JRuby Net :: HTTP does not work with OpenSSL :: SSL :: SSLError: certificates do not comply with algorithm restrictions

Question

Jruby jruby-1.7.0.preview1 JDK: Java (TM) SE runtime (build 1.7.0_05-b05)

I get data from a REST web service via HTTPS, and the other day everything was fine.

Over the weekend, I upgraded to Ubuntu 12.04 (from 11.10), and now it fails. I can only assume that something has changed in my JVM during this time. I thought I used to be in Java 7, so I'm very confused.

In any case, the code that crashes is located in Net :: HTTP.start :

require "net/http" Net::HTTP.start(uri.host, :use_ssl => true, :ca_path => "/etc/ssl/certs") do |http| #... end 

And the error:

 OpenSSL::SSL::SSLError: Certificates does not conform to algorithm constraints from org/jruby/ext/openssl/SSLSocket.java:180:in `connect' from /opt/jruby/active/lib/ruby/1.9/net/http.rb:799:in `connect' from org/jruby/ext/timeout/Timeout.java:103:in `timeout' from /opt/jruby/active/lib/ruby/1.9/net/http.rb:799:in `connect' from /opt/jruby/active/lib/ruby/1.9/net/http.rb:755:in `do_start' from /opt/jruby/active/lib/ruby/1.9/net/http.rb:744:in `start' from /opt/jruby/active/lib/ruby/1.9/net/http.rb:557:in `start' 

Any help would be appreciated.

EDIT:

I just tested this on Java 6 and it worked fine.

I am wondering if this relates to: https://forums.oracle.com/forums/thread.jspa?threadID=2405379

Answer 1

Found solution described here: http://sim.ivi.co/2011/07/java-se-7-release-security-enhancements.html

Short version: Go to java_home / jre / lib / security / java.security And change

 jdk.certpath.disabledAlgorithms=MD2 

to

 jdk.certpath.disabledAlgorithms= 

However, remember that this again allows MD2 hashing, which turned out to be unsafe.

See: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-2409