My test Tomcat 6 server has a self signed certificate. The manager webapp is accessible only via SSL, with this self signe certificate. When I try to deploy with the cargo-maven2-plugin, I get the error :
sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
I could probably add the certificate to the default Java keystore, but I would like to keep deployment as portable as possible and not require that everybody who needs to deploy the app to install the certificate. I would like to deploy the app by just having a checkout of the project, configuring the password to the app server and running Maven.
I could not find in the cargo documentation a way to ignore invalid certificates.
Can you point me in the right direction ?
I'm fairly ignorant on cargo specifically, but I've used this code to allow bad certs without errors in Java before, and it should work for you. Note that it's super insecure, but then again if you want to ignore invalid certs then pretty much any implementation is going to be super insecure.
http://ctasada.blogspot.com/2010/11/httpclient-use-self-signed-certificates.html
Related
I still can't install any plugin for eclipse because of a ValidatorException
Unable to read repository at http://www.pydev.org/updates/content.xml.
sun.security.validator.ValidationException: PKIX path building failed:
sun.security.provider.certpath.SunCertPathBuilderException: unable to
find valid certification path to requested target
What should I do in that case?
I think this is a common certificate issue, which can happen because of multiple reasons. I'll list the 2 most likely to be the case here:
The URL mentioned in the error does a redirect from HTTP to HTTPS, which java does not seem to like.
I'm not sure if this is still an issue in recent Java versions, could not find a better reference but they mention it here: https://github.com/protegeproject/protege/issues/17
Please try to change the update-site URL from http://www.pydev.org/updates/ to what it redirects to (which currently is: https://dl.bintray.com/fabioz/pydev/5.3.1/)
The certificate could not be validated because the certificate issuers root certificate is not in your keystore. Make sure you have the most recent version of java installed (each new version contains a new keystore). You can also add the issuers root certificate (or the certificate of the site) into your keystore using the keytool.
Running Eclipse 3.6 and trying to get version 3.2.4 of the GWT plugin. I add the source and it results in the following:
Unable to read repository at https://commondatastorage.googleapis.com/eclipse_toolreleases/products/gpe/release/3.2.4/3.6/content.xml.
Unable to read repository at https://commondatastorage.googleapis.com/eclipse_toolreleases/products/gpe/release/3.2.4/3.6/content.xml.
com.ibm.jsse2.util.j: PKIX path building failed: java.security.cert.CertPathBuilderException: PKIXCertPathBuilderImpl could not build a valid CertPath.; internal cause is:
java.security.cert.CertPathValidatorException: The certificate issued by OU=Equifax Secure Certificate Authority, O=Equifax, C=US is not trusted; internal cause is:
java.security.cert.CertPathValidatorException: Certificate chaining error
I have the correct path, my local time on my machine is accurate/correct (I had read some about some odd timestamp issues with certs?), and I can't seem to find any information about this. I tried installing locally, and there are missing dependencies when I use a local archive. I am curious though, why is it trying to hit content.xml? There is no such file in the downloadable repo, and when I try to hit that URI, I get the following:
<Error><Code>NoSuchKey</Code><Message>The specified key does not exist.</Message></Error>
It's because the repository does not have a valid, i.e. trusted, certificate according to our SSL. You need to manually add the certificate as trusted, and then install the plugin.
We have a java webstart application which is hosted a web server. The signer of the SSL certificate in the web server is not in the cacerts of the JRE, by default. Thus when we run
javaws https://blablah/our.jnlp
we get a Security Warning dialog saying the connection the website is untrusted. Is it possible to pass a custom truststore that contains the singer certificate to the javaws process? to avoid the warning?
I was hoping following would work
javaws -J-Djavax.net.ssl.trustStore=<path_to_custom_trusstore> https://blablah/our.jnlp
where custom_trusstore contains the signer certificate.
This does not seem to work. Warning still shows.
I know alternatively we can add the signer certificate from the Java Control Panel, but is there any other way?
have you tried to add the password?
-Djavax.net.ssl.trustStorePassword=storePassword
How can I detect certificate errors when attempting to access web content hosted on a HTTPS site with a certificate that would generate browser certificate errors or warnings?
It seems that currently the framework does not even send the HTTP request if the communication channel is not secure (i.e. if SSL is not enforced properly [e.g the validation of the certificate’s chain of trust fails])?
Similarly, what would be the best way to enforce certificate pinning?
Cheers
You can write your own PhoneGap Plugin based on the following SO question:
How to pin the Public key of a certificate on iOS
Here's some background on Pinning from the OWASP:
Pinning Cheat Sheet
If you end up writing the plugin, let me know as I'm interested too.
check out this post, which includes a PhoneGap (Build) plugin for certificate pinning, by comparing the server certificate fingerprint with an expected value: http://www.x-services.nl/certificate-pinning-plugin-for-phonegap-to-prevent-man-in-the-middle-attacks/734
I have installed the Eclipse Java EE Developers Helios SR2 IDE. The only additional plugins, installed from the Eclipse marketplace, are WebSphere Application Server 8.0 Developer Tools (8.0.4) and JGit/EGit.
I could attach to github fine until I follow the steps on the IBM site to update the eclipse.ini file to use the IBM-provided JRE that comes with WAS8.
Once I changed Eclipse to use the IBM JRE, I could not connect to github. When I tried to clone a repository, for instance, I got the error here:
my/url/to.git: cannot open git-upload-pack
java.lang.ClassNotFoundException: Cannot find the specified class com.ibm.websphere.ssl.protocol.SSLSocketFactory
I updated the configuration file as documented here:
http://publib.boulder.ibm.com/infocenter/radhelp/v7r5/index.jsp?topic=%2Fcom.ibm.ws.ast.st.v6.ui.doc%2Ftopics%2Frssl_isUseIBMSSLSocketFactory.html
After I make the change, it still doesn't work. I get this error:
my/url/to.git: cannot open git-upload-pack
com.ibm.jsse2.util.g: PKIX path building failed: java.security.cert.CertPathBuilderException: PKIXCertPathBuilderImpl could not build a valid CertPath.; internal cause is:
java.security.cert.CertPathValidatorException: The certificate issued by CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US is not trusted; internal cause is:
java.security.cert.CertPathValidatorException: Certificate chaining error
(Firstly, I'm not sure why you want to run Eclipse on the IBM JRE. If you need the IBM JRE for specific projects (or even by default) as the running environment, you could add it and set it in the Workspace (or Project) properties.)
This error is happening because the IBM JRE doesn't trust this certificate (CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US) out of the box.
Both the Oracle and the IBM JRE come with a default set of trusted CA certificates.
In Oracle Java, they're located in "jssecacerts, if it exists. Otherwise, cacerts". The documentation also says:
IMPORTANT NOTE: The JDK ships with a limited number of trusted root
certificates in the /lib/security/cacerts file. As
documented in keytool, it is your responsibility to maintain (that is,
add/remove) the certificates contained in this file if you use this
file as a truststore.
Depending on the certificate configuration of the servers you contact,
you may need to add additional root certificate(s). Obtain the needed
specific root certificate(s) from the appropriate vendor.
This may be in a different place for the IBM JRE, but ultimately, this piece of advice also applies: it's ultimately up to you to make sure you have the CA certificates you want to trust. You could export them from your browser, for example.