How can I disable SSL verification?

Question

I try to access the REST API, but I get the following exception (Complete StackTrace at the end):

"javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target" 

I asked the API provider about this problem and said that something was wrong with the SSL library you are using.

How would you solve this problem? Using the same code (below) I made calls to the NIMBLE REST API without problems, but in this case it does not work. Then I do not have a cert file (.cer).

I need to disable SSL verification because security methods are the API key that I already have.

Any suggestions?

Many thanks!

==== Console: ====

 POST https://api.nexalogy.com/project/create?api_key=XXXXXXXXXXXXXXXXXXXX HTTP Header:"Content-Type" "application/json" HTTP Body:[{"name":"project1","lang":"en","type":"twitter"}] api_key:XXXXXXXXXXXXXXXXXXXX javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target 

I also tried the following form, and the exception is the same:

 POST https://api.nexalogy.com/project/create HTTP Header:"Content-Type" "application/json" HTTP Header:"api_key" "XXXXXXXXXXXXXXXXXXXX" HTTP Body:[{"name":"project1","lang":"en","type":"twitter"}] api_key:XXXXXXXXXXXXXXXXXXXX javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target 

==== Code: ====

 package servlet; import java.io.BufferedReader; import java.io.DataOutputStream; import java.io.IOException; import java.io.InputStream; import java.io.InputStreamReader; import java.net.HttpURLConnection; import java.net.URL; import javax.servlet.ServletException; import javax.servlet.annotation.WebServlet; import javax.servlet.http.HttpServlet; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletResponse; @WebServlet("/AddProject") public class AddProject extends HttpServlet { private static final long serialVersionUID = 1L; public AddProject() { } protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { } protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { String body="[{\"name\":\"project1\",\"lang\":\"en\",\"type\":\"twitter\"}]"; String api_key="XXXXXXXXXXXXXXXXXXXX"; String str_response=""; String line=""; URL url = new URL("https://api.nexalogy.com/project/create?api_key="+api_key); try{ HttpURLConnection connection = (HttpURLConnection)url.openConnection(); connection.setRequestMethod("POST"); connection.setRequestProperty("Content-Type","application/json"); System.out.println("POST https://api.nexalogy.com/project/create?api_key="+api_key); System.out.println("HTTP Header:"+"\"Content-Type\" \"application/json\""); System.out.println("HTTP Body:"+body); System.out.println("api_key:"+api_key); connection.setUseCaches(false); connection.setDoInput(true); connection.setDoOutput(true); DataOutputStream wr = new DataOutputStream(connection.getOutputStream()); wr.writeBytes(body); wr.flush(); wr.close(); InputStream is = connection.getInputStream(); InputStreamReader isr = new InputStreamReader(is); BufferedReader rd = new BufferedReader(isr); while ((line = rd.readLine()) != null) str_response+= line + '\r'; rd.close(); System.out.println("str_response:"+str_response); }catch(Exception e){ e.printStackTrace(System.out); //throw new RuntimeException(e); } } } 

==== Complete StackTrace: ====

 com.sun.jersey.api.client.ClientHandlerException: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target at com.sun.jersey.client.urlconnection.URLConnectionClientHandler.handle(URLConnectionClientHandler.java:131) at com.sun.jersey.api.client.Client.handle(Client.java:616) at com.sun.jersey.api.client.WebResource.handle(WebResource.java:559) at com.sun.jersey.api.client.WebResource.post(WebResource.java:230) at engine_brandchats.twitter_api_create_project_0_1.Twitter_api_create_project.tREST_2Process(Twitter_api_create_project.java:955) at engine_brandchats.twitter_api_create_project_0_1.Twitter_api_create_project.tJava_1Process(Twitter_api_create_project.java:635) at engine_brandchats.twitter_api_create_project_0_1.Twitter_api_create_project.runJobInTOS(Twitter_api_create_project.java:1641) at engine_brandchats.twitter_api_create_project_0_1.Twitter_api_create_project.main(Twitter_api_create_project.java:1494) Caused by: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target at com.sun.net.ssl.internal.ssl.Alerts.getSSLException(Unknown Source) at com.sun.net.ssl.internal.ssl.SSLSocketImpl.fatal(Unknown Source) at com.sun.net.ssl.internal.ssl.Handshaker.fatalSE(Unknown Source) at com.sun.net.ssl.internal.ssl.Handshaker.fatalSE(Unknown Source) at com.sun.net.ssl.internal.ssl.ClientHandshaker.serverCertificate(Unknown Source) at com.sun.net.ssl.internal.ssl.ClientHandshaker.processMessage(Unknown Source) at com.sun.net.ssl.internal.ssl.Handshaker.processLoop(Unknown Source) at com.sun.net.ssl.internal.ssl.Handshaker.process_record(Unknown Source) at com.sun.net.ssl.internal.ssl.SSLSocketImpl.readRecord(Unknown Source) at com.sun.net.ssl.internal.ssl.SSLSocketImpl.performInitialHandshake(Unknown Source) at com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(Unknown Source) at com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(Unknown Source) at sun.net.www.protocol.https.HttpsClient.afterConnect(Unknown Source) at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(Unknown Source) at sun.net.www.protocol.http.HttpURLConnection.getOutputStream(Unknown Source) at sun.net.www.protocol.https.HttpsURLConnectionImpl.getOutputStream(Unknown Source) at com.sun.jersey.client.urlconnection.URLConnectionClientHandler$1$1.getOutputStream(URLConnectionClientHandler.java:203) at com.sun.jersey.api.client.CommittingOutputStream.commitWrite(CommittingOutputStream.java:117) at com.sun.jersey.api.client.CommittingOutputStream.write(CommittingOutputStream.java:89) at sun.nio.cs.StreamEncoder.writeBytes(Unknown Source) at sun.nio.cs.StreamEncoder.implFlushBuffer(Unknown Source) at sun.nio.cs.StreamEncoder.implFlush(Unknown Source) at sun.nio.cs.StreamEncoder.flush(Unknown Source) at java.io.OutputStreamWriter.flush(Unknown Source) at java.io.BufferedWriter.flush(Unknown Source) at com.sun.jersey.core.util.ReaderWriter.writeToAsString(ReaderWriter.java:191) at com.sun.jersey.core.provider.AbstractMessageReaderWriterProvider.writeToAsString(AbstractMessageReaderWriterProvider.java:128) at com.sun.jersey.core.impl.provider.entity.StringProvider.writeTo(StringProvider.java:88) at com.sun.jersey.core.impl.provider.entity.StringProvider.writeTo(StringProvider.java:58) at com.sun.jersey.api.client.TerminatingClientHandler.writeRequestEntity(TerminatingClientHandler.java:305) at com.sun.jersey.client.urlconnection.URLConnectionClientHandler._invoke(URLConnectionClientHandler.java:182) at com.sun.jersey.client.urlconnection.URLConnectionClientHandler.handle(URLConnectionClientHandler.java:129) ... 7 more Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target at sun.security.validator.PKIXValidator.doBuild(Unknown Source) at sun.security.validator.PKIXValidator.engineValidate(Unknown Source) at sun.security.validator.Validator.validate(Unknown Source) at com.sun.net.ssl.internal.ssl.X509TrustManagerImpl.validate(Unknown Source) at com.sun.net.ssl.internal.ssl.X509TrustManagerImpl.checkServerTrusted(Unknown Source) at com.sun.net.ssl.internal.ssl.X509TrustManagerImpl.checkServerTrusted(Unknown Source) ... 35 more Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(Unknown Source) at java.security.cert.CertPathBuilder.build(Unknown Source) ... 41 more 

EDITED 2013-06-13 Solution: Implements X509TrustManager

Add the following code ...

 HttpsURLConnection connection = (HttpsURLConnection)url.openConnection(); connection.setRequestMethod("POST"); connection.setUseCaches(false); connection.setDoInput(true); connection.setDoOutput(true); if (connection instanceof HttpsURLConnection) { try { KeyManager[] km = null; TrustManager[] tm = {new RelaxedX509TrustManager()}; SSLContext sslContext = SSLContext.getInstance("SSL"); sslContext.init(null, tm, new java.security.SecureRandom()); SSLSocketFactory sf = sslContext.getSocketFactory(); ((HttpsURLConnection)connection).setSSLSocketFactory(sf); System.out.println("setSSLSocketFactory OK!"); }catch (java.security.GeneralSecurityException e) { System.out.println("GeneralSecurityException: "+e.getMessage()); } } 

... and add the following class (implements X509TrustManager)

 class RelaxedX509TrustManager implements X509TrustManager { public boolean isClientTrusted(java.security.cert.X509Certificate[] chain){ return true; } public boolean isServerTrusted(java.security.cert.X509Certificate[] chain){ return true; } public java.security.cert.X509Certificate[] getAcceptedIssuers() { return null; } public void checkClientTrusted(java.security.cert.X509Certificate[] chain, String input) {} public void checkServerTrusted(java.security.cert.X509Certificate[] chain, String input) {} } 

Answer 1

try it

 public void disableCertificates() { TrustManager[] trustAllCerts = new TrustManager[]{ new X509TrustManager() { @Override public java.security.cert.X509Certificate[] getAcceptedIssuers() { return null; } @Override public void checkClientTrusted( java.security.cert.X509Certificate[] certs, String authType) { } @Override public void checkServerTrusted( java.security.cert.X509Certificate[] certs, String authType) { } } }; // Install the all-trusting trust manager try { SSLContext sc = SSLContext.getInstance("SSL"); sc.init(null, trustAllCerts, new java.security.SecureRandom()); HttpsURLConnection.setDefaultSSLSocketFactory(sc.getSocketFactory()); } catch (Exception e) { } } 

Answer 2

I need to disable SSL checking because the KEY API security methods that I already have.

It is not clear how you think that the API key (and its security aspect) has anything to do with the security provided by SSL / TLS: they, of course, do not affect the same security aspects. SSL / TLS protects data transmission from eavesdropping and modification.

If you are checking the server that you are trying to contact this SSL testing service with, you will find that the server needs a client that supports the server name (SNI): this allows the server to host multiple hosts with different certificates.

If your client does not support SNI (Java only supports it on the client side since version 7), requests will be presented with a different certificate than one indent: it may not perform certificate verification or the host name of the verification procedure. Disabling or checking makes the connection vulnerable to Man-In-The-Middle attacks.

• I would say that the most likely cause of the problem you are experiencing is that you are using a version of Java that does not support SNI (e.g. Java 6).

• It is also possible that the JRE you are using does not have this particular CA in its default trust store. You can try to obtain a list of CA certificates that you want to trust from another source (for example, the Mozilla package, as is often recommended using cURL). You may need to understand which CA certificates are the first.

  As the JSSE Reference Guide says :

  IMPORTANT NOTE: The JDK comes with a limited number of trusted root certificates in the / lib / security / cacerts file. As documented in keytool, you are responsible for maintaining (i.e. adding / removing) the certificates contained in this file if you use this file as a trusted repository.

  Depending on the certificate configuration of the servers you are communicating with, you may need to add additional root certificates. Get what you need from the appropriate supplier.

In any case: disabling SSL verification is not the solution to your problem.

EDIT:

It looks like the service you are trying to use has a certificate issued by StartSSL, which is not one of the CAs that come with Oracle JRE by default.

You need to download it from StartSSL (or export it from a trusted package that you already have, it is called "StartCom ...") and import it into your cacerts store using keytool (or another trust store if you use another one) :

 keytool -import -keystore /path/to/jre/lib/security/cacerts -alias startssl -file startssl.crt 

(Of course, adapt the path and name of the startssl certificate file if necessary).

Answer 3

Please use a certificate with a complete certificate chain. This means that at least a root certificate is required.

You only imported the final certificate of your colleague, and the implementation cannot verify the certificate chain. At least a root certificate is required.