Java Webstart application problem with TLS certificate revocation checks (Java 1.7.0_76)

We have a problem with our Java Web Start Application regarding the TLS certificate revocation check:
The application is running on a server within a wide area network which is separated from the internet.
The application users have access to the WAN, and also access to the internet over some corporate proxy/firewall.
The user has to enter, for example "https://my-site.de/myapp/ma.jnlp" within a webbrowser or could also call "javaws https://my-site.de/myapp/ma.jnlp" to start the application client.
The webserver has a certificate from a trusted certificate authority. This certificate seems to be ok, the browser is even configured to perform OCSP status check.
The application files are signed with a certificate from another trusted certificate authority. This certificate seems also to be ok. Regarding this certificate there
are no problems with certificate revocation checks.
The problem is, while starting the application client there is a message box which tell us something like "the connection to this website ist not trustworthy",
"Website: https://my-site.de:80", and something about an invalid certificate, meaning the webserver certificate.
Obviously the jvm runtime, which is executed on the users workstation, tries to perform a revocation check for the webservers certificate, but this fails because
it cannot fetch the certificate under https://my-site.de:80.
The application will execute without further problems after that message but the users are very concerned about the "invalid" certificate, so here are my questions:
- Why is the application trying to get the webserver certificate over Port 80. Our application developers told me, there is no corresponding statement. Calling this address
has to fail while "https://my-site.de:443" or "https://my-site.de" would not have a problem.
- Is there a way to make the application go on without performing a tls revocation check? I mean, by adjusting the application sourcecode and not by configuring the users Java Control Panel.
While disabling the TLS Certificate Revocation check in the Java Control Panel, the Webstart Application executes without a warning message, but this is not a workable solution for
our users.
It would be great if someone can help me with a hint so i can send our developers into the right direction;-)
Many thanks!
This is a part from a java console output after calling "javaws -verbose https://my-site.de/myapp/"
(sorry for this is in german... and also my english above)
network: Verbindung von http://ocsp.serverpass.telesec.de/ocspr mit Proxy=HTTP @ internet-proxy.***:80 wird hergestellt
network: Verbindung von http://ocsp.serverpass.telesec.de/ocspr mit Proxy=HTTP @ internet-proxy.***:80 wird hergestellt
security: OCSP Response: GOOD
network: Verbindung von http://ocsp.serverpass.telesec.de/ocspr mit Proxy=HTTP @ internet-proxy.***:80 wird hergestellt
security: UNAUTHORIZED
security: Failing over to CRLs: java.security.cert.CertPathValidatorException: OCSP response error: UNAUTHORIZED
network: Cacheeintrag gefunden [URL: http://crl.serverpass.telesec.de/rl/TeleSec_ServerPass_CA_1.crl, Version: null] prevalidated=false/0
cache: Adding MemoryCache entry: http://crl.serverpass.telesec.de/rl/TeleSec_ServerPass_CA_1.crl
cache: Resource http://crl.serverpass.telesec.de/rl/TeleSec_ServerPass_CA_1.crl has expired.
network: Verbindung von http://crl.serverpass.telesec.de/rl/TeleSec_ServerPass_CA_1.crl mit Proxy=HTTP @ internet-proxy.***:80 wird hergestellt
network: Verbindung von http://crl.serverpass.telesec.de/rl/TeleSec_ServerPass_CA_1.crl mit Proxy=HTTP @ internet-proxy.***:80 wird hergestellt
network: ResponseCode für http://crl.serverpass.telesec.de/rl/TeleSec_ServerPass_CA_1.crl: 200
network: Codierung für http://crl.serverpass.telesec.de/rl/TeleSec_ServerPass_CA_1.crl: null
network: Verbindung mit http://crl.serverpass.telesec.de/rl/TeleSec_ServerPass_CA_1.crl trennen
CacheEntry[http://crl.serverpass.telesec.de/rl/TeleSec_ServerPass_CA_1.crl]: updateAvailable=true,lastModified=Tue Mar 24 10:50:01 CET 2015,length=53241
network: Verbindung von http://crl.serverpass.telesec.de/rl/TeleSec_ServerPass_CA_1.crl mit Proxy=HTTP @ internet-proxy.***:80 wird
network: Verbindung von socket://ldap.serverpass.telesec.de:389 mit Proxy=DIRECT wird hergestellt
security: Revocation Status Unknown
com.sun.deploy.security.RevocationChecker$StatusUnknownException: java.security.cert.CertPathValidatorException: OCSP response error: UNAUTHORIZED
    at com.sun.deploy.security.RevocationChecker.checkOCSP(Unknown Source)
    at com.sun.deploy.security.RevocationChecker.check(Unknown Source)
    at com.sun.deploy.security.RevocationCheckHelper.doRevocationCheck(Unknown Source)
    at com.sun.deploy.security.RevocationCheckHelper.doRevocationCheck(Unknown Source)
    at com.sun.deploy.security.RevocationCheckHelper.checkRevocationStatus(Unknown Source)
    at com.sun.deploy.security.X509TrustManagerDelegate.checkTrusted(Unknown Source)
    at com.sun.deploy.security.X509Extended7DeployTrustManagerDelegate.checkServerTrusted(Unknown Source)
    at com.sun.deploy.security.X509Extended7DeployTrustManager.checkServerTrusted(Unknown Source)
    at sun.security.ssl.ClientHandshaker.serverCertificate(Unknown Source)
    at sun.security.ssl.ClientHandshaker.processMessage(Unknown Source)
    at sun.security.ssl.Handshaker.processLoop(Unknown Source)
    at sun.security.ssl.Handshaker.process_record(Unknown Source)
    at sun.security.ssl.SSLSocketImpl.readRecord(Unknown Source)
    at sun.security.ssl.SSLSocketImpl.performInitialHandshake(Unknown Source)
    at sun.security.ssl.SSLSocketImpl.startHandshake(Unknown Source)
    at sun.security.ssl.SSLSocketImpl.startHandshake(Unknown Source)
    at sun.net.www.protocol.https.HttpsClient.afterConnect(Unknown Source)
    at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(Unknown Source)
    at sun.net.www.protocol.http.HttpURLConnection.getInputStream(Unknown Source)
    at sun.net.www.protocol.https.HttpsURLConnectionImpl.getInputStream(Unknown Source)
    at com.sun.deploy.net.HttpUtils.followRedirects(Unknown Source)
    at com.sun.deploy.net.BasicHttpRequest.doRequest(Unknown Source)
    at com.sun.deploy.net.BasicHttpRequest.doGetRequestEX(Unknown Source)
    at com.sun.deploy.cache.ResourceProviderImpl.checkUpdateAvailable(Unknown Source)
    at com.sun.deploy.cache.ResourceProviderImpl.isUpdateAvailable(Unknown Source)
    at com.sun.deploy.cache.ResourceProviderImpl.getResource(Unknown Source)
    at com.sun.deploy.cache.ResourceProviderImpl.getResource(Unknown Source)
    at com.sun.deploy.model.ResourceProvider.getResource(Unknown Source)
    at com.sun.javaws.jnl.LaunchDescFactory._buildDescriptor(Unknown Source)
    at com.sun.javaws.jnl.LaunchDescFactory.buildDescriptor(Unknown Source)
    at com.sun.javaws.jnl.LaunchDescFactory.buildDescriptor(Unknown Source)
    at com.sun.javaws.Main.launchApp(Unknown Source)
    at com.sun.javaws.Main.continueInSecureThread(Unknown Source)
    at com.sun.javaws.Main.access$000(Unknown Source)
    at com.sun.javaws.Main$1.run(Unknown Source)
    at java.lang.Thread.run(Unknown Source)
    Suppressed: com.sun.deploy.security.RevocationChecker$StatusUnknownException
        at com.sun.deploy.security.RevocationChecker.checkCRLs(Unknown Source)
        ... 35 more
Caused by: java.security.cert.CertPathValidatorException: OCSP response error: UNAUTHORIZED
    at sun.security.provider.certpath.OCSP.check(Unknown Source)
    at sun.security.provider.certpath.OCSP.check(Unknown Source)
    at sun.security.provider.certpath.OCSP.check(Unknown Source)
    ... 36 more
security: Ungültiges Zertifikat vom HTTPS-Server
network: Cacheeintrag nicht gefunden [URL: https://my-site.de:80, Version: null]

Add the JSF Jars to the WEB-INF/lib directory of the application. If still getting error add to the CLASSPATH variable in the startWebLogic script in the domain/bin directory.

Similar Messages

How to launch a Java WebStart application with older JREs when Java 7u25 is on the client?

How can I launch older versions of my Java WebStart application, that are built and run with Java 7u21 or earlier, even if Java 7u25 is installed locally on the client? Application launch and behaviour must be reliable and consistent.
Background:
As of 7u25 (and later), Java Webstart applications launch with a different class loader than pre-7u25.
My Java Webstart application has supported versions that were built with older versions of the JDK (e.g. Java 5, 6, 7u21 or earlier). These applications run with their required JRE version, enforced through JNLP. Once Java 7u25 is installed locally, these older applications fail to launch, due to classloader differences.
The question is: what is required to run older Java WebStart applications even if 7u25 (or later) Java Webstart is installed locally on the client?

I confirm your findings when using shortcuts to try specific versions of JavaWS with 7u25 or later installed:
JRE 5u14 launched and the classloader was as pre 7u25
JRE 6u43 would not launch
JRE 7u21 launched but the classloader was not as pre 7u25
You can launch the shortcut with the JavaWS -verbose option to display a messagebox with valuable information.
I am keeping a close watch on this thread.

How to disable checks for certificate revocation on Java 7 u25

I have updated a standalone network to Java 7 update 25. With this new version is an option to "Perform certificate revocation checks on". Since this checks against sources published to the outside network, it fails to allow users on the standalone network to use some Java applications. This is remedied by checking Do not check. However, I need to be able to push this setting out to all users on the network.
Does anyone have or know a way to make this change through the registry or a config file?

For Internal webauth - HTTP & HTTPs redirection is possible on 7.0 & 7.2 code on WLC. See the difference below.
On 7.0 code both webauth redirection & wlc management were global, Disabling http management disables http webauth redirection, same for https as well. This behavior is changed in 7.2.
On 7.2 code, You can have both HTTP & HTTPs management enabled and configure either HTTP or HTTPs redirection. use the below command to control http or https redirection.
(Cisco Controller) >config network web-auth secureweb enable/disable
Enable - Enables https for web-auth redirection.
Disable - Enables http for web-auth redirection.

[SOLVED] Problem with ca-certificates

For some time there is a problem with ca-certificates during update. I receive folowing error:
[user@bragi ~]$ sudo pacman -Suy
:: Synchronizowanie baz danych z pakietami...
core jest już w najnowszej wersji
community jest już w najnowszej wersji
multilib jest już w najnowszej wersji
:: Rozpoczynanie pełnej aktualizacji systemu...
ostrzeżenie: libxml-perl: local (0.08-6) jest nowsze niż community (0.08-5)
rozwiązywanie zależności...
ostrzeżenie: nie można rozwiązać "ca-certificates-mozilla", zależności od "ca-certificates"
:: Następujący pakiet nie mógł zostać zaktualizowany w wyniku niespełnionych zależności:
ca-certificates
:: Czy chcesz pominąć powyższy pakiet przy aktualizacji? [t/N] N
błąd: nie udało się przygotować transakcji (niespodziewany błąd)
I know that this is not in english but the messages says that there is a error with dependency ca-certificates-mozilla <--> ca-certificates.
I ask this same question on polish forum but I only receive suggestion to try run:
pacman -Suyy
but this is not a solution.
Any ideas?
Last edited by web01 (2014-10-16 19:36:30)

I'm not sure but maybe becouse of this
[user@bragi ~]$ sudo pacman -Suyy
:: Synchronizing package databases...
core 116.7 KiB 1945K/s 00:00 [#####################################################] 100%
extra 1767.3 KiB 2.16M/s 00:01 [#####################################################] 100%
community 2.3 MiB 2.28M/s 00:01 [#####################################################] 100%
multilib 118.9 KiB 2.04M/s 00:00 [#####################################################] 100%
:: Starting full system upgrade...
:: Replace ati-dri with extra/mesa-dri? [Y/n]
:: Replace baloo with extra/baloo4? [Y/n]
:: Replace baloo-widgets with extra/baloo4-widgets? [Y/n]
:: Replace grantlee with extra/grantlee-qt4? [Y/n]
:: Replace intel-dri with extra/mesa-dri? [Y/n]
:: Replace java-common with extra/java-runtime-common? [Y/n]
:: Replace kfilemetadata-frameworks with extra/kfilemetadata5? [Y/n]
warning: libxml-perl: local (0.08-6) is newer than community (0.08-5)
:: Replace nouveau-dri with extra/mesa-dri? [Y/n]
:: Replace svga-dri with extra/mesa-dri? [Y/n]
resolving dependencies...
looking for inter-conflicts...
error: unresolvable package conflicts detected
error: failed to prepare transaction (conflicting dependencies)
:: kwin and kdebase-workspace are in conflict

Java webstart not installed with 1.5.0

I have uninstalled J2SE 1.4.2 and installed J2SE 1.5.0 upgrade. I have noticed that java webstart application launcher was not installed in the start menu or programs menu. Is Sun not supporting it any more or is it in a different download? What happened to it? Where can I obtain it?

Nevermind. I have seen the webstart documentation. Now, I understand what you all were trying to tell me. Thanks for information any way. From now on, I will read the docs first. then experiment and if i still have problems, then i will post a forum message. I am sorry that did not I catch on.

I need to sign a java webstart application but Im no coder

Hi
I have a java webstart application that was writen for me by a coder that I can no longer contact. I was given all the souce code for the application including an unsigned jar file. What I would like to know is how do I go about getting the application signed by a trusted authority so that the people who use the app for the first time dont get the big ugly warnings. I have no java programing experience at all so any help will be greatly appreciated.
Regards
Dean

Please note that users will still get a message, because signing does not infer trust, it only establishes identity.

Having some problems with security certificates

Hello,
In some pages, e.g. Twitter, and pages that load FB comments sections, I'm having problems with the certificates and the pages won't load. I don't get an option to add an exception either, therefore I cannot access pages.
I have pasted the error details below. Here is some important info for you:
Version: 9.0.1 <-- Upgrading is NOT an option, this is a corporate machine
Connect via proxy: yes
I doubt very much that this is an issue with the connection, as IE and Chrome are NOT having this issue on the same connection.
Error I get:
This Connection is Untrusted
You have asked Firefox to connect securely to twitter.com, but we can't confirm that your connection is secure.
Normally, when you try to connect securely, sites will present trusted identification to prove that you are going to the right place. However, this site's identity can't be verified.
What Should I Do?
If you usually connect to this site without problems, this error could mean that someone is
trying to impersonate the site, and you shouldn't continue.
Technical Details
twitter.com uses an invalid security certificate.
The certificate is not trusted because the issuer certificate is not trusted.
(Error code: sec_error_untrusted_issuer)
Can anyone shed some light? The usual troubleshooting I've come across hasn't helped me much.

Off the cuff it smells of a man-in-the-middle situation to me. As far as I know, Twitter does have a valid certificate, signed by Verisign. That IE and Chrome have no problem with it, could just mean they do not check resp. do let you know.
I'll have to pass here, because I would not know, how to turn this checking off in FX 9.0 - in any case I would think twice before doing it. The place to look would be Options > advanced > Encryption.
Hope somebody else joins us:)
PS: keeping you nailed down to Fx 9.0 version is unsafe - not just for you, but for your company as well.

Getting error "Problem with SSL Certificate" but I'm connecting to my private server without SSL

I wanted to create a PDF from a subtree at a website. The first problem was that Acrobat Pro (11.0.7) wouldn't spider it (probably because there was a robot.txt file there) so I had to use SiteSucker to pull the pages down to my Mac.
Then I discovered that Acrobat Pro can't handle file:/// URLs so that was no good either
So then I copied all the pages to a folder on my Linux server where I use a non-standard port (86) for http connection as a minor security precaution.
When I tried to access that from Acrobat Pro, it bitched about a problem with SSL Certificate but gave me no option to do anything about it. More relevantly, all the files were accessible using http protocol, not https so there shouldn't have been any need to deal with SSL certificates at all
I had to temporarily enable port 80 on my apache server at which point it's now pulling all the files in and hopefully converting them.
A) We're at version 11 ---- these kinds of issues should have been fixed years ago
B) While you're at it, fix the stupid UI issue where the download dialog disappears completely if Acrobat Pro doesn't have the focus. On a long download, I'd like to be able to see progress while working on other stuff. Acrobat Pro is not the center of the universe!

Interesting point 2, I am working on a Mac plugin at the moment. It does not hide its dialogs when switching to a different app. I consider this a bug and will fix it so the dialog disappears. I hadn't considered the question of progress but there is a very strong reason to do this on the Mac.
My tests seem to show that
(a) to get a dialog to sit above PDF documents all the time, it must be on a higher "level".
(b) if a dialog is at a higher level, this is a global setting.
So, if the dialog is not hidden when switching all, it will typically sit on top of the other app's document windows. This would not be popular, as the end user, unless they have mountains of screen space and choose to use it that way, must either close or move the dialog when switching app, then bring the dialog back. So, because Acrobat Pro is not the centre of the universe, it will hide dialogs (or rather, the Mac will, as it's a standard option when creating a window).

Sqljdbc4 driver problem with the latest version of java (java6 update9)

Hi all, sorry for my ingles.Need help with a problem, I have to connect to sql server 2008 from Java, I had install the Java SE Development Kit 6u22, and when the upgrade to the 6u29, the driver stopped working, they let the following example:
public static Connection getConnection(String db_connect_string,String jdbcDriver)
Connection conn = null;
try {
Class.forName(jdbcDriver);
conn = DriverManager.getConnection(db_connect_string); //when you run this line, does nothing mores, nor throws errors
} catch (Exception e) {
System.out.println("Error de conexion." + e.getMessage());
return conn;
uninstall update29, and install that before and had returned to work. Still do not know how to solve this problem with the latest version of java. Any ideas?.
Thanks.

You are not the only one.
MS SQL JDBC does not work with 1.6.0_29?

Exchange Certificate - Revocation Check Failed

Hi,
the scenario is the following:
Windows 2012 R2 domain
Exchange 2010
Windows 2012 R2 PKI (1 CA Root stand alone. 1 CA Subordinate Enterprise)
At Exchange, I get the following error:
The certificate details are:
I guess that revocation check error is due to "%20" at ldap path (second image).
The questions are:
The "%20" is a normal behavior at "CRL Distribution Points" details in the certificate?
if no
How to delete "%20" in the certificate?
Thanks in advance!

Thanks Mark.
The output from issuing CA:
Issuer:
    CN=SERVSUBUCA
    DC=servicioscorp
    DC=pbo
Name Hash(sha1): 3f202eaecb344a1d5f7cefa0ef305ccc4f11764b
Name Hash(md5): d096ae4af2bbf1f9b7246c5c51f979cb
Subject:
    CN=uiomatrv-exca01.servicioscorp.pbo
    OU=IT
    O=PRODUBANCO
    L=Quito
    S=Pichincha
    C=EC
Name Hash(sha1): dbed6b31170d7ea3c36e08e4b7012a4595108527
Name Hash(md5): bd573e0501d5e3d3a8cdcd229dd40a2e
Cert Serial Number: 620000001168945925b163ff5d000000000011
dwFlags = CA_VERIFY_FLAGS_CONSOLE_TRACE (0x20000000)
dwFlags = CA_VERIFY_FLAGS_DUMP_CHAIN (0x40000000)
ChainFlags = CERT_CHAIN_REVOCATION_CHECK_CHAIN_EXCLUDE_ROOT (0x40000000)
HCCE_LOCAL_MACHINE
CERT_CHAIN_POLICY_BASE
-------- CERT_CHAIN_CONTEXT --------
ChainContext.dwInfoStatus = CERT_TRUST_HAS_PREFERRED_ISSUER (0x100)
ChainContext.dwRevocationFreshnessTime: 32 Days, 5 Minutes, 4 Seconds
SimpleChain.dwInfoStatus = CERT_TRUST_HAS_PREFERRED_ISSUER (0x100)
SimpleChain.dwRevocationFreshnessTime: 32 Days, 5 Minutes, 4 Seconds
CertContext[0][0]: dwInfoStatus=102 dwErrorStatus=0
Issuer: CN=SERVSUBUCA, DC=servicioscorp, DC=pbo
NotBefore: 8/4/2014 11:10 AM
NotAfter: 8/3/2016 11:10 AM
Subject: CN=uiomatrv-exca01.servicioscorp.pbo, OU=IT, O=PRODUBANCO, L=Quito, S=Pichincha, C=EC
Serial: 620000001168945925b163ff5d000000000011
SubjectAltName: DNS Name=uiomatrv-exca01.servicioscorp.pbo, DNS Name=gyesitev-exca01.servicioscorp.pbo, DNS Name=gyesitev-exca01, DNS Name=uiomatrv-exca01
Template: WebServer
0e180ca4a6642be3709465fd1db4d9a6fa3be717
Element.dwInfoStatus = CERT_TRUST_HAS_KEY_MATCH_ISSUER (0x2)
Element.dwInfoStatus = CERT_TRUST_HAS_PREFERRED_ISSUER (0x100)
---------------- Certificate AIA ----------------
No CRL "Certificate (0)" Time: 0
    [0.0] ldap:///CN=SERVSUBUCA,CN=AIA,CN=Public%20Key%20Services,CN=Services,CN=Configuration,DC=servicioscorp,DC=pbo?cACertificate?base?objectClass=certificationAuthority
---------------- Certificate CDP ----------------
Verified "Base CRL (2b)" Time: 0
    [0.0] ldap:///CN=SERVSUBUCA,CN=UIOMATRV-CERT02,CN=CDP,CN=Public%20Key%20Services,CN=Services,CN=Configuration,DC=servicioscorp,DC=pbo?certificateRevocationList?base?objectClass=cRLDistributionPoint
Verified "Delta CRL (2b)" Time: 0
    [0.0.0] ldap:///CN=SERVSUBUCA,CN=UIOMATRV-CERT02,CN=CDP,CN=Public%20Key%20Services,CN=Services,CN=Configuration,DC=servicioscorp,DC=pbo?deltaRevocationList?base?objectClass=cRLDistributionPoint
---------------- Base CRL CDP ----------------
OK "Delta CRL (2f)" Time: 0
    [0.0] ldap:///CN=SERVSUBUCA,CN=UIOMATRV-CERT02,CN=CDP,CN=Public%20Key%20Services,CN=Services,CN=Configuration,DC=servicioscorp,DC=pbo?deltaRevocationList?base?objectClass=cRLDistributionPoint
---------------- Certificate OCSP ----------------
No URLs "None" Time: 0
    CRL 2b:
    Issuer: CN=SERVSUBUCA, DC=servicioscorp, DC=pbo
    ThisUpdate: 7/30/2014 2:31 PM
    NextUpdate: 8/14/2014 2:51 AM
    507e17f28e96054ead075e0cf353ea1cefbc4d9f
    Delta CRL 2f:
    Issuer: CN=SERVSUBUCA, DC=servicioscorp, DC=pbo
    ThisUpdate: 8/3/2014 2:32 PM
    NextUpdate: 8/5/2014 2:52 AM
    52827a7c7b5f621e2db4aa6b76f9fc448a35e50b
Application[0] = 1.3.6.1.5.5.7.3.1 Server Authentication
CertContext[0][1]: dwInfoStatus=102 dwErrorStatus=0
Issuer: CN=SERVROOTCA
NotBefore: 6/18/2014 1:53 PM
NotAfter: 6/18/2024 2:03 PM
Subject: CN=SERVSUBUCA, DC=servicioscorp, DC=pbo
Serial: 2d000000024a75bdddb4ea0374000000000002
Template: SubCA
5b61be4e5ef53895a1475a89a986302a26cc34a8
Element.dwInfoStatus = CERT_TRUST_HAS_KEY_MATCH_ISSUER (0x2)
Element.dwInfoStatus = CERT_TRUST_HAS_PREFERRED_ISSUER (0x100)
---------------- Certificate AIA ----------------
No URLs "None" Time: 0
---------------- Certificate CDP ----------------
No URLs "None" Time: 0
---------------- Base CRL CDP ----------------
No URLs "None" Time: 0
---------------- Certificate OCSP ----------------
No URLs "None" Time: 0
    CRL 03:
    Issuer: CN=SERVROOTCA
    ThisUpdate: 7/3/2014 11:59 AM
    NextUpdate: 7/4/2015 12:19 AM
    34931efb937f7495ce869f635823bbd9e3df578a
CertContext[0][2]: dwInfoStatus=10c dwErrorStatus=0
Issuer: CN=SERVROOTCA
NotBefore: 6/18/2014 1:08 PM
NotAfter: 6/18/2029 1:18 PM
Subject: CN=SERVROOTCA
Serial: 63f24946f2448c9242ce44936f1f759e
1cd3339f1c7717ff77921ca53408a9d7ca58a5f7
Element.dwInfoStatus = CERT_TRUST_HAS_NAME_MATCH_ISSUER (0x4)
Element.dwInfoStatus = CERT_TRUST_IS_SELF_SIGNED (0x8)
Element.dwInfoStatus = CERT_TRUST_HAS_PREFERRED_ISSUER (0x100)
---------------- Certificate AIA ----------------
No URLs "None" Time: 0
---------------- Certificate CDP ----------------
  No URLs "None" Time: 0
---------------- Certificate OCSP ----------------
No URLs "None" Time: 0
Exclude leaf cert:
e594318b0d857c2fcb9d08db80637e278ad891df
Full chain:
a0215d71e05618f20649331ea9541930154344eb
Verified Issuance Policies: None
Verified Application Policies:
    1.3.6.1.5.5.7.3.1 Server Authentication
Leaf certificate revocation check passed
CertUtil: -verify command completed successfully.
The output from Exchange:
Issuer:
    CN=SERVSUBUCA
    DC=servicioscorp
    DC=pbo
Subject:
    CN=uiomatrv-exca01.servicioscorp.pbo
    OU=IT
    O=PRODUBANCO
    L=Quito
    S=Pichincha
    C=EC
Cert Serial Number: 620000001168945925b163ff5d000000000011
dwFlags = CA_VERIFY_FLAGS_CONSOLE_TRACE (0x20000000)
dwFlags = CA_VERIFY_FLAGS_DUMP_CHAIN (0x40000000)
ChainFlags = CERT_CHAIN_REVOCATION_CHECK_CHAIN_EXCLUDE_ROOT (0x40000000)
HCCE_LOCAL_MACHINE
CERT_CHAIN_POLICY_BASE
-------- CERT_CHAIN_CONTEXT --------
ChainContext.dwInfoStatus = CERT_TRUST_HAS_PREFERRED_ISSUER (0x100)
ChainContext.dwErrorStatus = CERT_TRUST_REVOCATION_STATUS_UNKNOWN (0x40)
ChainContext.dwRevocationFreshnessTime: 21 Hours, 31 Minutes, 44 Seconds
SimpleChain.dwInfoStatus = CERT_TRUST_HAS_PREFERRED_ISSUER (0x100)
SimpleChain.dwErrorStatus = CERT_TRUST_REVOCATION_STATUS_UNKNOWN (0x40)
SimpleChain.dwRevocationFreshnessTime: 21 Hours, 31 Minutes, 44 Seconds
CertContext[0][0]: dwInfoStatus=102 dwErrorStatus=0
Issuer: CN=SERVSUBUCA, DC=servicioscorp, DC=pbo
NotBefore: 04/08/2014 11:10
NotAfter: 03/08/2016 11:10
Subject: CN=uiomatrv-exca01.servicioscorp.pbo, OU=IT, O=PRODUBANCO, L=Quito, S=Pichincha, C=EC
Serial: 620000001168945925b163ff5d000000000011
SubjectAltName: DNS Name=uiomatrv-exca01.servicioscorp.pbo, DNS Name=gyesitev-exca01.servicioscorp.pbo, DNS Name=gyesitev-exca01, DNS Name=uiomatrv-exca01
Template: WebServer
17 e7 3b fa a6 d9 b4 1d fd 65 94 70 e3 2b 64 a6 a4 0c 18 0e
Element.dwInfoStatus = CERT_TRUST_HAS_KEY_MATCH_ISSUER (0x2)
Element.dwInfoStatus = CERT_TRUST_HAS_PREFERRED_ISSUER (0x100)
---------------- Certificate AIA ----------------
No CRL "Certificate (0)" Time: 0
    [0.0] ldap:///CN=SERVSUBUCA,CN=AIA,CN=Public%20Key%20Services,CN=Services,CN=Configuration,DC=servicioscorp,DC=pbo?cACertificate?base?objectClass=certificationAuthority
---------------- Certificate CDP ----------------
Verified "Base CRL (2b)" Time: 0
    [0.0] ldap:///CN=SERVSUBUCA,CN=UIOMATRV-CERT02,CN=CDP,CN=Public%20Key%20Services,CN=Services,CN=Configuration,DC=servicioscorp,DC=pbo?certificateRevocationList?base?objectClass=cRLDistributionPoint
Verified "Delta CRL (2b)" Time: 0
    [0.0.0] ldap:///CN=SERVSUBUCA,CN=UIOMATRV-CERT02,CN=CDP,CN=Public%20Key%20Services,CN=Services,CN=Configuration,DC=servicioscorp,DC=pbo?deltaRevocationList?base?objectClass=cRLDistributionPoint
---------------- Base CRL CDP ----------------
OK "Delta CRL (2f)" Time: 0
    [0.0] ldap:///CN=SERVSUBUCA,CN=UIOMATRV-CERT02,CN=CDP,CN=Public%20Key%20Services,CN=Services,CN=Configuration,DC=servicioscorp,DC=pbo?deltaRevocationList?base?objectClass=cRLDistributionPoint
---------------- Certificate OCSP ----------------
No URLs "None" Time: 0
    CRL 2b:
    Issuer: CN=SERVSUBUCA, DC=servicioscorp, DC=pbo
    9f 4d bc ef 1c ea 53 f3 0c 5e 07 ad 4e 05 96 8e f2 17 7e 50
    Delta CRL 2f:
    Issuer: CN=SERVSUBUCA, DC=servicioscorp, DC=pbo
    0b e5 35 8a 44 fc f9 76 6b aa b4 2d 1e 62 5f 7b 7c 7a 82 52
Application[0] = 1.3.6.1.5.5.7.3.1 Server Authentication
CertContext[0][1]: dwInfoStatus=102 dwErrorStatus=40
Issuer: CN=SERVROOTCA
NotBefore: 18/06/2014 13:53
NotAfter: 18/06/2024 14:03
Subject: CN=SERVSUBUCA, DC=servicioscorp, DC=pbo
Serial: 2d000000024a75bdddb4ea0374000000000002
Template: SubCA
a8 34 cc 26 2a 30 86 a9 89 5a 47 a1 95 38 f5 5e 4e be 61 5b
Element.dwInfoStatus = CERT_TRUST_HAS_KEY_MATCH_ISSUER (0x2)
Element.dwInfoStatus = CERT_TRUST_HAS_PREFERRED_ISSUER (0x100)
Element.dwErrorStatus = CERT_TRUST_REVOCATION_STATUS_UNKNOWN (0x40)
---------------- Certificate AIA ----------------
No URLs "None" Time: 0
---------------- Certificate CDP ----------------
No URLs "None" Time: 0
---------------- Certificate OCSP ----------------
No URLs "None" Time: 0
CertContext[0][2]: dwInfoStatus=10c dwErrorStatus=0
Issuer: CN=SERVROOTCA
NotBefore: 18/06/2014 13:08
NotAfter: 18/06/2029 13:18
Subject: CN=SERVROOTCA
Serial: 63f24946f2448c9242ce44936f1f759e
f7 a5 58 ca d7 a9 08 34 a5 1c 92 77 ff 17 77 1c 9f 33 d3 1c
Element.dwInfoStatus = CERT_TRUST_HAS_NAME_MATCH_ISSUER (0x4)
Element.dwInfoStatus = CERT_TRUST_IS_SELF_SIGNED (0x8)
Element.dwInfoStatus = CERT_TRUST_HAS_PREFERRED_ISSUER (0x100)
---------------- Certificate AIA ----------------
No URLs "None" Time: 0
---------------- Certificate CDP ----------------
No URLs "None" Time: 0
---------------- Certificate OCSP ----------------
No URLs "None" Time: 0
Exclude leaf cert:
24 b9 1e b2 79 76 b0 16 2d 6d ae e2 cd 6b 98 aa 5f 27 38 20
Full chain:
7b 8c 64 0e 02 42 5a 7e 2d 1a 8b d4 db 3a c2 9c 10 a9 13 56
Issuer: CN=SERVSUBUCA, DC=servicioscorp, DC=pbo
NotBefore: 04/08/2014 11:10
NotAfter: 03/08/2016 11:10
Subject: CN=uiomatrv-exca01.servicioscorp.pbo, OU=IT, O=PRODUBANCO, L=Quito, S=Pichincha, C=EC
Serial: 620000001168945925b163ff5d000000000011
SubjectAltName: DNS Name=uiomatrv-exca01.servicioscorp.pbo, DNS Name=gyesitev-exca01.servicioscorp.pbo, DNS Name=gyesitev-exca01, DNS Name=uiomatrv-exca01
Template: WebServer
17 e7 3b fa a6 d9 b4 1d fd 65 94 70 e3 2b 64 a6 a4 0c 18 0e
The revocation function was unable to check revocation for the certificate. 0x80092012 (-2146885614)
Revocation check skipped -- no revocation information available
Leaf certificate revocation check passed
CertUtil: -verify command completed successfully.
Thanks in advance!

When login, i see a error message saying " there is a eminent problem with hard disk " smart check

G72-250US Notebook , Win 7 64 Home Premium,
Error :
When i login " There is a eminent problem with Hard disk, SMART check faled" ,Prmary hard disk self test failed .
Please help me with ths problem

Hi,
If this message is coming up in a black screen.
Then the harddrive in the system is about to go bad or already bad.
If you are able to boot to windows, FIRST BACKUP DATA.
Also run a startup test by tapping F2 as soon as you power on the system.
The smart test is a BIOS feature in most of the computer which is designed to keep cust informed if the HDD is about to go bad. But their are instances where the SMART will only let you know that the HDD is bad only when the HDD has bad.
More Info: http://h10025.www1.hp.com/ewfrf/wc/document?docname=c01443317&cc=us&dlc=en&lc=en&jumpid=reg_R1002_US...
Although I am an HP employee, I am speaking for myself and not for HP.

Java WebStart application fails to load when cache is disabled.

We have a problem with our application when using the latest version of Java (Update 20). We a lanching a jnlp file using Java WebStart.
Until to the early release Update 21 b05, we had the following exception:
java.lang.NullPointerException
     at java.util.jar.JarVerifier.mapSignersToCodeSource(Unknown Source)
     at java.util.jar.JarVerifier.mapSignersToCodeSources(Unknown Source)
     at java.util.jar.JarVerifier.getCodeSources(Unknown Source)...
Which was fixed with the following bug resolution: http://bugs.sun.com/bugdatabase/view_bug.do?bug_id=6943522
Now with that latest version that initial problem got resolved, but a new one appeared. The problem described below, only appears when the "Java Cache"
of the control panel is disabled. We tested all the following scenarios:
- Cached data cleaned / Cache enabled: Works
- Cached data / Cache enabled: Works
- Cached data cleaned / Cache disabled -> Exception
- Cached data / Cache disabled -> Exception
* We have already check the signature of the resource manually and it is correctly signed.
* We have checked the jnlp with JaNeLA, and it's good.
* No matter what we change, every time Java Cache is disabled, we get the exception.
The exception thrown is the following:
com.sun.deploy.net.JARSigningException: Found unsigned entry in resource: http://server/resource.jar
     at com.sun.javaws.security.SigningInfo.getCommonCodeSignersForJar(SigningInfo.java:405)
     at com.sun.javaws.security.SigningInfo.check(SigningInfo.java:291)
     at com.sun.javaws.LaunchDownload.checkSignedResourcesHelper(LaunchDownload.java:1738)
     at com.sun.javaws.LaunchDownload.checkSignedResources(LaunchDownload.java:1508)
     at com.sun.javaws.Launcher.prepareResources(Launcher.java:1231)
     at com.sun.javaws.Launcher.prepareAllResources(Launcher.java:620)
     at com.sun.javaws.Launcher.prepareToLaunch(Launcher.java:326)
     at com.sun.javaws.Launcher.prepareToLaunch(Launcher.java:198)
     at com.sun.javaws.Launcher.launch(Launcher.java:115)
     at com.sun.javaws.Main.launchApp(Main.java:417)
     at com.sun.javaws.Main.continueInSecureThread(Main.java:249)
     at com.sun.javaws.Main$1.run(Main.java:111)
     at java.lang.Thread.run(Thread.java:619)
Can someone give any light on this issue?
For me it look very clearly like another bug related the first fix, but I wanted to pop the question here first.
For now we are recommending our customers, to keep with Java Update 18 (Last working version),
but it's becoming a bigger issue, since more and more customers are trying to update to the latest version.
Regards.

lizaro wrote:
..Can someone give any light on this issue?
For me it look very clearly like another bug related the first fix, but I wanted to pop the question here first.Normally I would ask a lot of questions and demand more evidence before thinking of agreeing to such an assessment, but you seem to have put in the research needed to cover most of that.
There were some recent (last month or three) reports of broken cache management, but AFAIR they were supposed to be fixed by update _20. Try update _21, and if that does not resolve the issue, raise a bug report with Sun.

SSO java sample application problem

Hi all,
I am trying to run the SSO java sample application, but am experiencing a problem:
When I request the papp.jsp page I end up in an infinte loop, caught between papp.jsp and ssosignon.jsp.
An earlier thread in this forum discussed the same problem, guessing that the cookie handling was the problem. This thread recommended a particlar servlet , ShowCookie, for inspecting the cookies for the current session.
I have installed this cookie on the server, but don't see anything but one cookie, JSESSIONID.
At present I am running the jsp sample app on a Tomcat server, while Oracle 9iAS with sso and portal is running on another machine on the LAN.
The configuration of the SSO sample application is as follows:
Cut from SSOEnablerJspBean.java:
// Listener token for this partner application name
private static String m_listenerToken = "wmli007251:8080";
// Partner application session cookie name
private static String m_cookieName = "SSO_PAPP_JSP_ID";
// Partner application session domain
private static String m_cookieDomain = "wmli007251:8080/";
// Partner application session path scope
private static String m_cookiePath = "/";
// Host name of the database
private static String m_dbHostName = "wmsi001370";
// Port for database
private static String m_dbPort = "1521";
// Sehema name
private static String m_dbSchemaName = "testpartnerapp";
// Schema password
private static String m_dbSchemaPasswd = "testpartnerapp";
// Database SID name
private static String m_dbSID = "IASDB.WMDATA.DK";
// Requested URL (User requested page)
private static String m_requestUrl = "http://wmli007251:8080/testsso/papp.jsp";
// Cancel URL(Home page for this application which don't require authentication)
private static String m_cancelUrl = "http://wmli007251:8080/testsso/fejl.html";
Values specified in the Oracle Portal partner app administration page:
     ID: 1326
     Token: O87JOE971326
     Encryption key: 67854625C8B9BE96
     Logon-URL: http://wmsi001370:7777/pls/orasso/orasso.wwsso_app_admin.ls_login
     single signoff-URL: http://wmsi001370:7777/pls/orasso/orasso.wwsso_app_admin.ls_logout
     Name: testsso
     Start-URL: http://wmli007251:8080/testsso/
     Succes-URL: http://wmli007251:8080/testsso/ssosignon.jsp
     Log off-URL: http://wmli007251:8080/testsso/papplogoff.jsp
Finally I have specified the cookie version to be v1.0 when running the regapp.sql script. Other parameters for this script are copied from the values specified above.
Unfortunately the discussion in the earlier thread did not go any further but to recognize the cookieproblem, so I am now looking for help to move further on from here.
Any ideas will be greatly appreciated!
/Mads

Pierre - When you work on the sample application, you should test the pages in a separate browser instance. Don't use the Run Page links from the Builder. The sample app has a different authentication scheme from that used in the development environment so it'll work better for you to use a separate development browser from the application testing browser. In the testing browser, to request the page you just modified, login to the application, then change the page ID in the URL. Then put some navigation controls into the application so you can run your page more easily by clicking links from other pages.
Scott

Java Front-end problems with Windows 200 Pro

Hi,
I have some problem on my pc with java applications front-end. I have windows 2000 Professional and use java(TM) 2 SDK, Standard Edition Version 1.3.1
Using every java applications (also development environment as JBuilder 4 Professional and Together 4) I have always problems with front-end: the text is bad visualized everytime I use the scroolbar, menu items into a menu are bad visualized while I drag over of them the mouse and so on...
To try to solve this my problem I have just installed Service Pack 2 for Windows 2000 Pro but I have not had good results - I keep to have the usual problem.
I'm aware that it is difficult to reproduce and however if anyone has some idea to solve my problem I am opened to every suggestion.
Thanks in advance

the text says that what technolody that they are using its called "Off Screen Images" once i used them in my applications to improve the prefomance.
What they says is to improve the time it takes to display componants that display text on them (Such as buttons, Labels...) they going to create an Off Screen Image of the text and then paste that image on to the screen whenever the componant has to be displayed/Re displayed instead of redrowing (Re rendering) the text on the screen repeatedly which take more time and processing power than rendering once and paste it to screen whenever needed but this solution will take some more memory.

Problem with loading native library in java version "1.5.0_05"

My application uses a native coded drawing. With java version 1.4.xx it was working just fine but with java 1.5.xx it gives the following error at the time of loading native library:
java.lang.UnsatisfiedLinkError: /home/abyzov/tmp/friend32-1.6.02/libfriend.so:
/home/abyzov/tmp/friend32-1.6.02/libfriend.so: undefined symbol: XtWindowToWidget
I assumed that java loads all necessary X-libraries at start up but it seems to be not true for version 1.5.xx. Does anybody now about this kind of problems? Should I report it as a bug?

I have this exact same problem. I developed an application all along using 1.4.2_08 to be exact no problems. I was forced to switch to 1.5.0_06, now when I try to run the app I get:
java.lang.UnsatisfiedLinkError: <path to library>/libcomlib.so: <path to library>/libcomlib.so: undefined symbol: yp_get_default_domain
I have tried compiling it in both 1.4.2_8 and 1.5.0_06 and it compiles perfectly but when I run with 1.5.0_06 it messes up.
If you found the problem with this or anyone else has any advice please let me know.

Java Webstart application problem with TLS certificate revocation checks (Java 1.7.0_76)

Similar Messages

Maybe you are looking for