a hard time dealing with this in Java. All the answers I've found suggest using a TrustManager like this

TrustManager[] trustAllCerts = new TrustManager[] { new X509TrustManager() {
    public X509Certificate[] getAcceptedIssuers() {
        return null;
    }

    public void checkClientTrusted(X509Certificate[] certs, String authType) {
        return;
    }

    public void checkServerTrusted(X509Certificate[] certs, String authType) {
        return;
    }
}};

sslContext.init(kmf.getKeyManagers(), trustAllCerts, new SecureRandom());

But this doesn't change anything.

The authentication involves entering a password on reading the client certificate's private key, and this works identically and correctly both from a browser and my application, it's after this authentication that either the prompt pops up in the browser or the connection returns a 'bad_certificate' error in my application. Is there some other way to either ignore the domain validation entirely or make the same prompt appear?

For clarity, my application doesn't cause the password prompt to appear because I programmed it in or anything, I think it just originates from windows detecting my application trying to access the certificate's private key, so I would assume that the second prompt would work in a similar fashion, but I haven't found any parameters to make that happen yet.

2 Answers 2

0

Let me warn you that if you are doing this for testing your code then this is not the right thing to do as. Browsers often ignore the errors and prompt the user if he would like to contnue despite the problems. If he decides to continue then he owns the decision. In your java application, if you are using the JDK provided default SSLSocketFactory then the SSL sessionis only established if the SSL handshake succeeds. And this is for security reasons. If you need to have a funcationalty like your browsers; to proceed irrespective of the security issues then you need to have your own custom implementation. Or better dont use SSL at all.

1
  • This is a valid warning. However, I've downvoted this for not being an answer: there are situations where Java code needs to connect to a legitimate HTTPS URL, where that Java code (like any good browser) tells the user that "name X in certificate does not match hostname Y in the URL", and where the user wants the connection made anyway. Jun 8, 2012 at 11:23
0

Is there some other way to either ignore the domain validation...

Yes. See Java's HostnameVerifier interface:

During handshaking, if the URL's hostname and the server's identification hostname mismatch, the verification mechanism can call back to implementers of this interface to determine if this connection should be allowed.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.