SSL: make Java check the whole trust chain -

-

say i'm communicating client via https certificate chain:

acme root   |   +--- acme intermediate          |          +--- server cert

i've created trust store i've imported acme intermediate certificate using

keytool -import -alias intermediate-ca -file acme_intermediate.der -keystore /path/to/intermediate-cacerts

and started vm ...

java -djavax.net.ssl.truststorepassword=changeit -djavax.net.ssl.truststore=/path/to/intermediate-cacerts ...

when connecting server, connection made. i've expected javax.net.ssl.sslhandshakeexception unable find valid certification path requested target or similar because acme root certificate not stored in intermediate-ca.

to sure, i've checked if jvm examined default system truststore straceing jvm did not:

$ strace -tt -f -etrace=open java -djavax.net.ssl.truststorepassword=changeit -djavax.net.ssl.truststore=/path/to/intermediate-cacerts program 2>&1 | grep -ve 'open\((.*\.(so|jar)|"/(proc|dev|etc/host|tmp|sys))'  22:31:21.103201 open("/usr/lib/jvm/java-1.7.0-oracle-1.7.0.51.x86_64/jre/lib/amd64/jvm.cfg", o_rdonly) = 3 [pid 27619] 22:31:21.119299 open("/usr/lib/jvm/java-1.7.0-oracle-1.7.0.51.x86_64/jre/lib/endorsed", o_rdonly|o_nonblock|o_directory|o_cloexec) = 3 [pid 27619] 22:31:21.125422 open("/etc/nsswitch.conf", o_rdonly) = 3 [pid 27619] 22:31:21.127423 open("/etc/passwd", o_rdonly|o_cloexec) = 3 [pid 27619] 22:31:21.141141 open("/usr/lib/jvm/java-1.7.0-oracle-1.7.0.51.x86_64/jre/lib/meta-index", o_rdonly) = 3 [pid 27619] 22:31:21.540826 open("/usr/lib/locale/locale-archive", o_rdonly) = 4 [pid 27619] 22:31:21.541576 open("/etc/passwd", o_rdonly|o_cloexec) = 4 [pid 27619] 22:31:21.542221 open("/etc/localtime", o_rdonly) = 4 [pid 27619] 22:31:22.267438 open("/usr/lib/jvm/java-1.7.0-oracle-1.7.0.51.x86_64/jre/lib/ext/meta-index", o_rdonly) = 4 [pid 27619] 22:31:22.318007 open("/usr/lib/jvm/java-1.7.0-oracle-1.7.0.51.x86_64/jre/lib/ext", o_rdonly|o_nonblock|o_directory|o_cloexec) = 4 [pid 27619] 22:31:22.462944 open("/usr/java/packages/lib/ext", o_rdonly|o_nonblock|o_directory|o_cloexec) = -1 enoent (no such file or directory) [pid 27619] 22:31:22.604155 open("/home/me/program.class", o_rdonly) = 4 [pid 27619] 22:31:22.728273 open("/usr/lib/jvm/java-1.7.0-oracle-1.7.0.51.x86_64/jre/lib/security/java.security", o_rdonly) = 4 [pid 27619] 22:31:24.048924 open("/usr/share/jbossas/standalone/data/intermediate-cacerts", o_rdonly) = 9 [pid 27619] 22:31:24.462164 open("/usr/lib/jvm/java-1.7.0-oracle-1.7.0.51.x86_64/jre/lib/meta-index", o_rdonly) = 10 [pid 27619] 22:31:24.626192 open("/etc/resolv.conf", o_rdonly) = 11 [pid 27619] 22:31:25.523615 open("/usr/lib/jvm/java-1.7.0-oracle-1.7.0.51.x86_64/jre/lib/net.properties", o_rdonly) = 12 [pid 27619] 22:31:26.168961 --- sigsegv (segmentation fault) @ 0 (0) --- connected

when omitting -djavax.net.ssl options observe open() of system truststore:

[pid 27212] 10:54:53.699479 open("/usr/lib/jvm/java-1.7.0-oracle-1.7.0.51.x86_64/jre/lib/security/cacerts", o_rdonly) = 9

the connection created using code fragment:

sslsocketfactory sslsocketfactory = (sslsocketfactory) sslsocketfactory.getdefault(); sslsocket sslsocket = (sslsocket) sslsocketfactory.createsocket(hostname, port);

this , serveral resources on internet there's no way make java lookup certificates in multiple truststores. 1 need clone system truststore , import needed certificates. sounds plausible me.

  • are there configuration options make java check whole trust chain?
  • if not, should implement manually check trust chain?


Comments

Post a Comment

Popular posts from this blog

python - pip install -U PySide error -

-
does know how avoid following error when running pip install -u pyside per official website instructions here: https://pypi.python.org/pypi/pyside/#installing-pyside-on-a-mac-os-x-system note have done brew install qt successfully. you using pip version 7.0.3, version 7.1.2 available. should consider upgrading via 'pip install --upgrade pip' command. collecting pyside using cached pyside-1.2.4.tar.gz installing collected packages: pyside running setup.py install pyside complete output command /applications/anaconda/bin/python -c "import setuptools, tokenize;__file__='/private/var/folders/dy/ttgqhqqx3g9bsbsnqnxsk2z80000gq/t/pip-build-cpxemt/pyside/setup.py';exec(compile(getattr(tokenize, 'open', open)(__file__).read().replace('\r\n', '\n'), __file__, 'exec'))" install --record /var/folders/dy/ttgqhqqx3g9bsbsnqnxsk2z80000gq/t/pip-0r7hri-record/install-record.txt --single-version-externally-managed --compile: ...
Read more

arrays - C++ error: a brace-enclosed initializer is not allowed here before ‘{’ token -

-
simple question: i'm trying initialize array within c++ class declaration: using namespace std; #include <string> class myclass{ public: string myarray[] = {"a","b","c"}; }; and i'm getting error: error: brace-enclosed initializer not allowed here before ‘{’ token no, without complied c++11 compiler, cannot initialize member array in declaration. have initialize array member in constructor. , don't use open array if know number of elements initialize array.
Read more

cytoscape.js - How to add nodes to Dagre layout with Cytoscape -

-
i trying add nodes dagre graph through cityscape.js. problem nodes not painted. code have: cy.add({ group: "nodes", data: { id:"n0",name:"n0",weight: 75 }, }); $.ajax(url).done(function(jsontree){ var newnodes=[]; for(var i=1;i<6;i++){ //var child = jsontree.result[i]; newnodes.push( { group: "nodes", data: { id: "n"+i, name:"n"+i}}, { group: "edges", data: { id: "e"+i, source: "n0", target: "n"+i } } ); } cy.add(newnodes); any ideas? have used loaded function reload graph not work. not know if have use specific function reload graph. thank in advance. you need add positions new nodes. cytoscape.js docs : it important note positions of newly added nodes must defined when calling cy.add(). nodes can not placed in graph without valid position — otherwise not displayed. yo...
Read more