Geek Answers Handbook

Enable Java to allow expired certificate

Is there any command line flag to allow Java to allow expired certificates?

Now I am getting the following exception because the certificate has expired.

Caused by: java.security.cert.CertificateExpiredException: NotAfter: {PAST DATETIME}
at sun.security.x509.CertificateValidity.valid(CertificateValidity.java:274)
at sun.security.x509.X509CertImpl.checkValidity(X509CertImpl.java:629)
at sun.security.x509.X509CertImpl.checkValidity(X509CertImpl.java:602)
at org.apache.ws.security.validate.SignatureTrustValidator.validateCertificates(SignatureTrustValidator.java:103)

I tried the following command line flag that does not ignore certificate expiration check

-Dcom.sun.net.ssl.checkRevocation=false

Our application runs in tomcat along the way /myapplication. So I created another application /ignorecertificateand deployed to the same Webapp Tomcat folder. According to the accepted answer in question, I run the following code when the application starts /ignoreexpired.

// Create a trust manager that does not validate certificate chains
TrustManager[] trustAllCerts = new TrustManager[]{
    new X509TrustManager() {
        public java.security.cert.X509Certificate[] getAcceptedIssuers() {
            return null;
        }
        public void checkClientTrusted(
            java.security.cert.X509Certificate[] certs, String authType) {
        }
        public void checkServerTrusted(
            java.security.cert.X509Certificate[] certs, String authType) {
        }
    }
};

// Install the all-trusting trust manager
try {
    SSLContext sc = SSLContext.getInstance("SSL");
    sc.init(null, trustAllCerts, new java.security.SecureRandom());
    HttpsURLConnection.setDefaultSSLSocketFactory(sc.getSocketFactory());
} catch (Exception e) {
    e.printStackTrace();
}

tomcat, , /myapplication / (Bcoz java). . (/ignoreexpired) coz. - (/myapplication).

+4
1
-Dcom.sun.net.ssl.checkRevocation=false

( ) - . , .

tomcat, /myapplication, /

JVM. TrustManager /ignoreexpired .

, JVM. , TrustoreManager , . JKS keytool GUI KeyStore explorer, ( , ) tomcat

-Djavax.net.ssl.trustStore=/path/to/truststore
-Djavax.net.ssl.trustStorePassword=truststorepassword

JVM jre/lib/security/cacerts

+4

More articles:


All Articles