Https Class for Encryption Message...One question on this

Question

(1)I have written a java code that connects to an https server.
Do I always need to have a client certificate in my code for the browser
to recognize the Server Certificate? like the example I have written below?(the try-catch block..)
Is it possible to write a normal class that makes an https connection without
having to use the try-catch block defined in the code?
Assuming that the Server has a valid certificate,what needs to be done
in my code so that I can get rid of the try-catch block and just make a normal
https connection to transfer data securely.
(2)Also,how do we install a certifcate in a browser? Why do we do this?
Please an urgent response will be much appreciated to question 1.
ajay
[email protected]
Code attached
package Encryption;
import java.io.*;
import java.util.*;
import java.security.*;
import javax.net.*;
import javax.net.ssl.*;
import com.sun.net.ssl.*;
import java.net.*;
public class Encrypt
public String sMess;
public static void ec(String sMess)
try {
System.setProperty("java.protocol.handler.pkgs","com.sun.net.ssl.internal.www.protocol");
Security.addProvider(new com.sun.net.ssl.internal.ssl.Provider());
URL url;
String uri="https://myserver.com/<java.class>";
url = new URL(uri);
HttpsURLConnection hpCon=null;
try {
KeyManager[] km = null;
TrustManager[] tm = {new RelaxedX509TrustManager()};
SSLContext sslContext = SSLContext.getInstance("SSL");
sslContext.init(null, tm, new java.security.SecureRandom());
SSLSocketFactory sslSF = sslContext.getSocketFactory();
hpCon = (HttpsURLConnection)url.openConnection();
hpCon.setSSLSocketFactory(sslSF);
}catch(Exception e){}
hpCon.setDoOutput(true);
hpCon.setDoInput(true);
OutputStream output = hpCon.getOutputStream();
output.write(sMess.getBytes());
output.flush();
output.close();
//Response from the Receiving Servlet.
System.out.println("Received response from the Server.....");
int i;
InputStreamReader input = new InputStreamReader(hpCon.getInputStream());
while((i = input.read())!=-1)
System.out.println((char)i);
}catch(IOException e)
System.out.println("Error in Client " + e);
} // End of Method Encrypt.
static class RelaxedX509TrustManager implements X509TrustManager
public boolean checkClientTrusted(java.security.cert.X509Certificate[] chain)
return true;
public boolean isServerTrusted(java.security.cert.X509Certificate[] chain){
return true;
public boolean isClientTrusted(java.security.cert.X509Certificate[] chain){
return true;
public java.security.cert.X509Certificate[] getAcceptedIssuers() {
return null;
public void checkClientTrusted(java.security.cert.X509Certificate[] chain, String authType) {}
public void checkServerTrusted(java.security.cert.X509Certificate[] chain, String authType) {}
} // End of Class Encryption
Now to get rid of the try-catch block can I say the attached to send a secured message without the
try catch block....Is it necessary to have the try-catch
block if the Server has a valid Certificate
import java.io.*;
import java.util.*;
import java.security.*;
import javax.net.*;
import javax.net.ssl.*;
import com.sun.net.ssl.*;
import java.net.*;
public class Encrypt
public String sMess;
public static void ec(String sMess)
try {
System.setProperty("java.protocol.handler.pkgs","com.sun.net.ssl.internal.www.protocol");
Security.addProvider(new com.sun.net.ssl.internal.ssl.Provider());
URL url;
String uri="https://myserver.com/<java.class>";
url = new URL(uri);
HttpsURLConnection hpCon=null;
hpCon = (HttpsURLConnection)url.openConnection();
hpCon.setDoOutput(true);
hpCon.setDoInput(true);
OutputStream output = hpCon.getOutputStream();
output.write(sMess.getBytes());
output.flush();
output.close();
int i;
InputStreamReader input = new InputStreamReader(hpCon.getInputStream());
while((i = input.read())!=-1)
System.out.println((char)i);
}catch(IOException e)
System.out.println("Error in Client " + e);
} // End of Method Encrypt.
} // End of Class Encryption

Answer 1

Hi Amelin
Thanks for your reply.
I havent understood your statement:
But You'll not authenticate your client. Everyone will be able to acces to your server.
My objective is:
1) Send a Message over HTTPS to a Servlet.
This Servlet will decrypt the Message,and then
send a response back to the caller in encrypted
format and the caller will decrypt the response from
the Servlet.
For this,I created a class called Encrypt,which will
transfer data over https to the Receiving Servlet.
That Servlet will decrypt the message and send
a response back to the caller in encrypted format
and the caller will decrypt the Response.
My codes are as follows:
Class Encrypt2
package Encryption;
import java.io.*;
import java.util.*;
import java.security.*;
import javax.net.*;
import javax.net.ssl.*;
import com.sun.net.ssl.*;
import java.net.*;
public class Encrypt2
public String sMess;
public String sURL;
public static void ec(String sMess,String sURL)
try {
System.setProperty("java.protocol.handler.pkgs","com.sun.net.ssl.internal.www.protocol");
Security.addProvider(new com.sun.net.ssl.internal.ssl.Provider());
URL url;
String uri = "https://" + sURL + ":8443/AHTTPS_USERPWD/servlet/SecureServer3";
System.out.println("uri is " + uri);
url = new URL(uri);
HttpsURLConnection hpCon=null;
// Code below is used as the Client doesnt trust the Server Certifcate.
// This will be deleted if the Server has genuine/valid certificates.
try {
KeyManager[] km = null;
TrustManager[] tm = {new RelaxedX509TrustManager()};
SSLContext sslContext = SSLContext.getInstance("SSL");
sslContext.init(null, tm, new java.security.SecureRandom());
SSLSocketFactory sslSF = sslContext.getSocketFactory();
hpCon = (HttpsURLConnection)url.openConnection();
hpCon.setSSLSocketFactory(sslSF);
}catch(Exception e){}
hpCon.setDoOutput(true);
hpCon.setDoInput(true);
// Send the Message over HTTPS as a Stream to the Receving Servlet
System.out.println("Sending data over HTTPS ..." + sMess);
System.out.println();
// Transfer Data
OutputStream output = hpCon.getOutputStream();
output.write(sMess.getBytes());
output.flush();
output.close();
//Response from the Receiving Servlet.
System.out.println("Received response from the Secure Server...");
System.out.println();
int i;
InputStreamReader input = new InputStreamReader(hpCon.getInputStream());
while((i = input.read())!=-1)
System.out.println((char)i);
}catch(IOException e)
System.out.println("Error in Client " + e);
} // End of Method Encrypt.
static class RelaxedX509TrustManager implements X509TrustManager
public boolean checkClientTrusted(java.security.cert.X509Certificate[] chain)
return true;
public boolean isServerTrusted(java.security.cert.X509Certificate[] chain){
return true;
public boolean isClientTrusted(java.security.cert.X509Certificate[] chain){
return true;
public java.security.cert.X509Certificate[] getAcceptedIssuers() {
return null;
public void checkClientTrusted(java.security.cert.X509Certificate[] chain, String authType) {}
public void checkServerTrusted(java.security.cert.X509Certificate[] chain, String authType) {}
// End of Class Encryption
The Servlet to receive the Message and respond back
// The Secure Server Servlet.
// Receives the PAP Push Message in an Encrypted Format and decrypts this.
// This servlet is invoked first by: https://localhost:8443/AHTTPS_USERPWD/servlet/SecureServer3
import javax.servlet.*;
import javax.servlet.http.*;
import java.util.*;
import java.security.*;
import javax.net.*;
import javax.net.ssl.*;
import com.sun.net.ssl.*;
import java.net.*;
import java.io.*;
import java.sql.*;
import java.math.*;
import oracle.jdbc.driver.*; // See classpath and check how this is set
public class SecureServer3 extends HttpServlet {
private static final String CONTENT_TYPE = "text/html";
Connection dbConn;
PreparedStatement userPwd=null;
public void doGet(HttpServletRequest request,
HttpServletResponse response)
throws ServletException, IOException
doPost(request,response);
public void doPost(HttpServletRequest request,
HttpServletResponse response)
throws ServletException, IOException
System.out.println("Secure Server Ready to receive Message from application : TestEncryption.java");
System.out.println();
BufferedReader br=null;
/* Receives the String Message here and decrypts it... */
String sMess="";
InputStream input = request.getInputStream();
int i;
while((i = input.read())!=-1)
sMess += (String.valueOf((char) i));
System.out.println("Displaying at the SecureServer:");
System.out.println();
System.out.println(sMess);
// Send a Response back to the Caller depending upon
// whats received.
String sResponse = sMess;
OutputStream output = response.getOutputStream();
output.write(sResponse.getBytes());
} // End of doPost
As I will be porting all this on Apache 1.3.12/WAS Websphere 3.5.5 shortly,I wanted a go-ahead from
you (as you know all the ins-and outs)
PLEASE RESPOND.
Ajay
France Telecom R&D,London
[email protected]