Develop Reference

Using https in Rest web service

I have a Rest web service developed in java, glassfish, running on a centos server.
We recently opted to use the https protocol and started testing through the test certificate provided by glassfish itself at deployment time (port 8181).
Using Postman for testing I just needed to disable one option in the configuration: "SSL certificate verification".
However the modules that consumed my service, service destop, in java, started to throw exceptions.
javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
In test environment, windows, the lines below corrected the problem, already in production, hundreds, could not solve.
String certificatesTrustStorePath = "/etc/alternatives/jre_1.8.0/lib/security/cacerts";
System.setProperty("javax.net.ssl.trustStore", certificatesTrustStorePath); System.setProperty("javax.net.ssl.trustStorePassword", "changeit");
The error in centos is the one presented in the post below, already read about the various reasons but could not solve.
Error - trustAnchors parameter must be non-empty
If you know how to solve in linux I appreciate it,but the question is not this ...
Do these lines I have published specify where the cacerts file is (and within my platform certificate)?
But it seems to me wrong ... I've already consumed third party https rest services and never had to specify the certificate path ... this would require me to know structurally some details of a third party server. Am I wrong?
So, I imagine there must be another way to do it ... could anyone help?

Yes, your code specifies a custom path for truststore where the ssl cert is present.
This is the public key shared corresponding to the https protocol for the handshake(either self-signed or signed by a whitelisted CA).
Default path where these get stored is
$JAVA_HOME/jre/lib/security/cacerts
Though above can be overridden.
So in your code, you have overridden the path, to point it where the public key(cert) is already present. Thus it's working for you.
Truststore is just a collection of public keys.
Alternatively, you can import the public key in the default truststore as well to make it work.
In that case, you don't have to explicitly set a different truststore.

There is many ways to do it.
copy your file to $java_home\jre\lib\security\cacerts\ than you don't have to set property manually.
you can also mention path at runtime using
-Djavax.net.ssl.trustStore=/home/user/SSL/mycacerts
-Djavax.net.ssl.keyStore=/home/user/SSL/serverkeystore.jks

During post request on send email API of mailgun it shows error using java web application

I am using mailgun to send email but from last day it shows error during POST request on email send api as below.I am using java/spring/AWS to my web app.I tried to restart app and to check if certificate is already in the trust store but we never had generate trust store keys.
com.mashape.unirest.http.exceptions.UnirestException: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
at com.mashape.unirest.http.HttpClientHelper.request(HttpClientHelper.java:143)
at com.mashape.unirest.request.BaseRequest.asJson(BaseRequest.java:68)

On 1/22, we updated our SSL certificates due to Symantec's PKI infrastructure set to become untrusted. Some older versions of Java do not have the "DigiCert Global Root G2" CA.
There are several options:
Import the "DigiCert Global Root G2" CA into your "cacerts" file.
Upgrade your JRE to 8u91 (or higher), which includes this root.
To import the "DigiCert Global Root G2" You can download the root from https://www.digicert.com/digicert-root-certificates.htm. Ensure you are downloading the correct root certificate.
Once the certificate is downloaded, you'll need to import it into with a command like the following:
keytool -import -trustcacerts -keystore /path/to/cacerts -storepass changeit -noprompt -alias digicert-global-root-g2 -file /path/to/digicert.crt
You will need to set the path to your Java Keystore and the location of the root certificate you downloaded.

Same issue for us (java).
Here is what Mailgun support said:
Hello,
Thank you for reaching out to us in regards to our SSL certification renewal, >which are now fully completed. This update was pushed out to correct numerous >certificates that did not comply with the industry-developed CA/Browser Forum >Baseline Requirements by Symantec’s PKI business. You can read more about this >here.
Now that the updates have been completed, if you’re still having difficulties >sending, we can provide some suggestions to get your application back up and >running.
If you’re utilizing PHP-
1) Download the latest CA certificates from (https://curl.haxx.se/docs/caextract.html) This is an extract of a list of certificates vetted by Mozilla.
2) Set the path to the CA certificates in the .htaccess file with a directive like the following:
php_value curl.cainfo "/path/to/cacert.pem"
If you have access to your php.ini file, you can modify this value globally by setting curl.cainfo = "/path/to/cacert.pem"
If you’re utilizing cURL-
_Ubuntu users:_https://askubuntu.com/questions/646594/how-to-fix-ca-cert-issues-with-curl-in-ubuntu-14-04
RedHat users: https://serverfault.com/questions/394815/how-to-update-curl-ca-bundle-on-redhat
Be sure to restart your sending application after updating.
If a restart of your application does not clear the issue, the certificate cache may need to be cleared. Here is some additional information as to how this might be accomplished for you:
http://unitstep.net/blog/2009/05/05/using-curl-in-php-to-access-https-ssltls-protected-sites/
http://stackoverflow.com/questions/7219989/java-and-ssl-certificates
Because every sending application is be different, the exact method for updating the certifications/restarting your sending application may vary for you. If none of these options worked, some independent research might be needed for the update/restart method applicable to you.
While these suggestions are meant to help resolve the issues you are experiencing, making certain changes to your environment can always cause further issues with your application. We highly recommend making these changes in a non-production environment prior to releasing into production. These are only intended as suggested fixes and in no-way guarantee that this will fix the issue, further steps may need to be taken depending on your specific environment. As always Mailgun will always do our best to answer any questions that you may have, but there are limitations in the support we can provide.
Thanks,
Keith#MG
Restarting the application did not fix the issue. I'm trying to find which CA they are using to see if we can import it in the trustore.

Automaticly resolve Java SSL errors? - Unable to find valid certification path to requested target

I'm trying to put together a simple web crawler using the jsoup library.
However when calling "Jsoup.connect(url).get()" On some sites I'm getting the error below.
javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
There are a number of other questions about this error, but all of them suggest resolving it by manually creating a cert for the site in question. Since I'm trying to do a web crawler that will connect to many sites, that's not really a solution.
Is there a recommended way to resolve this? For a simple web crawler security is not particularly a concern, so the authenticity of the cert does not matter.

Solution I'm using for now, Option 2 mentioned in a related question here. Accept server's self-signed ssl certificate in Java client

You should ignore TSL validation, set validateTLSCertificates(false):
Document document = Jsoup.connect(url).timeout(10000).validateTLSCertificates(false).get();

Yodlee - SSL Error when trying to Cobrand Login

I just downloaded the sample java code from the Yodlee site and I incorporated that into my web application. When I try to run, I error out on the Cobrand login:
Validating Cobrand by Connecting to URL https://rest.developer.yodlee.com/services/srest/restserver/v1.0/authenticate/coblogin
javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
I believe the issue is that my development environment (JDeveloper) doesn't have Yodlee's SSL certificate. I've searched the Yodlee site but I don't see any mention of test SSL certificates that I can import/reference.
I created similar code for an OFX connection, and had the same issue. That solution was to create an EventListener and then ignore SSL:
public void SSLServerAuthentication(InvstatementSSLServerAuthenticationEvent invstatementSSLServerAuthenticationEvent) {
invstatementSSLServerAuthenticationEvent.accept = true;
}
I also can't find any information on a Yodlee event listener base class.
How is everyone else getting around this issue?
I assume that once I deploy this to my production environment, I'll have to import the Yodlee SSL certificate into my WebLogic cert store... but one problem at a time for now :)
[EDIT] ANSWERED
I fixed this issue by changing the location that JDeveloper is using for it's keystore.
It was ..../DemoTrust.jks and I changed it to:
C:\Oracle\Middleware11116\jdk160_24\jre\lib\security\cacerts
This is under Tools / Preferences / Credentials
I was told that DemoTrust.jks doesn't have many signing authorities in it and cacerts does.
I will also need to make sure my production WebLogic server is using cacerts and not DemoTrust. Apparently in the start up of WebLogic, you'll get a big warning if you're pointing to DemoTrust.

ANSWER
[Sorry for the duplication, but I should have "Answered" my question and not edited the answer into the question]
I fixed this issue by changing the location that JDeveloper is using for it's keystore. It was ..../DemoTrust.jks and I changed it to: C:\Oracle\Middleware11116\jdk160_24\jre\lib\security\cacerts This is under Tools / Preferences / Credentials
I was told that DemoTrust.jks doesn't have many signing authorities in it and cacerts does. I will also need to make sure my production WebLogic server is using cacerts and not DemoTrust. Apparently in the start up of WebLogic, you'll get a big warning if you're pointing to DemoTrust.
Chris

Axis over SSL and 2-way authentication with a PKCS#12 keystore

I have PKCS#12 keystore that I've sucessfully imported in my browser for accessing a server that needs 2-way SSL authentication. Works perfectly reaching any https URL there.
However, I'm unable to access an URL in the same server, and from the same host when using Axis 1.4. The given Axis faultString is:
javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
My javax.net.ssl.{keyStore,keyStorePassword,keyStoreType} properties seem to be set up fine.
How can I resolve this?

I came across a simpler answer if all you want is for your client to be able to call the SSL web service and ignore SSL certificate errors. (Of course you would NOT do this in production!, but it sure is handy for testing.)
Just put this statement before you invoke any web services:
System.setProperty("axis.socketSecureFactory",
"org.apache.axis.components.net.SunFakeTrustSocketFactory");
I found this at the Axis wiki.

Finally, importing the certificates into my own truststore, using Andreas Sterbenz's InstallCert, and setting the trustStore properties as indicated here did the trick!