Develop Reference

HTTPS vs HTTP in java

We got an wsdl from a website and we generated the java code with Axis2. Works perfect but the site is HTTPS and has the SSL certificatite turned off.
When I make a request I get
Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
The admin from the site told me to disable SSL
I can't seem to find a solution for this.
What do I need to call before the request to disable this?

how to not to verify certificate in ldap ssl connection

I'm using novell ldap api and I must use ssl connection but I'm searching for a way in which the client not verify the certificate when connection starts...I get the follow exception:
javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
I'm try to reproduce the behavior like when I open a web page in https and browser asks me if I want to accept the certificate...
I didn't find any method to do this with novell ldap api and I'm wondering if it is possibile to do in pure java programmatic way. Thanks
G

HTTPS Certificate issue

I am getting following error while using certificate file, I have generated truststore of the same and passing it to XmlRpcCommonsTransportFactory
org.apache.xmlrpc.XmlRpcException: I/O error while communicating with HTTP server: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

What I think you're dealing with is a certificate chain issue and not an XML-RPC specific issue.
You will need to look up how to get your XML-RPC client to implicitly trust the certificate and not do more than a cursory validation.
There are examples of this, I'm just not sure how to tie it to your particular XML-RPC client.

The issue here is that your truststore doesn't trust the certificate provided by the peer.
I have generated truststore of the same
What exactly do you mean by that?

How to disable javamail SSL support?

I receive the following Exception while trying to send an email (using Seam)
Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find vali
d certification path to requested target
at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:285)
at sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:191)
at sun.security.validator.Validator.validate(Validator.java:218)
at com.sun.net.ssl.internal.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:126)
at com.sun.net.ssl.internal.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:209)
at com.sun.net.ssl.internal.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:249)
at com.sun.net.ssl.internal.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1014)
... 68 more
Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:174)
at java.security.cert.CertPathBuilder.build(CertPathBuilder.java:238)
at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:280)
... 74 more
I tested the server by using a plain javamail app with no extra settings and it worked fine.
But using Seams mail-tags the Exception occurs.
- Is there a way to disable SSL?
I realy don't need SSL.
I found these properties in a forum
mail.smtp.ssl.trust="*"
mail.smtp.starttls.enable="true"
How could I pass them the properties above through seam framework down to javamail ?

The error you're getting means that one of the certificates (presumably the server's certificate) isn't trusted by your JavaMail client. Since you seem to be using STARTTLS, you're effectively using SSL/TLS.
You could perhaps try something like mail.smtp.starttls.enable="false" if you don't want to use SSL/TLS at all, although some SMTP servers will force you to use it (either SSL/TLS on connection or via STARTTLS) to proceed any further.
Alternatively, if you change your mind and want/need to use SSL, make sure your trust store on the client side contains a trust anchor (CA certificate) that can be used to verify your server certificate. (Note that the mail.smtp.ssl.checkserveridentity default to false is insecure, so you'd want to change that to true, and not use mail.smtp.ssl.trust="*".)

According to Seam reference manual and Seam forum you should be able to disable TLS and SSL directly in your components.xml configuration:
<mail:mail-session debug="true" tls="false" ssl="false" ... />

Axis over SSL and 2-way authentication with a PKCS#12 keystore

I have PKCS#12 keystore that I've sucessfully imported in my browser for accessing a server that needs 2-way SSL authentication. Works perfectly reaching any https URL there.
However, I'm unable to access an URL in the same server, and from the same host when using Axis 1.4. The given Axis faultString is:
javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
My javax.net.ssl.{keyStore,keyStorePassword,keyStoreType} properties seem to be set up fine.
How can I resolve this?

I came across a simpler answer if all you want is for your client to be able to call the SSL web service and ignore SSL certificate errors. (Of course you would NOT do this in production!, but it sure is handy for testing.)
Just put this statement before you invoke any web services:
System.setProperty("axis.socketSecureFactory",
"org.apache.axis.components.net.SunFakeTrustSocketFactory");
I found this at the Axis wiki.

Finally, importing the certificates into my own truststore, using Andreas Sterbenz's InstallCert, and setting the trustStore properties as indicated here did the trick!