95

I received this error while trying to start up an application:

Sun.security.validator.ValidatorException: PKIX path validation failed: 
java.security.cert.CertPathValidatorException:  java.net.UnknownHostException:oscp.thawte.com

The application is behind a closed network and won't ever be able to get to oscp.thawte.com. Is there a java setting that can disable this?

0

7 Answers 7

77

-Dcom.sun.net.ssl.checkRevocation=false

9
  • 6
    Where should I execute this?
    – nyanev
    Jan 20, 2014 at 9:06
  • 2
    it is a command line parameter for the JVM. You can also set it programmatically stackoverflow.com/questions/5189914/setting-system-property
    – MK.
    Jan 21, 2014 at 3:37
  • 1
    well it is referenced in OpenJDK code hg.openjdk.java.net/jdk7/jdk7/jdk/file/37a05a11f281/src/share/… Try to check which TrustManager you are using.
    – MK.
    Sep 17, 2015 at 13:59
  • 31
    Doesn't work with Java 8 for me. I used System.setProperty("com.sun.net.ssl.checkRevocation", "false") in my code. The property does get set but has no effect. Mar 23, 2018 at 21:19
  • 1
    I'm using openjdk version "1.8.0_292" OpenJDK Runtime Environment (build 1.8.0_292-b10) this option doesn't seem to work
    – HoaPhan
    Jun 8, 2021 at 1:00
23

Not exactly a setting but you can override the default TrustManager and HostnameVerifier to accept anything. Not a safe approach but in your situation, it can be acceptable.

1
  • 1
    This should be the accepted answer. The property mentioned in accepted answer does not take effect on many JVMs. Mar 23, 2018 at 21:26
18

In addition to the answers above. You can do it programmatically by implementing the TrustManager:

TrustManager[] trustAllCerts = new TrustManager[] {
        new X509TrustManager() {
          public java.security.cert.X509Certificate[] getAcceptedIssuers() {
           return null;
          }
          @Override
          public void checkClientTrusted(X509Certificate[] arg0, String arg1)
           throws CertificateException {}

          @Override
          public void checkServerTrusted(X509Certificate[] arg0, String arg1)
            throws CertificateException {}
          }
     };

  SSLContext sc=null;
  try {
   sc = SSLContext.getInstance("SSL");
  } catch (NoSuchAlgorithmException e) {
   e.printStackTrace();
  }
  try {
   sc.init(null, trustAllCerts, new java.security.SecureRandom());
  } catch (KeyManagementException e) {
   e.printStackTrace();
  }
  HttpsURLConnection.setDefaultSSLSocketFactory(sc.getSocketFactory());
  // Create all-trusting host name verifier
  HostnameVerifier validHosts = new HostnameVerifier() {
  @Override
  public boolean verify(String arg0, SSLSession arg1) {
   return true;
  }
  };
  // All hosts will be valid
  HttpsURLConnection.setDefaultHostnameVerifier(validHosts);

However this is not a good practice for production.

This example on How to disable SSL certificat validation in Java contains a utility class you can copy in your project.

4
  • 3
    worked at first attempt. Thanks!!
    – JRichardsz
    Jul 14, 2021 at 16:58
  • Can you tell me what version of apache client you are using. This does not work for later versions such as version 4.5.13 Nov 2, 2021 at 17:36
  • Can you tell me what version of java you are using, and what version of Apache Client. Nov 2, 2021 at 17:56
  • @AntonCavanaugh at the time of writing this answer I was using java 8.
    – Mehdi
    Nov 3, 2021 at 18:09
10

Use cli utility keytool from java software distribution for import (and trust!) needed certificates

Sample:

  1. From cli change dir to jre\bin

  2. Check keystore (file found in jre\bin directory)
    keytool -list -keystore ..\lib\security\cacerts
    Enter keystore password: changeit

  3. Download and save all certificates chain from needed server.

  4. Add certificates (before need to remove "read-only" attribute on file "..\lib\security\cacerts") keytool -alias REPLACE_TO_ANY_UNIQ_NAME -import -keystore ..\lib\security\cacerts -file "r:\root.crt"

accidentally I found such a simple tip. Other solutions require the use of InstallCert.Java and JDK

source: http://www.java-samples.com/showtutorial.php?tutorialid=210

3

On my Mac that I'm sure I'm not going to allow java anyplace other than a specific site, I was able to use Preferences->Java to bring up the Java control panel and turned the checking off. If DLink ever fixes their certificate, I'll turn it back on.

Java control panel - Advanced

2
  • 1
    And how do i open this file?
    – lordvidex
    Mar 4, 2021 at 22:31
  • 1
    How do I get this to do on Macos Moneterey, I believe there is no Java Control Panel Jul 23, 2022 at 11:47
2

In Axis webservice and if you have to disable the certificate checking then use below code:

AxisProperties.setProperty("axis.socketSecureFactory","org.apache.axis.components.net.SunFakeTrustSocketFactory");

-6

It is very simple .In my opinion it is the best way for everyone

       Unirest.config().verifySsl(false);
       HttpResponse<String> response = null;
       try {
           Gson gson = new Gson();
           response = Unirest.post("your_api_url")
                   .header("Authorization", "Basic " + "authkey")
                   .header("Content-Type", "application/json")
                   .body("request_body")
                   .asString();
           System.out.println("------RESPONSE -------"+ gson.toJson(response.getBody()));
       } catch (Exception e) {
           System.out.println("------RESPONSE ERROR--");
           e.printStackTrace();
       }
   }
1
  • Are you sure this will help? I'm not sure if the poster is trying to make a ws call himself.
    – Stan
    Apr 19, 2020 at 9:21

Not the answer you're looking for? Browse other questions tagged or ask your own question.