使用jdk 1.6时SSLHandshake异常

Question

I am trying to connect to a REST webservice using HTTPClient / URLConnection. Its a simple code that works fine in jdk 1.7 but throws a SSLHandshake Exception while using jdk1.6

    IO Exception:  javax.net.ssl.SSLHandshakeException: java.security.cert.CertificateException: No subject alternative DNS name matching your.domain.name.com found.
...

    Caused by: java.security.cert.CertificateException: No subject alternative DNS name matching your.domain.name.com found.

Also, the code is very basic

URL url = new URL("https://your.domain.name.com/services/");
HttpsURLConnection   urlConnection = (HttpsURLConnection) url.openConnection();
urlConnection.setRequestProperty("Authorization", "Basic " + encodedCredenials);
urlConnection.setRequestProperty("Content-Type", "application/vnd.mtdomain.gold+json");
InputStream is = urlConnection.getInputStream();

Is this a known issue between jdk 1.6 and 1.7 ? How can we get this fixed ? I am not much fluent with SSL related issues.

Answer 1

This issue might be happened due to the below reasons (wrong url, corruped certificate or not valid certificate).

To install the certifcate please use the below syntax.

Default Keystore Installing Certificate to the Default Keystore (JDK cacerts) 1. Export the certificate from the server (.cer) 2. Open command prompt and go to JAVA_HOME/jre/lib/security 3. Execute the following command

Windows

keytool -import -v -alias -keystore cacerts -file \\.cer

Password: changeit

Unix

/bin/keytool -import -v -alias -keystore cacerts -file \\.cer

Password: changeit

4. Select option 'yes' and press enter

Custom Keystore Installing Certificate to the Custom Keystore 1. Export the certificate from the server (.cer) 2. Open command prompt and go the location where you want to create your custom keystore 3. Execute the following command Windows keytool -import -v -trustcacerts -alias -file \\.cer -keystore .jks -keypass changeit Password: changeit

Unix /bin/ keytool -import -v -trustcacerts -alias -file \\.cer -keystore .jks -keypass changeit Password: changeit

4. Select option 'yes' and press enter

Add the following System variables when invoking Custom Keystore

-Dweblogic.security.SSL.ignoreHostnameVerification=true -Dweblogic.security.TrustKeyStore=CustomTrust -
Dweblogic.security.CustomTrustKeyStoreFileName=<location>/<keystore-name>.jks -Djavax.net.ssl.trustStore=<location>/<keystore-name>.jks -Djavax.net.ssl.trustStorePassword=changeit