0

I have a web application which uses 3rd party jars to provide payments with bank cards. Communication is made via SSL.

I also implemented functionality which will send confirmation e-mail (JavaMail) after the payment is made with code like this:

// property list
Properties properties = new Properties();

// host
properties.setProperty("mail.smtp.host", smptServer);
// authorization
properties.setProperty("mail.smtp.auth", "true");
// STARTTLS
properties.setProperty("mail.smtp.starttls.enable", "true");
// port
properties.setProperty("mail.smtp.port", "587");
// trust all certificates
properties.setProperty("mail.smtp.ssl.trust", "*");
// debug
properties.setProperty("mail.debug", "true");

The problem is: bank software sets such system parameters:

javax.net.ssl.trustStorePassword
javax.net.ssl.keyStore
javax.net.ssl.keyStoreType
javax.net.ssl.trustStore
javax.net.ssl.keyStorePassword

to custom keystore which contains certificates.

As result I have a situation when bank software is working, but I can't send emails or mail is working, but bank software is not: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

In short, as I understand JavaMail must access Java cacerts (java/jre/lib/security/cacerts), but bank software must use custom keystore... but javax.net.ssl parameters can link to only one keystore. If I import SMTP server certificate in bank keystore, then PKIX error is rised.

How to resolve this?

1 Answer 1

1

You should be able to put all the certs in a single trust store. If that's not working, you may need help from a security expert. See SSLNOTES.txt for tips for debugging these problems.

As a last resort, you can use MailSSLSocketFactory to set your own TrustManager, or set the mail..ssl.trust property to the server you want to trust.

1
  • mail.smtp.ssl.trust already contained * to trust all servers. But this did not work. The usage of MailSSLSocketFactory resolved the issue. Thank you! You are my saver!
    – StevenR
    Sep 1, 2014 at 14:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.