SSL connection from Java

Question

I am trying to make a test SSL connection using the following Java code:

String httpsURL = "https://www.somehost.com";
URL myurl = new URL(httpsURL);
HttpsURLConnection con = (HttpsURLConnection)myurl.openConnection();

InputStream ins = con.getInputStream();
InputStreamReader isr=new InputStreamReader(ins);
BufferedReader in =new BufferedReader(isr);

String inputLine;

while ((inputLine = in.readLine()) != null)
    System.out.println(inputLine);

in.close();

When I connect to Host A everything works fine - the connection is made and the response is received.

However when I connect to Host B, which is secured by a certificate that is issued by the same authority as Host A's, I receive the following exception:

sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

Everything that I have read so far suggests that I need to install the certificates in my keystore, however if that were the solution then why does Host A work whilst Host B doesn't?

As a probably unhelpful aside - if I write a similar piece of C# code then the connection is successfully negotiated for both Hosts A and B - the same applies for navigating to the URL in the browser.

ZZ Coder · Accepted Answer · 2010-05-03 19:40:01Z

2

Most likely causes are,

The Host B uses a self-signed certificate.
The certificate is signed by CA which is not in your trust store.
The cert is signed with an intermediate cert but Host B is misconfigured so it doesn't send the server cert with intermediate cert.

For #1, #2, you need to import the cert or the CA cert into your trust store.

For #3, tell host B to send the intermediate cert.

answered May 3, 2010 at 19:40

ZZ Coder

75.7k30 gold badges139 silver badges169 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

nos Over a year ago

Note that for #1 & #2, you can also skip the validation, as described at exampledepot.com/egs/javax.net.ssl/trustall.html , though think about what you're doing before doing that.

Simon Goodyear Over a year ago

Host B's cert is signed with the same intermediate cert as Host A. So, option #3 is the most likely possibility. I don't have immediate access to Host B - is there anyway that I could prove this was the case in the meantime? I tried removing the intermediate cert from my browser's certificate store and then browsing to the url. The certificate is presented as valid and the intermediate cert appears in the certificate store again. Does this prove that the intermediate cert is sent from the server, or would/could the browser request it separately for elsewhere?

Victor Basurto · Accepted Answer · 2013-05-20 20:52:28Z

-1

This probably is because you dont have a valid path for the certificate or maybe because you dont have a CA certificate of verising o some company like that.

answered May 20, 2013 at 20:52

Victor Basurto

11 bronze badge

1 Comment

user207421 Over a year ago

The first item merely restates what the error message says; the rest is just guesswork. -1

Collectives™ on Stack Overflow

SSL connection from Java

2 Answers 2

2 Comments

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

2 Comments

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related