HttpClient and PostMethod - Https site

Hi All,

I am using org.apache.commons.httpclient.HttpClient and org.apache.commons.httpclient.methods.PostMethod to post a request to https site.

my requirement is i need to read the url from property file, add some sensitive information in the HttpHeader and post the request to the URL read from the property.

if I try to post to a https site, I keep getting "javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: No trusted certificate found"

when I tried setting some system propery as given below

System.setProperty("javax.net.ssl.trustStore",cert);

System.setProperty("javax.net.ssl.trustStoreType", "jks");

System.setProperty("javax.net.ssl.trustStorePassword", "changeit");

i got a different error saying " Keystore tampered or invalid password" and sometimes "java.net.SocketException: Default SSL context init failed: Invalid keystore format"

pls help.

Iam using weblogic server.

here is my code.

System.setProperty("javax.net.ssl.trustStore","C:/progra~1/Java/j2re1.4.2_12/lib/security/cacerts");

System.setProperty("javax.net.ssl.trustStoreType", "jks");

System.setProperty("javax.net.ssl.trustStorePassword", "changeit");

//setting the security details ends

String nextUrl="";

if(request.getParameter("goto") != null && ((String)request.getParameter("goto").trim()).length() > 0) {

nextUrl = (String)request.getParameter("goto").trim();

} else {

nextUrl = AccessMgrPropertyManager.getProperty("default.waldo.landing.url");

}

System.out.println("url " + nextUrl);

HttpClient client = new HttpClient();

PostMethod postMethod = new PostMethod(nextUrl);

postMethod.addRequestHeader("AM_MOBILE_NUMBER",paramUsrName);

postMethod.addRequestHeader("AM_USER_NAME",getAlias(paramUsrName));

postMethod.addRequestHeader("AM_ACCOUNT_NUMBER",paramAcctNum);

client.executeMethod(postMethod);

int code = postMethod.getStatusCode();

byte bytes[] = postMethod.getResponseBody();

response.getOutputStream().write(bytes);

[2162 byte] By [HttpClienta] at [2007-11-27 9:00:46]
# 1

System.setProperty("javax.net.ssl.trustStore","C:/progra~1/Java/j2re1.4.2_12/lib/security/cacerts");

System.setProperty("javax.net.ssl.trustStoreType", "jks");

System.setProperty("javax.net.ssl.trustStorePassword", "changeit");

Those are the defaults except possibly for the password, but you don't need to specify the password for a truststore anyway. Remove all this.

The real question is, is the server's certificate trusted by that truststore?

Either the server certificate or that of one of its signers needs to be in the truststore. At present none of them are.

ejpa at 2007-7-12 21:29:51 > top of Java-index,Security,Other Security APIs, Tools, and Issues...
# 2
Thanks for your response, can pls brief on how fix this issue. I am new to these kind of issues.
HttpClienta at 2007-7-12 21:29:51 > top of Java-index,Security,Other Security APIs, Tools, and Issues...