HTTPS over SSL

Question

Hi!
I1ve been experimenting with SSL and weblogic. I run the following code to
retrieve an HTML page.
public static void main(String[] args) throws Exception {
java.security.Security.addProvider(new
com.sun.net.ssl.internal.ssl.Provider());
System.setProperty("java.protocol.handler.pkgs","com.sun.net.ssl.internal.ww
w.protocol");
System.setProperty("javax.net.ssl.trustStore","C:\\Documents and
Settings\\tdevos\\.keystore");
URL ssl = new URL(args[0]);
BufferedReader in = new BufferedReader(
new InputStreamReader(
ssl.openStream()));
String inputLine;
while ((inputLine = in.readLine()) != null)
System.out.println(inputLine);
in.close();
Everything goes fine over a non HTTPS connection. E.g. when I type in
java myApp http://localhost:7001
everything goes fine. However when I run
java myApp https://localhost:7002
I get the following error:
Exception in thread "main" java.io.IOException: HTTPS hostname wrong:
should be <localhost>, but cert says <weblogic.bea.com>
at
com.sun.net.ssl.internal.www.protocol.https.HttpsClient.a([DashoPro-V1.2-120
198])
at
com.sun.net.ssl.internal.www.protocol.https.HttpsClient.a([DashoPro-V1.2-120
198])
at
com.sun.net.ssl.internal.www.protocol.https.HttpsClient.a([DashoPro-V1.2-120
198])
at
com.sun.net.ssl.internal.www.protocol.https.HttpsURLConnection.connect([Dash
oPro-V1.2-120198])
at
com.sun.net.ssl.internal.www.protocol.https.HttpsURLConnection.getInputStrea
m([DashoPro-V1.2-120198])
at java.net.URL.openStream(URL.java:798)
I imported the weblogic key in the correct way (I think ...)
keytool -import -trustcacerts -keystore "C:\Documents and
Settings\tdevos\.keystore" -file democert.pem
I understand that he expects weblogic.bea.com instead of localhost but what
I don`t understand is that the example works when I rewrite my code to the
following:
System.setProperty("javax.net.ssl.trustStore", "C:\\Documents and
Settings\\tdevos\\.keystore");
SSLSocketFactory factory =
(SSLSocketFactory)SSLSocketFactory.getDefault();
SSLSocket socket = (SSLSocket)factory.createSocket("localhost", 7002);
socket.startHandshake();
PrintWriter out = new PrintWriter(
new BufferedWriter(
new OutputStreamWriter(
socket.getOutputStream())));
out.println("GET http://localhost/ HTTP/1.1");
out.println();
out.flush();
if (out.checkError())
System.out.println("SSLSocketClient: java.io.PrintWriter error");
/* read response */
BufferedReader in = new BufferedReader(
new InputStreamReader(
socket.getInputStream()));
String inputLine;
while ((inputLine = in.readLine()) != null)
System.out.println(inputLine);
in.close();
out.close();
socket.close();
This is also NOT the way I want to write my code because I`m planning to do
SOAP calls over the SSL.so I can`t simply use the GET method.
In my opinion I should tell weblogic to use another private key than the one
in the delivered. But how can I make a private key on my own?
Is there a way to export a private key with the standard java keytool and
how can I tell weblogic to use it? If can get rid of the error
Exception in thread "main" java.io.IOException: HTTPS hostname wrong:
should be <localhost>, but cert says <weblogic.bea.com>
then everything is fine!
Thanks in advance for replying
Tim De Vos

Answer 1

You can try to abuse the attached code to get your stuff work. Note do not try HTTPS
POST with Weblogic 6 now. The key point here is the DummyHostnameVerifier. You should
not use such method in your production code.
import java.io.*;
import java.net.*;
import com.sun.net.ssl.*;
import javax.net.ssl.*;
import java.security.*;
public class TestHttpsURL{     
     public static void main(String[] args){
SSLContext ctx;
//KeyManagerFactory kmf;
KeyStore ks;
try{
Security.addProvider(new com.sun.net.ssl.internal.ssl.Provider());
System.setProperty("java.protocol.handler.pkgs","com.sun.net.ssl.internal.www.protocol");
          //ctx = SSLContext.getInstance ("SSL");
          KeyManagerFactory kmf = KeyManagerFactory.getInstance("SunX509", "SunJSSE");
          TrustManagerFactory tmf = TrustManagerFactory.getInstance("SunX509", "SunJSSE");
ctx = SSLContext.getInstance ("SSL");
     ctx.init (kmf.getKeyManagers(), X509TrustManagerImpl.getTrustManagers("SunX509",null),
null);
     SSLSocketFactory factory = ctx.getSocketFactory();
     String msg = "USERID=user&PASSWORD=password";
HttpsURLConnection conn = (HttpsURLConnection)(new URL("https://localhost:7002/PostTest.jsp")).openConnection();
//URLConnection conn = (new URL("http://localhost:7001/PostTest.jsp")).openConnection();
conn.setDefaultSSLSocketFactory(factory);
conn.setSSLSocketFactory(factory);
conn.setHostnameVerifier(new DummyHostnameVerifier());
conn.setDoOutput(true);
conn.setDoOutput(true);
conn.setRequestProperty("Content-Length", String.valueOf(msg.length()));
conn.setRequestProperty("Content-Type", "application/x-www-form-urlencoded");
conn.setRequestProperty("Accept", "image/gif, image/x-xbitmap, image/jpeg,
image/pjpeg, application/msword, application/vnd.ms-powerpoint, application/vnd.ms-excel,
conn.setRequestProperty("Accept-Language", "en-us");
conn.setRequestProperty("User-Agent","Mozilla/4.0 (compatible; MSIE
5.01; Windows NT 5.0)");
conn.setRequestProperty("Host", "localhost:7002");
OutputStream out = conn.getOutputStream();
out.write(msg.getBytes());
out.flush();
byte[] resp = new byte[1024];
int len;
BufferedInputStream in = new BufferedInputStream(conn.getInputStream());
while((len = in.read(resp))>0){
System.out.print((new String(resp,0,len, "8859_1")));
}catch(Exception ex){
ex.printStackTrace();
class DummyHostnameVerifier implements HostnameVerifier{
public boolean verify(String urlHostname, String certHostname){
return true;     
"Tim De Vos" <[email protected]> wrote:
Hi!
I1ve been experimenting with SSL and weblogic. I run the following code
to
retrieve an HTML page.
public static void main(String[] args) throws Exception {
java.security.Security.addProvider(new
com.sun.net.ssl.internal.ssl.Provider());
System.setProperty("java.protocol.handler.pkgs","com.sun.net.ssl.internal.ww
w.protocol");
System.setProperty("javax.net.ssl.trustStore","C:\\Documents and
Settings\\tdevos\\.keystore");
URL ssl = new URL(args[0]);
BufferedReader in = new BufferedReader(
new InputStreamReader(
ssl.openStream()));
String inputLine;
while ((inputLine = in.readLine()) != null)
System.out.println(inputLine);
in.close();
Everything goes fine over a non HTTPS connection. E.g. when I type in
java myApp http://localhost:7001
everything goes fine. However when I run
java myApp https://localhost:7002
I get the following error:
Exception in thread "main" java.io.IOException: HTTPS hostname wrong:
should be <localhost>, but cert says <weblogic.bea.com>
at
com.sun.net.ssl.internal.www.protocol.https.HttpsClient.a([DashoPro-V1.2-120
198])
at
com.sun.net.ssl.internal.www.protocol.https.HttpsClient.a([DashoPro-V1.2-120
198])
at
com.sun.net.ssl.internal.www.protocol.https.HttpsClient.a([DashoPro-V1.2-120
198])
at
com.sun.net.ssl.internal.www.protocol.https.HttpsURLConnection.connect([Dash
oPro-V1.2-120198])
at
com.sun.net.ssl.internal.www.protocol.https.HttpsURLConnection.getInputStrea
m([DashoPro-V1.2-120198])
at java.net.URL.openStream(URL.java:798)
I imported the weblogic key in the correct way (I think ...)
keytool -import -trustcacerts -keystore "C:\Documents and
Settings\tdevos\.keystore" -file democert.pem
I understand that he expects weblogic.bea.com instead of localhost but what
I don`t understand is that the example works when I rewrite my code to the
following:
System.setProperty("javax.net.ssl.trustStore", "C:\\Documents and
Settings\\tdevos\\.keystore");
SSLSocketFactory factory =
(SSLSocketFactory)SSLSocketFactory.getDefault();
SSLSocket socket = (SSLSocket)factory.createSocket("localhost", 7002);
socket.startHandshake();
PrintWriter out = new PrintWriter(
new BufferedWriter(
new OutputStreamWriter(
socket.getOutputStream())));
out.println("GET http://localhost/ HTTP/1.1");
out.println();
out.flush();
if (out.checkError())
System.out.println("SSLSocketClient: java.io.PrintWriter error");
/* read response */
BufferedReader in = new BufferedReader(
new InputStreamReader(
socket.getInputStream()));
String inputLine;
while ((inputLine = in.readLine()) != null)
System.out.println(inputLine);
in.close();
out.close();
socket.close();
This is also NOT the way I want to write my code because I`m planning to
do
SOAP calls over the SSL.so I can`t simply use the GET method.
In my opinion I should tell weblogic to use another private key than the
one
in the delivered. But how can I make a private key on my own?
Is there a way to export a private key with the standard java keytool and
how can I tell weblogic to use it? If can get rid of the error
Exception in thread "main" java.io.IOException: HTTPS hostname wrong:
should be <localhost>, but cert says <weblogic.bea.com>
then everything is fine!
Thanks in advance for replying
Tim De Vos