Apache HttpClient SelfSigned certificates - ssl

Question

A self signed certificate is one that is not signed by a Certificate Authority(CA). JAVA stores the certificates of most of the CA (here jre/lib/security/cacerts) and so if you want to connect to an https site with certificate signed by a CA there is no special code for it. (the same code for http call would work)
So basically
CloseableHttpClient httpclient = HttpClients.createDefault();
HttpGet httpGet = new HttpGet(https_url);
httpclient.execute(httpGet)
But if we have a self signed certificate then we would need to configure the client and make it work. Otherwise we would see
sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
javax.net.ssl.SSLPeerUnverifiedException: Host name 'localhost' does not match the certificate subject provided by the peer ...
How to configure http client for this case?

Answer 1

httpclient 4.x
Approach 1
Configure the TrustStrore through debug options
-Djavax.net.ssl.trustStore=/Users/amodpandey/.keystore
Java is able to read the truststore even without passing the password (password of the truststore)
But even after this you might face
javax.net.ssl.SSLPeerUnverifiedException: Host name 'localhost' does not match the certificate subject provided by the peer ...
CloseableHttpClient httpClient =
HttpClientBuilder.create()
.setSSLHostnameVerifier(new HostnameVerifier() {
#Override
public boolean verify(String arg0, SSLSession arg1) {
return true;
}
})
.build();
And it works..
Approach 2
Put it all in the code
CloseableHttpClient httpClient =
HttpClientBuilder.create()
.setSslcontext(SSLContexts.custom().loadTrustMaterial(new File(Thread.currentThread().getContextClassLoader().getResource("keystore").getFile())).build())
.setSSLHostnameVerifier(new HostnameVerifier() {
#Override
public boolean verify(String arg0, SSLSession arg1) {
return true;
}
})
.build();
Approach 3
While using a connection manager
The setSslcontext and setSSLHostnameVerifier are ignore when using
.setConnectionManager(connectionManager)
So connection manager should be configured
Files.copy(ClassLoader.getSystemResourceAsStream("keystore"), Paths.get(URI.create("file:/tmp/keystore")),
StandardCopyOption.REPLACE_EXISTING);
Registry<ConnectionSocketFactory> socketFactoryRegistry =
RegistryBuilder
.<ConnectionSocketFactory>create()
.register(
"https",
new SSLConnectionSocketFactory(SSLContextBuilder.create()
.loadTrustMaterial(new File("/tmp/keystore")).build(),
new HostnameVerifier() {
#Override
public boolean verify(String hostname, SSLSession session) {
return true;
}
})).register("http", PlainConnectionSocketFactory.INSTANCE).build();
PoolingHttpClientConnectionManager connectionManager =
new PoolingHttpClientConnectionManager(socketFactoryRegistry);
CloseableHttpClient httpClient =
HttpClientBuilder.create()
.setConnectionManager(connectionManager)
.build();
Note
-Djavax.net.debug=all debug option is very helpful to see the certificates being used
The SSLContext uses File and if we plan to package the certificate with the code in a Jar then we would need to create a file to pass it to the File object (it does not for files inside the jar)
Files.copy(ClassLoader.getSystemResourceAsStream("keystore"),Paths.get(URI.create("file:/tmp/utskeystore")),StandardCopyOption.REPLACE_EXISTING)