Quantcast



Docs


Blogs


Forums


Samples


Media


Labs


Resources

 




DevCentral > Weblogs > Joe Pruitt - A Software Architect's take on Network Security
 SSL Trust Provider for Java
posted on Wednesday, July 06, 2005 2:46 PM

I've blogged about Self-signed Server Certificates and how they can cause havoc with client java applications. We'll I put the call out there to provide solutions and a very slick one has arrived!

XTrustProvider.java:

/*
 * The contents of this file are subject to the "END USER LICENSE AGREEMENT FOR F5
 * Software Development Kit for iControl"; you may not use this file except in
 * compliance with the License. The License is included in the iControl
 * Software Development Kit.
 *
 * Software distributed under the License is distributed on an "AS IS"
 * basis, WITHOUT WARRANTY OF ANY KIND, either express or implied. See
 * the License for the specific language governing rights and limitations
 * under the License.
 *
 * The Original Code is iControl Code and related documentation
 * distributed by F5.
 *
 * Portions created by F5 are Copyright (C) 1996-2004 F5 Networks
 * Inc. All Rights Reserved.  iControl (TM) is a registered trademark of
 * F5 Networks, Inc.
 *
 * Alternatively, the contents of this file may be used under the terms
 * of the GNU General Public License (the "GPL"), in which case the
 * provisions of GPL are applicable instead of those above.  If you wish
 * to allow use of your version of this file only under the terms of the
 * GPL and not to allow others to use your version of this file under the
 * License, indicate your decision by deleting the provisions above and
 * replace them with the notice and other provisions required by the GPL.
 * If you do not delete the provisions above, a recipient may use your
 * version of this file under either the License or the GPL.
 */
import java.security.AccessController; 
import java.security.InvalidAlgorithmParameterException; 
import java.security.KeyStore; 
import java.security.KeyStoreException; 
import java.security.PrivilegedAction; 
import java.security.Security; 
import java.security.cert.X509Certificate; 
  
import javax.net.ssl.ManagerFactoryParameters; 
import javax.net.ssl.TrustManager; 
import javax.net.ssl.TrustManagerFactorySpi; 
import javax.net.ssl.X509TrustManager; 
  
public final class XTrustProvider extends java.security.Provider
{ 
    private final static String NAME = "XTrustJSSE"; 
    private final static String INFO =
        "XTrust JSSE Provider (implements trust factory with truststore validation disabled)"; 
    private final static double VERSION = 1.0D; 
     
    public XTrustProvider()
   { 
       super(NAME, VERSION, INFO); 
        
       AccessController.doPrivileged(new PrivilegedAction()
      { 
         public Object run()
         { 
                 put("TrustManagerFactory." + TrustManagerFactoryImpl.getAlgorithm(),  
                                               TrustManagerFactoryImpl.class.getName()); 
                 return null; 
             } 
       }); 
    } 
     
    public static void install()
   { 
       if(Security.getProvider(NAME) == null)
      { 
          Security.insertProviderAt(new XTrustProvider(), 2); 
          Security.setProperty("ssl.TrustManagerFactory.algorithm",
              TrustManagerFactoryImpl.getAlgorithm()); 
       } 
    } 
     
    public final static class TrustManagerFactoryImpl extends TrustManagerFactorySpi
   { 
       public TrustManagerFactoryImpl() { } 
       public static String getAlgorithm() { return "XTrust509"; } 
       protected void engineInit(KeyStore keystore) throws KeyStoreException { } 
       protected void engineInit(ManagerFactoryParameters mgrparams)
         throws InvalidAlgorithmParameterException
      { 
          throw new InvalidAlgorithmParameterException(
              XTrustProvider.NAME + " does not use ManagerFactoryParameters"); 
       } 
        
       protected TrustManager[] engineGetTrustManagers()
      { 
            return new TrustManager[] { new X509TrustManager()
         { 
             public X509Certificate[] getAcceptedIssuers() { return null; } 
             public void checkClientTrusted(X509Certificate[] certs, String authType) { } 
             public void checkServerTrusted(X509Certificate[] certs, String authType) { } 
            }}; 
        } 
    } 
 } 

Calling Application:

...
XTrustProvider.install();
...

This file is up in CodeShare for those who are cut+paste challenged B-).

Hat tip to Exnihilo for posting this solution!

-Joe

[Listening to: Ob-La-Di, Ob-La-Da - The Beatles - The White Album (03:08)]

Categories:  


Email This
  del.icio.us
      

Feedback


3/6/2006 1:01 PM
Gravatar I am using the fix above with HttpUnit, but the website I have to test also requires client authentication via SSL. I have the certificate for this, but I don't know how to get HttpUnit to use my client cert. Any ideas?
Rob Whitener

3/6/2006 2:31 PM
Gravatar Wish I could help you but I've never used HttpUnit before. This has to be a pretty standard option to hook up a client cert to it's endpoint requests. At least you would think...

-Joe
Joe Pruitt

3/7/2006 11:28 AM
Gravatar I figured it out, it is pretty simple acutally. To use a client certificate, just set the system properties for the keyStore, keyStoreType, and keyStorePassword like this:

System.setProperty("javax.net.ssl.keyStore",
"C:\\auto\\USF.ATAP.ROB01-1013682586-1-key-and-cert.p12");
System.setProperty("javax.net.ssl.keyStoreType","PKCS12");

System.setProperty("javax.net.ssl.keyStorePassword","passw0rd");

Using your own store, password and whatever type your store is. Just in case anyone else runs into this.
Rob Whitener

9/25/2006 5:25 PM
Gravatar What a great solution. No more "unable to find valid certification path to requested target" errors when testing over HTTPS to our development server. Works with HTMLUnit and HTTPUnit for me.
Adam Buckley

10/24/2006 6:26 PM
Gravatar It works!!! Thanks!!
Guest

10/26/2006 1:58 PM
Gravatar Thank you. It worked.
ken

9/3/2007 9:01 AM
Gravatar Very Good Work, thx
darmowe programy

9/5/2007 11:58 PM
Gravatar I am trying to use the iControlIntermediary classes for java. I am just trying to connect to the LB using VirtualNode but I get the "unable to find valid certification path to requested target" error. Do i have make a keystore?

Sorry if this is a n00b question.. :P
Naman Joshi

9/17/2007 10:38 AM
Gravatar Saved me from hours of painful work, thanks so much!!!
Wolfgang

10/26/2007 6:56 PM
Gravatar Me too. Really thanks. Really great job!
Darmowe mp3

11/8/2007 8:30 AM
Gravatar Guys,

if I want to implement this https on sap J2EE engine, what is the process ?

Thanks
cris

11/8/2007 10:35 AM
Gravatar This code is somewhat outdated by the iControl Library for Java available in the Labs section of DevCentral. It encapsulates all of the connection information (including client side ssl management).

-Joe
Joe Pruitt

11/10/2007 6:14 AM
Gravatar Great hint! it's work fine with HtmlUnit and webClient, for who want to know how, this is my code.

final WebClient webClient = new WebClient(
BrowserVersion.INTERNET_EXPLORER_7_0);
XTrustProvider.install();
URL url = new URL("https://somesite.com");
htmlpage = webCliente.getPage(url);
Marcelo Daniel

11/15/2007 3:42 AM
Gravatar tanks guys works fine for me :) thumbs up
bandur

5/27/2008 8:10 AM
Gravatar I was searching for a solution to use with Commons HttpClient. Forget about EasySSLProtocolSocketFactory! XTrustProvider IS the way to go!

Many thanks!
Filipe Mateus
 Leave Feedback
Title  
Name  
Email
Url
Comments   
Please add 4 and 6 and type the answer here: