Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I'm trying to test a script, locally, which involves uploading a file using a Java-based program to a FileZilla FTPES server.

For the real thing, there is a real certificate on the FZ server, and the upload step (tested alone) seems to work fine.

I've installed FileZilla Server on my dev box (so it'll test uploading from localhost to localhost). I don't have a real certificate for it, of course, so I used the "Generate new certificate..." button in FZ. It works fine from an interactive FTPES program (as long as I OK the unknown cert), but from my Java program it throws a javax.net.ssl.SSLHandshakeException ("unable to find valid certification path to requested target").

So how do I tell Java that this certificate is OK with me?

(I know there's a way to change the Java program to accept any certificate, but I don't want to go down that route. I want to test it just as it will happen in production, and I don't want to ignore unknown certificates in production.)

I found that Java has a program called "keytool" that seems to be for managing this sort of thing, but it complains that the certificate file that FZ generated is not an "x.509" file. A posting from the FZ side said it was "PEM encoded". I have "openssl" here, which looks like it's perfect for converting between certificate formats, but I think my understanding of certificate formats is wrong because I'm not seeing anything obvious.

My knowledge of security certificates is a bit shaky, so if my title is stupidly wrong, please help by fixing that. :-)

share|improve this question
add comment

1 Answer

up vote 1 down vote accepted

PEM is just a mechanism of encoding binary data in an base64 representation. Most x.509 certificates are PEM encoded; they look something like this:

-----BEGIN CERTIFICATE-----
MIICbDCCAdWgAwIBAgIJALeUXoWyGYBYMA0GCSqGSIb3DQEBBQUAMCoxGzAZBgNV
BAMMEmh4NTA5IFRlc3QgUm9vdCBDQTELMAkGA1UEBhMCU0UwHhcNMDcxMTE1MDY1
ODU2WhcNMTcxMTEyMDY1ODU2WjAqMRswGQYDVQQDDBJoeDUwOSBUZXN0IFJvb3Qg
Q0ExCzAJBgNVBAYTAlNFMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDHcvJb
yJXPhM9HHq1hU6d2Cu1fW9o1CvObirn1SNZg+pTnQgO9Lv4VjQQfltNK0aovyLJa
UdbAbsRCfH+79YY2tU76x8aXpUri0DfUv5PGscIZzW7WULaaXxBgHo1owzmhc1Qj
F9JDEurJXGFEZaDsPcEwY40RjrKDL8SXzEoEwwIDAQABo4GZMIGWMB0GA1UdDgQW
BBSM5w21xd5phXUsCKHeUxUwnKHoADBaBgNVHSMEUzBRgBSM5w21xd5phXUsCKHe
UxUwnKHoAKEupCwwKjEbMBkGA1UEAwwSaHg1MDkgVGVzdCBSb290IENBMQswCQYD
VQQGEwJTRYIJALeUXoWyGYBYMAwGA1UdEwQFMAMBAf8wCwYDVR0PBAQDAgHmMA0G
CSqGSIb3DQEBBQUAA4GBAIBa6mq1aytlbhixD6q4PROg7P1OGX6nr5CkC96CC+Xp
5UTLZEVIddkrBswNAAS0p5eEorO8xD9eT5ztZ0oYITymsO1sEIfDLks+LhdBoyF7
TX24INRwjlqsC8UlbRFoClxIMNhrMwcC3oZ4oLddV2OmA0IOG6yHXvEOQq0sTotr
-----END CERTIFICATE-----

You can examine such a certificate using openssl like this:

$ openssl x509 -in filename -noout -text

For the above certificate, this prints:

Certificate:
Data:
    Version: 3 (0x2)
    Serial Number:
        b7:94:5e:85:b2:19:80:58
    Signature Algorithm: sha1WithRSAEncryption
    Issuer: CN=hx509 Test Root CA, C=SE
    Validity
        Not Before: Nov 15 06:58:56 2007 GMT
        Not After : Nov 12 06:58:56 2017 GMT
    Subject: CN=hx509 Test Root CA, C=SE
    Subject Public Key Info:
        Public Key Algorithm: rsaEncryption
        RSA Public Key: (1024 bit)
            Modulus (1024 bit):
                00:c7:72:f2:5b:c8:95:cf:84:cf:47:1e:ad:61:53:
                a7:76:0a:ed:5f:5b:da:35:0a:f3:9b:8a:b9:f5:48:
                d6:60:fa:94:e7:42:03:bd:2e:fe:15:8d:04:1f:96:
                d3:4a:d1:aa:2f:c8:b2:5a:51:d6:c0:6e:c4:42:7c:
                7f:bb:f5:86:36:b5:4e:fa:c7:c6:97:a5:4a:e2:d0:
                37:d4:bf:93:c6:b1:c2:19:cd:6e:d6:50:b6:9a:5f:
                10:60:1e:8d:68:c3:39:a1:73:54:23:17:d2:43:12:
                ea:c9:5c:61:44:65:a0:ec:3d:c1:30:63:8d:11:8e:
                b2:83:2f:c4:97:cc:4a:04:c3
            Exponent: 65537 (0x10001)

...and a bunch of other stuff. This is how you can (a) verify that your file contains a certificate, and (b) see the certificate details.

share|improve this answer
    
Hmm, mine prints out pretty much like that. –  Ken Jan 12 '11 at 1:16
    
The file that FZ generated has both a "BEGIN RSA PRIVATE KEY" and a "BEGIN CERTIFICATE" section, so I tried putting just the "BEGIN CERTIFICATE" section in its own file, and feeding that to keytool, and it worked. I guess Java isn't smart enough to handle 2 things in one file? Anyway, your answer was enough to point me in the right direction, so thanks! –  Ken Jan 12 '11 at 1:22
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.