Skip to main content
Filter by
Sorted by
Tagged with
-1 votes
1 answer
46 views

JDK bundled TrustManager

I would like to get a TrustManager instance loaded with JDK's bundled trust material (meaning the material which in later versions of the JDK live in lib/security/cacerts file). Ideally the solution ...
peterh's user avatar
  • 19k
0 votes
1 answer
819 views

How to resolve java.security.NoSuchAlgorithmException: Error constructing implementation (algorithm: Default, provider: SunjSSE...?

I'm getting an error message when trying to connect a Java client application to a C++ Server using TLS. The C++ server is using openssl 3 for all its crypto operations. All the certificates were ...
Jack Allen's user avatar
2 votes
1 answer
89 views

Java SSLSocket find out if client sent a certificate

My application allows authenticated and non-authenticated TLS connections and in the code, I need to distinguish between them (just as in authenticated and non-authenticated HTTPS sessions). Is there ...
Andy Brunner's user avatar
0 votes
1 answer
66 views

Can't restrict accepted CA roots via X509TrustManager.getAcceptedIssuers [duplicate]

I am trying to write a custom X509TrustManager that will use the default system trust store, but allowing only a restricted set of trusted CA roots. I am trying to do this by returning a modified list ...
Grodriguez's user avatar
0 votes
0 answers
59 views

In Java, during TLS handshake, if a custom X509TrustManager is used, will the peer's signature still be verified

Below, I'm describing a super-simplified scenario, just so I won't burden you with details. If I write a client that communicates with a remote server over HTTPS, and if, during the TLS handshake, I ...
vesuvius's user avatar
0 votes
0 answers
60 views

Connecting to LDAPS from Java in multitenancy

I'm looking for a way to connect to an LDAP Server over SSL from Java in a scenario where you can have multiple users, each one with its own truststore (Basically each user is an application deployed ...
Carla's user avatar
  • 3,330
0 votes
1 answer
88 views

What is the difference between getSession, getHandshakeSession and session.startHandshake in SSLSocket.java in 2 way ssl

In SSLSocket.java there is one abstract method public abstract SSLSession getSession(); and One public SSLSession getHandshakeSession() { throw new UnsupportedOperationException(); ...
shweta kadam's user avatar
1 vote
0 answers
57 views

How to properly handshake in java using nonblocking socketchannels from the JSSE library?

I'm struggling to understand how to establish secure communication (the handshake) between a client and server using the JSSE library. I've read the documentation and have understood the first few ...
Theodore's user avatar
1 vote
0 answers
113 views

Java SSLContext setup not working, SunCertPathBuilderException

I have a working stunnel setup and am trying to use the same pem file containing the client certificate and client key and the server trust X509Certificate in a .crt file. I consistently get this ...
Olddave's user avatar
  • 437
0 votes
1 answer
1k views

Oracle JDBC: Ignore unsupported cipher suite: SSL_DH_anon_WITH_3DES_EDE_CBC_SHA for TLSv1.3

I am trying to set up an encryption-only SSL connection to Oracle 21.3, however javax.net.debug produces a following log for any anon cipher suite: I have removed appropriate entries from jdk.tls....
EMEM's user avatar
  • 33
2 votes
1 answer
1k views

How does Java pick default certificate when keystore has multiple server certificates

How does Java select the default / fallback server certificate when client does not set SNI servername at all? Background: I have created PKCS#12 keystore with multiple server certificates. I have ...
tsaarni's user avatar
  • 858
0 votes
1 answer
549 views

Java Grizzly server and Jersey client Received fatal alert: certificate_unknown

I have a Java application with an embedded SSL server and client. My application uses client authentication to determine the identity of the client, so the server is configured with wantClientAuth=...
John Calcote's user avatar
1 vote
1 answer
683 views

Received fatal alert: handshake_failure when calling from Java 1.8.0_162 to Java 1.6.0_45-b06

I'm trying to make a https call from a machine running Java 1.8.0_162 to another one running Java 1.6.0_45-b06. The one running 1.6.0_45-b06 has the bcprov-jdk15to18-1.68 and bctls-jdk15to18-1.68 ...
Sergiu's user avatar
  • 2,640
0 votes
1 answer
1k views

How to add extension to existing Key Pair using Java Keytool command or JSSE?

We have our own root certificate authority which later used to sign the certificates for clients. We have generated the root certificate authority using keytool command as below Keytool -genkeypair -...
Ravindra12jan's user avatar
1 vote
0 answers
2k views

What is conscrypt ? Can you explain its usage with some examples?

I need to use Conscrypt in my Java application. I understand that it implements parts of the Java Cryptography Extension (JCE) and Java Secure Socket Extension (JSSE). What code changes are required ...
CleanCoder540's user avatar
0 votes
0 answers
750 views

How to configure TLSv1.2 on Camel's http component to call an external service?

Below is the configured route I am using, to call an external service. services_routes.xml <beans xmlns="http://www.springframework.org/schema/beans" xmlns:xsi="http://www.w3....
tusharRawat's user avatar
1 vote
0 answers
116 views

How to use DER-encoded OCTET string for the extension value returned by X509Certificate::getExtensionValue(oid)

I am trying to manage the CRL cache locally to customize the cache timeout. The default implementation provided by Sun does not give ability to customize it. First step for this is to get the CRL ...
Ravindra12jan's user avatar
2 votes
0 answers
293 views

How to increase CRL Caching timeout in JSSE?

I want to check for the certificate revocation with the help of CRL. I am using CertPathValidator to validate the certificates. JSSE internally use URICertStore to fetch the CRL and caches it for 30 ...
Ravindra12jan's user avatar
2 votes
0 answers
2k views

Windows Certificate Store vs Java KeyStore: which is preferred for java server application?

We have server application developed in Java to which agent connects. We need to secure network connection with Certificates signed by Trusted CAs. Customers can use their own Certificate Authority to ...
Ravindra12jan's user avatar
4 votes
1 answer
2k views

BouncyCastle JSSE and BCTLS No Credentials for Cipher

Using BouncyCastle FIPS JSSE and TLS providers for my server application. <dependency> <groupId>org.bouncycastle</groupId> <artifactId>bcpkix-fips</...
ramtech's user avatar
  • 787
2 votes
1 answer
629 views

How to enable named groups at Bouncy Castle JSSE (1.68)?

I want to create a Java TLS server with support of brainpoolP512r1 using Bouncy Castle 1.68 JSSE. I thought it would be enough to list it with system property jdk.tls.namedGroups but this only leads ...
Martin's user avatar
  • 667
0 votes
0 answers
354 views

SSLHandshakeException: Why is it not thrown until socket is read?

I develope a small client and server which establish a mutual-authenticated TLS connection using JSSE. Now, lets assume the client wants to initiate a connection but there is a legit reason for the ...
moritz1895's user avatar
0 votes
1 answer
134 views

Is the official Oracle SSLSocketClient.java demo code insecure?

From this link, a demo for SSLSocketClient.java is given: import java.net.*; import java.io.*; import javax.net.ssl.*; /* * This example demostrates how to use a SSLSocket as client to * send a ...
Ya Xiao's user avatar
  • 941
0 votes
1 answer
526 views

How to load local client certificate in java SSL?

I tried to connect to a server's socket with TLS that requires client authentication using this client.java code import java.io.IOException; import java.io.InputStream; import java.io.OutputStream; ...
Achmad Fathoni's user avatar
1 vote
0 answers
159 views

Java: Multiple SSL connections simultaneously with independent SSL sessions

I am simulating multiple end user devices connecting to a server simultaneously. The connections are made using HttpsUrlConnection and all the connections share the same SSLSession. What is the way to ...
vrtx54234's user avatar
  • 2,286
0 votes
1 answer
800 views

How to log TLSv1.3 keys in JSSE for Wireshark to decode traffic

I've been (successfully) looking at TLSv1.2 traffic in Wireshark via a key logfile. But I'd like to do something similar to TLSv1.3. https://github.com/square/okhttp/pull/6060 This follows the ...
Yuri Schimke's user avatar
  • 13.2k
3 votes
1 answer
4k views

Changing DH keySize in jdk.tls.disabledAlgorithms property in java.security leads to switching the server selected cipher and TLS version

We are connecting to an https url using OpenJDK 13 and we have troubles with the SSL handshake. It always ends with javax.net.ssl.SSLHandshakeException: DH ServerKeyExchange does not comply to ...
Jan Krakora's user avatar
  • 2,590
9 votes
2 answers
4k views

Robolectric test that uses OkHttp for real HTTP requests throws java.lang.NullPointerException: No password supplied for PKCS#12 KeyStore

I'm using Robolectric 4.3.1 (testImplementation "org.robolectric:robolectric:4.3.1") to create an Android sqlite environment for my integration tests. My system uses OkHttp (implementation 'com....
Heath Borders's user avatar
2 votes
1 answer
589 views

How does one add certificate_authorities to CertificateRequest message in TLSv1.3

I'm setting up mutual authentication using TLS 1.3 using a spring boot server and curl client for testing. My truststore containts two certificate chains which are loaded correctly - in fact the ...
ljgw's user avatar
  • 2,771
2 votes
0 answers
336 views

Keystore Not Recognising Certificates

I've been working on embedding 2 SSL Certificates into my java code and the below code doesn't generate any errors but when i try and access the API that needs these certificates i get an error. I've ...
theNewb's user avatar
  • 75
0 votes
0 answers
1k views

Where does Java look in Windows for SSL certificates?

I am running Java 8 on Windows 10. I have a security subfolder under my JAVA_HOME and can see the cacerts file there. However, I am trying to call a remote service which requires a client ...
Tevya's user avatar
  • 864
6 votes
0 answers
2k views

Even after setting jsse.enableSNIExtension to true, enableSNIExtension in ClientHandshaker has value false

I am trying to enable the SNI extension in my project. I set jsse.enableSNIExtension property by following ways: 1. Writing System.setProperty("jsse.enableSNIExtension", "true"); 2. Passing -Djsse....
ABHITRNG's user avatar
0 votes
0 answers
404 views

SSL is enabled but the socket is not an instance of javax.net.ssl.SSLSocket java mongodb connection

I am trying to connect the MongoDB which is having SSL/TLS enabled along with self signed certificates. I have loaded the self-signed certificate in my local machine cacerts. But getting the exception ...
SooryaT's user avatar
1 vote
0 answers
5k views

Client is sending empty certificate chain to server despite of it having all the required certificates and keys

My application is running on jboss 6.4 and trying to communicate to load balancer. When server asks for certificate chain from client (jboss), it sends an empty certificate chain and ssl handshake ...
pragati sukhija's user avatar
1 vote
0 answers
25 views

Getting SunCertPathBuilderException: unable to find valid certification path to requested target [duplicate]

I am referring to this JSSE Reference Guide and doing handshake with my Webserver with an SNI Hostname and getting the public certificate. Only for a particular SNI Domain, when I try to get the Pub-...
Arun's user avatar
  • 3,650
2 votes
0 answers
9k views

javax.net.ssl.SSLHandshakeException: Remote host terminated the handshake

I have installed the certificate in java trust store(cacerts) using below commands: keytool -import -file "C:\Users\kdursoji\Downloads\ZscalerRootCertificate-154478.crt" -keystore "C:\...
krishna kumar Dursoji's user avatar
-1 votes
1 answer
547 views

Working with Java.io.file, when ever I try to read a cert from it it always points to wrong path

I am trying to read a cert with file IO , every time I try accessing my cert under testApp/src/main/resources -> cert it always reads X:\workspace1\testApp\target\classes\cert\test.p12 And here ...
Kishore Jetty's user avatar
7 votes
2 answers
28k views

OpenJDK keytool password

I am trying to register a corporate certificate for https connection in OpenJDK I ran the following command in OpenJDK verion 8. It asked me to enter in the password. The default password for Oracle ...
Jae Kim's user avatar
  • 145
0 votes
1 answer
334 views

Amazon Secrets Manager, Java 7, and CipherSuites

I am trying to get AWS Secrets Manager to work on an older Java 7 platform. Unfortunately we're locked on Java 7 for now. The issue I have is that Java 7 had some security issues with SSL, and most ...
wdtj's user avatar
  • 5,623
0 votes
0 answers
6k views

Handshake_failure without SSLContext in java HTTPclient

I felt to have faced a strange problem, I wrote a core java http client without an SSLContext and when I run the program to call REST service, it started failing with the below exception. However when ...
user2585494's user avatar
4 votes
0 answers
2k views

SSLProtocolException: Data received in non-data state: 6

My Heroku application uses PostgreSQL on AWS via Spring Data JPA. Occasionally, under high load, I see errors like this: Caused by: javax.net.ssl.SSLProtocolException: Data received in non-data state:...
Jan Nielsen's user avatar
  • 11.5k
2 votes
0 answers
919 views

Tomcat 9.0.16 + Java11 sometimes produces "Error parsing HTTP request header"

We have webapp running in Tomcat 9.0.16, after change AdoptJDK from 10 to 11 we have noticed once in a while HTTP 400 status in access log. This is happening only, if HTTPS is configured, we are using ...
Ota's user avatar
  • 21
0 votes
1 answer
148 views

How do I access the SSLSocket used for a servlet request within the body of the doPost( method?

I am implementing a HTTP servlet by subclassing javax.servlet.http.HttpServlet and overriding the doPost method. Within the body of the doPost method, I need to access the SSLSocket object that was ...
rossmpersonal's user avatar
0 votes
0 answers
100 views

How to display content on via SSL sockets on my web browser whilst using my own digital certificates?

I want to make a Java-server where I can simply open my web browser and see "Hello World". So far, I believe that I have set up a server but I don't know why nothing is displaying in the browser. I ...
Jordan's user avatar
  • 697
3 votes
1 answer
2k views

Using PKIXValidator with BouncyCastleFipsProvider for server certificate validation?

We have an Apache Tomcat-based Java web application running on JDK 1.8 and recently had to strenghten its security-related features to comply with certain regulations, thus we are now using ...
skarfiol's user avatar
  • 131
5 votes
1 answer
371 views

Selected cipher negotiated by firefox browser/server does not match Tomcat configured cipher list

I am a bit confused. We have configured our v7 Tomcat server to communicate with connecting browsers using only TSLv1.2 and we have specified a restricted set of ciphers. Using a firefox browser (v60....
Peter Hiross's user avatar
1 vote
1 answer
9k views

Tomcat8 constantly displays the https-jsse-nio-443-exec log

I have a problem with the data mapping in logs of Tomcat. There are the same information in the logs and it’s unusable. Could you please check and advise me how set and get correct data in the logs? ...
Vladimir Pikalov's user avatar
4 votes
0 answers
702 views

Is there workaround for Java11 TLS1.3 supported group handshake issue before 11.0.3

Trying to move my app from java 8 to java 11 faced with exception "javax.net.ssl.SSLHandshakeException: extension (10) should not be presented in server_hello" I found that this issue will be fixed ...
nahab's user avatar
  • 1,344
3 votes
0 answers
980 views

Oracle Weblogic 10.3.6: missing SNI extension in SSL Handshake

I have an old Weblogic 11g where I'm trying to connect over a remote URL in HTTPS using TLSv1.2. I have the following error: javax.net.ssl.SSLException: Received fatal alert: handshake_failure What ...
Alessandro C's user avatar
  • 3,510
2 votes
1 answer
706 views

Java JSSE RMI SSL file gets access denied

For university security lab work I have to create a simple client/server application using RMI. For secure communication between client and server I wanted to use SSL. Oracle has example so I tried to ...
Agne's user avatar
  • 23

1
2 3 4 5 6