Ignore self-signed ssl cert using Jersey Client

Ignore self-signed ssl cert using Jersey Client

I'm using the Jersey Client library to run tests against a rest service running on jboss. I have https set up fine on the server (running on localhost), using a self signed cert.

However whenever I run my tests with the https url I get the following error:

com.sun.jersey.api.client.ClientHandlerException: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target      at com.sun.jersey.client.urlconnection.URLConnectionClientHandler.handle(URLConnectionClientHandler.java:131)      at com.sun.jersey.api.client.Client.handle(Client.java:629)      at com.sun.jersey.oauth.client.OAuthClientFilter.handle(OAuthClientFilter.java:137)      at com.sun.jersey.api.client.WebResource.handle(WebResource.java:601)      at com.sun.jersey.api.client.WebResource.access$200(WebResource.java:74)      at com.sun.jersey.api.client.WebResource$Builder.get(WebResource.java:459)      at test.helper.Helper.sendSignedRequest(Helper.java:174)      ... And so on  

I know this is because my self signed cert is not in the java keystore. Is there any way I can make the Client not check the validity of the ssl cert and just use it regardless?

This code will only ever be run against test servers so I don't want to go to the hassle of adding new trusted certs each time we set up a new test server.

Here's the code which is making the call:

OAuthParameters params = new OAuthParameters();    // baseline OAuth parameters for access to resource  params.signatureMethod(props.getProperty("signature_method"));  params.consumerKey(props.getProperty("consumer_key"));  params.setToken(props.getProperty("token"));  params.setVersion("1.0");  params.nonce();    // OAuth secrets to access resource  OAuthSecrets secrets = new OAuthSecrets();  secrets.consumerSecret(props.getProperty("consumer_secret"));  secrets.setTokenSecret(props.getProperty("token_secret"));    // Jersey client to make REST calls to token services  Client client = Client.create();    // OAuth test server resource  WebResource resource = client.resource(props.getProperty("url"));    // if parameters and secrets remain static, filter cab be added to each web resource  OAuthClientFilter filter = new OAuthClientFilter(client.getProviders(), params, secrets);    // filter added at the web resource level  resource.addFilter(filter);  WebResource.Builder wbr = resource.getRequestBuilder().accept(props.getProperty("accept"));    return wbr.get(ClientResponse.class);  

Any help would be greatly appreciated.

Answer by Chris Salij for Ignore self-signed ssl cert using Jersey Client

After some searching and trawling through some old stackoverflow questions I've found a solution in a previously asked SO question:

• Question: Java client certificates over HTTPS/SSL
• Answer Java client certificates over HTTPS/SSL

Here's the code that I ended up using.

// Create a trust manager that does not validate certificate chains  TrustManager[] trustAllCerts = new TrustManager[]{new X509TrustManager(){      public X509Certificate[] getAcceptedIssuers(){return null;}      public void checkClientTrusted(X509Certificate[] certs, String authType){}      public void checkServerTrusted(X509Certificate[] certs, String authType){}  }};    // Install the all-trusting trust manager  try {      SSLContext sc = SSLContext.getInstance("TLS");      sc.init(null, trustAllCerts, new SecureRandom());      HttpsURLConnection.setDefaultSSLSocketFactory(sc.getSocketFactory());  } catch (Exception e) {      ;  }  

Answer by Ransom Briggs for Ignore self-signed ssl cert using Jersey Client

I had the same problem adn did not want this to be set globally, so I used the same TrustManager and SSLContext code as above, I just changed the Client to be created with special properties

 ClientConfig config = new DefaultClientConfig();   config.getProperties().put(HTTPSProperties.PROPERTY_HTTPS_PROPERTIES, new HTTPSProperties(       new HostnameVerifier() {           @Override           public boolean verify( String s, SSLSession sslSession ) {               // whatever your matching policy states           }       }   ));   Client client = Client.create(config);  

Answer by Tapas for Ignore self-signed ssl cert using Jersey Client

worked for me with this code. May be its for Java 1.7

    TrustManager[] trustAllCerts = new TrustManager[]{new X509TrustManager() {            @Override          public X509Certificate[] getAcceptedIssuers() {              // TODO Auto-generated method stub              return null;          }            @Override          public void checkServerTrusted(X509Certificate[] arg0, String arg1)                  throws CertificateException {              // TODO Auto-generated method stub            }            @Override          public void checkClientTrusted(X509Certificate[] arg0, String arg1)                  throws CertificateException {              // TODO Auto-generated method stub            }      }};        // Install the all-trusting trust manager      try {          SSLContext sc = SSLContext.getInstance("TLS");          sc.init(null, trustAllCerts, new SecureRandom());          HttpsURLConnection.setDefaultSSLSocketFactory(sc.getSocketFactory());      } catch (Exception e) {          ;      }  

Answer by Bruno for Ignore self-signed ssl cert using Jersey Client

This code will only ever be run against test servers so I don't want to go to the hassle of adding new trusted certs each time we set up a new test server.

This is the kind of code that will eventually find its way in production (if not from you, someone else who's reading this question will copy and paste the insecure trust managers that have been suggested into their applications). It's just so easy to forget to remove this sort of code when you have a deadline, since it doesn't show up as a problem.

If you're worried about having to add new certificates every time you have a test server, create your own little CA, issue all the certificates for the test servers using that CA and import this CA certificate into your client trust store. (Even if you don't deal with things like online certificate revocation in a local environment, this is certainly better than using a trust manager that lets anything through.)

There are tools to help you do this, for example TinyCA or XCA.

Answer by Marcelo C. for Ignore self-signed ssl cert using Jersey Client

For Jervey 2.*:

Client client = ClientBuilder.newBuilder()                  .hostnameVerifier(new HostnameVerifier() {                      @Override                      public boolean verify(String hostname, SSLSession session) {                          return true;                      }                  }).build();  

-> https://jersey.java.net/documentation/latest/migration.html

Answer by Mukesh for Ignore self-signed ssl cert using Jersey Client

Since I am new to stackoverflow and have lesser reputation to comment on others' answers, I am putting the solution suggested by Chris Salij with some modification which worked for me.

            SSLContext ctx = null;              TrustManager[] trustAllCerts = new X509TrustManager[]{new X509TrustManager(){                  public X509Certificate[] getAcceptedIssuers(){return null;}                  public void checkClientTrusted(X509Certificate[] certs, String authType){}                  public void checkServerTrusted(X509Certificate[] certs, String authType){}              }};              try {                  ctx = SSLContext.getInstance("SSL");                  ctx.init(null, trustAllCerts, null);              } catch (NoSuchAlgorithmException | KeyManagementException e) {                  LOGGER.info("Error loading ssl context {}", e.getMessage());              }                SSLContext.setDefault(ctx);  

Answer by prakash krishnan for Ignore self-signed ssl cert using Jersey Client

Just adding the same code with the imports. Also contains the unimplemented code that is needed for compilation. I initially had trouble finding out what was imported for this code. Also adding the right package for the X509Certificate. Got this working with trial and error:

import javax.net.ssl.HttpsURLConnection;  import javax.net.ssl.SSLContext;  import javax.net.ssl.TrustManager;  import javax.net.ssl.X509TrustManager;  import javax.security.cert.CertificateException;  import javax.security.cert.X509Certificate;  import javax.ws.rs.core.MultivaluedMap;     TrustManager[] trustAllCerts = new TrustManager[] { new X509TrustManager() {         public java.security.cert.X509Certificate[] getAcceptedIssuers() {           java.security.cert.X509Certificate[] chck = null;           ;           return chck;       }         public void checkServerTrusted(X509Certificate[] arg0, String arg1)               throws CertificateException {           // TODO Auto-generated method stub         }         public void checkClientTrusted(X509Certificate[] arg0, String arg1)               throws CertificateException {         }         public void checkClientTrusted(               java.security.cert.X509Certificate[] arg0, String arg1)                       throws java.security.cert.CertificateException {           // TODO Auto-generated method stub         }         public void checkServerTrusted(               java.security.cert.X509Certificate[] arg0, String arg1)                       throws java.security.cert.CertificateException {           // TODO Auto-generated method stub         }   } };     // Install the all-trusting trust manager   try {       SSLContext sc = SSLContext.getInstance("TLS");       sc.init(null, trustAllCerts, new SecureRandom());       HttpsURLConnection       .setDefaultSSLSocketFactory(sc.getSocketFactory());   } catch (Exception e) {       ;   }  

Answer by eitan for Ignore self-signed ssl cert using Jersey Client

For Jersey 2.* (Tested on 2.7) and java 8:

 public static Client IgnoreSSLClient() throws Exception {      SSLContext sslcontext = SSLContext.getInstance("TLS");      sslcontext.init(null, new TrustManager[]{new X509TrustManager() {          public void checkClientTrusted(X509Certificate[] arg0, String arg1) throws CertificateException {}          public void checkServerTrusted(X509Certificate[] arg0, String arg1) throws CertificateException {}          public X509Certificate[] getAcceptedIssuers() { return new X509Certificate[0]; }        }}, new java.security.SecureRandom());      return ClientBuilder.newBuilder().sslContext(sslcontext).hostnameVerifier((s1, s2) -> true).build();  }  

Fatal error: Call to a member function getElementsByTagName() on a non-object in D:\XAMPP INSTALLASTION\xampp\htdocs\endunpratama9i\www-stackoverflow-info-proses.php on line 72