Example Depot

I think the point is testing, against servers that have either self-signed certificates or are borrowing ones from other servers (for testing). Yes you lose some security, but your testing works.

Ok this page code is ok if i replace

SSLContext sc = SSLContext.getInstance("SSL");

with

SSLContext sc = SSLContext.getInstance("TLS");

and is working.

Thank you very much. You solved my biggest problem in the project.

Fantastic example, thanks to the author. The next version of our site checker (DeepTrawl) will now work much better with certs.

In my case I always need to secure my domains for the main reason that I hate spammers. But still I find this very useful anytime I will have to disable my https connection. radley bags

any similar solution for .Net?

Hey
I have tried the above example. But it doesn't work for me. It still throws the javax.net.ssl.SSLException Not trusted server certificate. I am trying it on Android. My code looks like:

public void run() {
try {

TrustManager[] trustAllCerts = new TrustManager[]{new X509TrustManager() {
public java.security.cert.X509Certificate[] getAcceptedIssuers() {
return null;
}
public void checkClientTrusted(
java.security.cert.X509Certificate[] certs, String authType) {
}
public void checkServerTrusted(java.security.cert.X509Certificate[] certs, String authType) {
}
}
};

// Install the all-trusting trust manager
try {
SSLContext sc = SSLContext.getInstance("SSL");
sc.init(null, trustAllCerts, new java.security.SecureRandom());
HttpsURLConnection.setDefaultSSLSocketFactory(sc.getSocketFactory());
} catch (Exception e) {
}

try {
// Create the client socket
int port = 443;
String hostname = "myhostname"; //I have put my hostname here.
SSLSocketFactory factory = HttpsURLConnection.getDefaultSSLSocketFactory();
SSLSocket socket = (SSLSocket)factory.createSocket(hostname, port);

// Connect to the server
socket.startHandshake();

// Retrieve the server's certificate chain
java.security.cert.Certificate[] serverCerts = socket.getSession().getPeerCertificates();

// Close the socket
socket.close();
} catch (SSLPeerUnverifiedException e) {
} catch (IOException e) {
}
HttpConnectionParams.setConnectionTimeout(httpClient.getParams(), 20000); // 20 secs
HttpPost httpPost = new HttpPost(serverpath);
httpPost.setEntity(new StringEntity(request.getRequestData()));
HttpResponse response = httpClient.execute(httpPost);

// process response
wrapper.setResponse(response);
handler.post(wrapper);
} catch (ClientProtocolException e) {
e.printStackTrace();
} catch (IOException e) {
e.printStackTrace();
}
}

Hi ..
Thanks for post!!! Its a great help.
Can anyone help me in the following scenerio:
I am trying to get an instance of a remote weblogic server through an java client which is an SSL enabled with an self signed certificate.How can i use the above code to avoid the SSL handshake expection.
Please any help will be of a great help!!!

The below is the piece of code i am using to get an initial context to the weblogic server.
public InitialContext getContext(String integrationId) {
InitialContext ctx = null;
try {
Properties env = new Properties();
env.put(Context.PROVIDER_URL, "t3://10.10.201.41:8011");
env.put(Context.SECURITY_PRINCIPAL, "weblogic");
env.put(Context.SECURITY_CREDENTIALS, "welcome1");
env.put(Context.INITIAL_CONTEXT_FACTORY, "weblogic.jndi.WLInitialContextFactory");
ctx = new InitialContext(env);

}catch(Exception e) {
System.out.println(integrationId+" ==> "+e.getMessage());
e.printStackTrace();
}
return ctx;
}

thank you thank you thank you!!!! u save my life... lol

¡Muchas gracias! Funciona.
Many thanks! It works.

thanks..u saves lot of my time..

please, how can i make this work for POP3SSLStore ?

Excellent ..it worked fine ..just copy paste..Any disadvantages.?

You made my day.

I also had to do add the setDefaultHostnameVerifier call . Otherwise I was getting the hostname error.

Real Classy.... Thank you very much.... Very good page.

First I would like to say thanks for posting the original solution. Secondly I am not that well versed in certificate handling so please bear with me.

I implemented the code for trusting all certificates into a JUnit test case that exercises a class that makes an HTTPS request to an external site. However I was concerned about the MITM vulnerability, so I attempted to eliminate the MITM vulnerability with the code shown below.

I exported from my web browser to the xxxx.crt file the public (???) certificate that was downloaded to the browser when I accessed the site via the browser.

When running through debug I can see that the certs array is invoked with 4 certificates, the first certificate in the array is the certificate from the external site in question. I assumed by comparing (verify method) the certificates in the array with the certificate in the file that a match would be found on at least one of the certificates in the array, thereby eliminating the MITM vulnerability.

However as the code loops through the array the SignatureException is thrown on every iteration.

Does anyone have any insight as to why this does not work as expected.

And if I can get this to work without throwing an exception then is it truly eliminating the MITM vulnerability?


public void checkServerTrusted(X509Certificate[] certs, String authType) {
InputStream is = this.getClass().getClassLoader().getResourceAsStream("xxxx.crt");

try {
CertificateFactory cf = CertificateFactory.getInstance("X.509");
Certificate publicCert = cf.generateCertificate(is);
PublicKey publicKey = publicCert.getPublicKey();
boolean validSignature = false;

for (int i = 0; i < certs.length; i++) {
try {
certs[i].verify(publicKey);
validSignature = true;
break;

} catch (SignatureException e) {
}
}

if (!validSignature) {
throw new SignatureException();
}

} catch (InvalidKeyException e) {
throw new RuntimeException(e);

} catch (java.security.cert.CertificateException e) {
throw new RuntimeException(e);

} catch (NoSuchAlgorithmException e) {
throw new RuntimeException(e);

} catch (NoSuchProviderException e) {
throw new RuntimeException(e);

} catch (SignatureException e) {
throw new RuntimeException(e);
}
}

Conect me

Thank you for the useful article. I found it looking for a solution for our java hosting client.

That's the best aneswr of all time! JMHO

According to my own analysis, thousands of persons all over the world get the loan at good banks. So, there is good chances to receive a secured loan in every country.

it's excellent, thank you very much, me has salvao la vida tio!!!!

Thanks to the original author and to SJ Baker all the way back in 2010 for the DefaultHostnameVerifier tip, which solved my problem!