Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have successfully generated a keystore using

keytool -genkeypair -alias SomeAlias -keyalg RSA -validity 365 -keystore NAME.keystore -storetype JKS

placed it in tomcat config dir and updated server.xml file enabling 8443 port listening.

So i can access https://localhost:8443/MyApp

But when i am trying to POST some data from https://localhost:8443/MyApp to https://localhost:8443/MyApp

sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

my POST function:

    public void HttpsPostData(String data, URL url){
    try {
        String encodedData = URLEncoder.encode("data", "UTF-8") + "=" + URLEncoder.encode(data, "UTF-8");
        HttpsURLConnection con = (HttpsURLConnection)url.openConnection();

        con.setDoOutput(true);
        OutputStreamWriter wr = new OutputStreamWriter(con.getOutputStream());
        wr.write(encodedData);
        wr.flush();

        BufferedReader in = new BufferedReader(new InputStreamReader(con.getInputStream()));

        String inputLine;

        while ((inputLine = in.readLine()) != null)
        {
            System.out.println(inputLine); 
        }

        in.close();
    } catch (IOException ex) {
        Logger.getLogger(Sender.class.getName()).log(Level.SEVERE, null, ex);
    }
}

what i am missing?

share|improve this question
add comment

1 Answer

You will have to trust the server certificate, even if it was localhost. Probably the easiest way is to use a Java application called InstallCert. See a blog post here.

Quick steps:

  1. Compile the InstallCert.java with javac InstallCert.java.
  2. Call java InstallCert localhost:8443, trust the certificate and InstallCert will produce a file called jssecacerts.
  3. Copy jssecacerts to your JDK directory under the jre/lib/security directory.

and the program should be able to trust the certificate.

share|improve this answer
    
Is it possible to do it in runtime without touching java.home? –  Eir Nym Nov 3 '11 at 13:32
    
@EirNym Apparently yes (see: exampledepot.com/egs/javax.net.ssl/TrustAll.html). I would only recommend this for testing purposes, because this basically makes the SSL useless. –  miq Nov 3 '11 at 13:50
    
So I can easily make X509TrustManager with partial trust! –  Eir Nym Nov 3 '11 at 13:59
1  
@EirNym if you want to use a different truststore (other than cacerts in the JRE home directory), you can use the javax.net.ssl.trustStore (and related) system properties. –  Bruno Dec 27 '11 at 23:24
    
Bruno, thanks! it's very useful! –  Eir Nym Dec 28 '11 at 15:41
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.