299
questions
-1
votes
1
answer
46
views
JDK bundled TrustManager
I would like to get a TrustManager instance loaded with JDK's bundled trust material
(meaning the material which in later versions of the JDK live in lib/security/cacerts file).
Ideally the solution ...
0
votes
1
answer
819
views
How to resolve java.security.NoSuchAlgorithmException: Error constructing implementation (algorithm: Default, provider: SunjSSE...?
I'm getting an error message when trying to connect a Java client application to a C++ Server using TLS. The C++ server is using openssl 3 for all its crypto operations. All the certificates were ...
2
votes
1
answer
89
views
Java SSLSocket find out if client sent a certificate
My application allows authenticated and non-authenticated TLS connections and in the code, I need to distinguish between them (just as in authenticated and non-authenticated HTTPS sessions).
Is there ...
0
votes
1
answer
66
views
Can't restrict accepted CA roots via X509TrustManager.getAcceptedIssuers [duplicate]
I am trying to write a custom X509TrustManager that will use the default system trust store, but allowing only a restricted set of trusted CA roots.
I am trying to do this by returning a modified list ...
0
votes
0
answers
59
views
In Java, during TLS handshake, if a custom X509TrustManager is used, will the peer's signature still be verified
Below, I'm describing a super-simplified scenario, just so I won't burden you with details.
If I write a client that communicates with a remote server over HTTPS, and if, during the TLS handshake, I ...
0
votes
0
answers
60
views
Connecting to LDAPS from Java in multitenancy
I'm looking for a way to connect to an LDAP Server over SSL from Java in a scenario where you can have multiple users, each one with its own truststore (Basically each user is an application deployed ...
0
votes
1
answer
88
views
What is the difference between getSession, getHandshakeSession and session.startHandshake in SSLSocket.java in 2 way ssl
In SSLSocket.java there is one abstract method
public abstract SSLSession getSession();
and One
public SSLSession getHandshakeSession() {
throw new UnsupportedOperationException();
...
1
vote
0
answers
57
views
How to properly handshake in java using nonblocking socketchannels from the JSSE library?
I'm struggling to understand how to establish secure communication (the handshake) between a client and server using the JSSE library.
I've read the documentation and have understood the first few ...
1
vote
0
answers
113
views
Java SSLContext setup not working, SunCertPathBuilderException
I have a working stunnel setup and am trying to use the same pem file containing the client certificate and client key and the server trust X509Certificate in a .crt file.
I consistently get this ...
0
votes
1
answer
1k
views
Oracle JDBC: Ignore unsupported cipher suite: SSL_DH_anon_WITH_3DES_EDE_CBC_SHA for TLSv1.3
I am trying to set up an encryption-only SSL connection to Oracle 21.3, however javax.net.debug produces a following log for any anon cipher suite:
I have removed appropriate entries from jdk.tls....
2
votes
1
answer
1k
views
How does Java pick default certificate when keystore has multiple server certificates
How does Java select the default / fallback server certificate when client does not set SNI servername at all?
Background:
I have created PKCS#12 keystore with multiple server certificates. I have ...
0
votes
1
answer
549
views
Java Grizzly server and Jersey client Received fatal alert: certificate_unknown
I have a Java application with an embedded SSL server and client.
My application uses client authentication to determine the identity of the client, so the server is configured with wantClientAuth=...
1
vote
1
answer
683
views
Received fatal alert: handshake_failure when calling from Java 1.8.0_162 to Java 1.6.0_45-b06
I'm trying to make a https call from a machine running Java 1.8.0_162 to another one running Java 1.6.0_45-b06.
The one running 1.6.0_45-b06 has the bcprov-jdk15to18-1.68 and bctls-jdk15to18-1.68 ...
0
votes
1
answer
1k
views
How to add extension to existing Key Pair using Java Keytool command or JSSE?
We have our own root certificate authority which later used to sign the certificates for clients.
We have generated the root certificate authority using keytool command as below
Keytool -genkeypair -...
1
vote
0
answers
2k
views
What is conscrypt ? Can you explain its usage with some examples?
I need to use Conscrypt in my Java application. I understand that it implements parts of the Java Cryptography Extension (JCE) and Java Secure Socket Extension (JSSE).
What code changes are required ...
0
votes
0
answers
750
views
How to configure TLSv1.2 on Camel's http component to call an external service?
Below is the configured route I am using, to call an external service.
services_routes.xml
<beans xmlns="http://www.springframework.org/schema/beans"
xmlns:xsi="http://www.w3....
1
vote
0
answers
116
views
How to use DER-encoded OCTET string for the extension value returned by X509Certificate::getExtensionValue(oid)
I am trying to manage the CRL cache locally to customize the cache timeout. The default implementation provided by Sun does not give ability to customize it.
First step for this is to get the CRL ...
2
votes
0
answers
293
views
How to increase CRL Caching timeout in JSSE?
I want to check for the certificate revocation with the help of CRL. I am using CertPathValidator to validate the certificates. JSSE internally use URICertStore to fetch the CRL and caches it for 30 ...
2
votes
0
answers
2k
views
Windows Certificate Store vs Java KeyStore: which is preferred for java server application?
We have server application developed in Java to which agent connects. We need to secure network connection with Certificates signed by Trusted CAs.
Customers can use their own Certificate Authority to ...
4
votes
1
answer
2k
views
BouncyCastle JSSE and BCTLS No Credentials for Cipher
Using BouncyCastle FIPS JSSE and TLS providers for my server application.
<dependency>
<groupId>org.bouncycastle</groupId>
<artifactId>bcpkix-fips</...
2
votes
1
answer
629
views
How to enable named groups at Bouncy Castle JSSE (1.68)?
I want to create a Java TLS server with support of brainpoolP512r1 using Bouncy Castle 1.68 JSSE. I thought it would be enough to list it with system property jdk.tls.namedGroups but this only leads ...
0
votes
0
answers
354
views
SSLHandshakeException: Why is it not thrown until socket is read?
I develope a small client and server which establish a mutual-authenticated TLS connection using JSSE. Now, lets assume the client wants to initiate a connection but there is a legit reason for the ...
0
votes
1
answer
134
views
Is the official Oracle SSLSocketClient.java demo code insecure?
From this link, a demo for SSLSocketClient.java is given:
import java.net.*;
import java.io.*;
import javax.net.ssl.*;
/*
* This example demostrates how to use a SSLSocket as client to
* send a ...
0
votes
1
answer
526
views
How to load local client certificate in java SSL?
I tried to connect to a server's socket with TLS that requires client authentication using this client.java code
import java.io.IOException;
import java.io.InputStream;
import java.io.OutputStream;
...
1
vote
0
answers
159
views
Java: Multiple SSL connections simultaneously with independent SSL sessions
I am simulating multiple end user devices connecting to a server simultaneously. The connections are made using HttpsUrlConnection and all the connections share the same SSLSession. What is the way to ...
0
votes
1
answer
800
views
How to log TLSv1.3 keys in JSSE for Wireshark to decode traffic
I've been (successfully) looking at TLSv1.2 traffic in Wireshark via a key logfile. But I'd like to do something similar to TLSv1.3.
https://github.com/square/okhttp/pull/6060
This follows the ...
3
votes
1
answer
4k
views
Changing DH keySize in jdk.tls.disabledAlgorithms property in java.security leads to switching the server selected cipher and TLS version
We are connecting to an https url using OpenJDK 13 and we have troubles with the SSL handshake. It always ends with javax.net.ssl.SSLHandshakeException: DH ServerKeyExchange does not comply to ...
9
votes
2
answers
4k
views
Robolectric test that uses OkHttp for real HTTP requests throws java.lang.NullPointerException: No password supplied for PKCS#12 KeyStore
I'm using Robolectric 4.3.1 (testImplementation "org.robolectric:robolectric:4.3.1") to create an Android sqlite environment for my integration tests. My system uses OkHttp (implementation 'com....
2
votes
1
answer
589
views
How does one add certificate_authorities to CertificateRequest message in TLSv1.3
I'm setting up mutual authentication using TLS 1.3 using a spring boot server and curl client for testing. My truststore containts two certificate chains which are loaded correctly - in fact the ...
2
votes
0
answers
336
views
Keystore Not Recognising Certificates
I've been working on embedding 2 SSL Certificates into my java code and the below code doesn't generate any errors but when i try and access the API that needs these certificates i get an error. I've ...
0
votes
0
answers
1k
views
Where does Java look in Windows for SSL certificates?
I am running Java 8 on Windows 10. I have a security subfolder under my JAVA_HOME and can see the cacerts file there. However, I am trying to call a remote service which requires a client ...
6
votes
0
answers
2k
views
Even after setting jsse.enableSNIExtension to true, enableSNIExtension in ClientHandshaker has value false
I am trying to enable the SNI extension in my project. I set jsse.enableSNIExtension property by following ways:
1. Writing System.setProperty("jsse.enableSNIExtension", "true");
2. Passing -Djsse....
0
votes
0
answers
404
views
SSL is enabled but the socket is not an instance of javax.net.ssl.SSLSocket java mongodb connection
I am trying to connect the MongoDB which is having SSL/TLS enabled along with self signed certificates. I have loaded the self-signed certificate in my local machine cacerts. But getting the exception
...
1
vote
0
answers
5k
views
Client is sending empty certificate chain to server despite of it having all the required certificates and keys
My application is running on jboss 6.4 and trying to communicate to load balancer. When server asks for certificate chain from client (jboss), it sends an empty certificate chain and ssl handshake ...
1
vote
0
answers
25
views
Getting SunCertPathBuilderException: unable to find valid certification path to requested target [duplicate]
I am referring to this JSSE Reference Guide and doing handshake with my Webserver with an SNI Hostname and getting the public certificate.
Only for a particular SNI Domain, when I try to get the Pub-...
2
votes
0
answers
9k
views
javax.net.ssl.SSLHandshakeException: Remote host terminated the handshake
I have installed the certificate in java trust store(cacerts) using below commands:
keytool -import -file "C:\Users\kdursoji\Downloads\ZscalerRootCertificate-154478.crt" -keystore "C:\...
-1
votes
1
answer
547
views
Working with Java.io.file, when ever I try to read a cert from it it always points to wrong path
I am trying to read a cert with file IO , every time I try accessing my cert under
testApp/src/main/resources -> cert
it always reads
X:\workspace1\testApp\target\classes\cert\test.p12
And here ...
7
votes
2
answers
28k
views
OpenJDK keytool password
I am trying to register a corporate certificate for https connection in OpenJDK
I ran the following command in OpenJDK verion 8. It asked me to enter in the password. The default password for Oracle ...
0
votes
1
answer
334
views
Amazon Secrets Manager, Java 7, and CipherSuites
I am trying to get AWS Secrets Manager to work on an older Java 7 platform. Unfortunately we're locked on Java 7 for now.
The issue I have is that Java 7 had some security issues with SSL, and most ...
0
votes
0
answers
6k
views
Handshake_failure without SSLContext in java HTTPclient
I felt to have faced a strange problem, I wrote a core java http client without an SSLContext and when I run the program to call REST service, it started failing with the below exception. However when ...
4
votes
0
answers
2k
views
SSLProtocolException: Data received in non-data state: 6
My Heroku application uses PostgreSQL on AWS via Spring Data JPA. Occasionally, under high load, I see errors like this:
Caused by: javax.net.ssl.SSLProtocolException: Data received in non-data state:...
2
votes
0
answers
919
views
Tomcat 9.0.16 + Java11 sometimes produces "Error parsing HTTP request header"
We have webapp running in Tomcat 9.0.16, after change AdoptJDK from 10 to 11 we have noticed once in a while HTTP 400 status in access log. This is happening only, if HTTPS is configured, we are using ...
0
votes
1
answer
148
views
How do I access the SSLSocket used for a servlet request within the body of the doPost( method?
I am implementing a HTTP servlet by subclassing javax.servlet.http.HttpServlet and overriding the doPost method. Within the body of the doPost method, I need to access the SSLSocket object that was ...
0
votes
0
answers
100
views
How to display content on via SSL sockets on my web browser whilst using my own digital certificates?
I want to make a Java-server where I can simply open my web browser and see "Hello World". So far, I believe that I have set up a server but I don't know why nothing is displaying in the browser.
I ...
3
votes
1
answer
2k
views
Using PKIXValidator with BouncyCastleFipsProvider for server certificate validation?
We have an Apache Tomcat-based Java web application running on JDK 1.8 and recently had to strenghten its security-related features to comply with certain regulations, thus we are now using ...
5
votes
1
answer
371
views
Selected cipher negotiated by firefox browser/server does not match Tomcat configured cipher list
I am a bit confused. We have configured our v7 Tomcat server to communicate with connecting browsers using only TSLv1.2 and we have specified a restricted set of ciphers. Using a firefox browser (v60....
1
vote
1
answer
9k
views
Tomcat8 constantly displays the https-jsse-nio-443-exec log
I have a problem with the data mapping in logs of Tomcat. There are the same information in the logs and it’s unusable. Could you please check and advise me how set and get correct data in the logs?
...
4
votes
0
answers
702
views
Is there workaround for Java11 TLS1.3 supported group handshake issue before 11.0.3
Trying to move my app from java 8 to java 11 faced with exception
"javax.net.ssl.SSLHandshakeException: extension (10) should not be presented in server_hello"
I found that this issue will be fixed ...
3
votes
0
answers
980
views
Oracle Weblogic 10.3.6: missing SNI extension in SSL Handshake
I have an old Weblogic 11g where I'm trying to connect over a remote URL in HTTPS using TLSv1.2.
I have the following error:
javax.net.ssl.SSLException: Received fatal alert: handshake_failure
What ...
2
votes
1
answer
706
views
Java JSSE RMI SSL file gets access denied
For university security lab work I have to create a simple client/server application using RMI. For secure communication between client and server I wanted to use SSL. Oracle has example so I tried to ...