JSSE: Having trouble connecting to an https URL (certificate problems)

Question

Hi folks,
I have a really, really simple Java app that just opens a URL using the java.net.URL class to open a URL ("https://....").
I can't get it to connect successfully. Here is a history of what I've done so far.
I was given a cert that's part of a two-cert chain, but not rooted in a recognized CA. I installed it in
./jre/lib/security/cacerts file using keytool.
It didn't work. I got this error:
javax.net.ssl.SSLHandshakeException:
sun.security.validator.ValidatorException: PKIX path building failed:
sun.security.provider.certpath.SunCertPathBuilderException: unable to
find valid certification path to requested targetDoing some googling I found this article:
http://blogs.sun.com/andreas/entry/no_more_unable_to_findIf I'm paraphrasing it correctly, it says that the InstallCert app it mentions will hit the server, obtain its cert, and install it in my jssecacerts file as part of a chain so that JSSE won't throw an exception.
So, I think this means I don't need my original cert. I can run this guy's program and it will get the server's cert and install it in (or first create) my jssecacerts file as part of a cert chain.
I did this, and now get another error:
"no name matching disc.paramount-bluray.com found"
The URL I'm trying to hit is: https://disc.paramount-bluray.com The CN in the cert presented by the server is: disc.paramount-hddvd.comI believe the two names need to match, correct? OK, but if I'm using this guy's program, it's not even using my cert. It's getting the cert from the server and installing it as part of a chain in my jssecacerts file so the name matching in my cert shouldn't matter.
So, why did this program not properly install the cert chain? Am I missing a step? After running his program a second time, it behaves as he describes. But when I subsequently run my app, it fails.
Do I need to add all the certs in jssecacerts to the .keystore file in my home directory? Do I need to add the certs in the jssecacerts into my cacerts file?
Or, perhaps the simpler question is "how do I get my app to successfully connect" to the server?
Many thanks in advance.
Vartan

Answer 1

Thanks for the warning, but I can "trust" the server cert because I know the server. It's a client who will not be acquiring a cert that's chained to a CA's root cert.Then get them to export it and import it into your own truststore. That's the correct solution. Accepting any certificate you receive over the connection that you're trying to make secure via the certificate you receive over the connection you're trying to secure ... doesn't make any sense. Get them to send it to you offline. And put a security design around that process too. If you don't do this step your solution is not secure, because you don't have any guarantee that the certificate came from who it said it came from. The HostnameVerifier doesn't help you with that part.
I think I want to get the common name (CN) out of the cert that the server presents and compare it to the URL to which I'm connecting. Is this correct?Yep.
I can't figure out how to get the CN out of the server's cert.X509Certificate.getSubjectX500Principal().getName(), then parse out the CN part.
How do I get the cert from the SSLSession object that's passed into the HostnameVerifier.verify() method? SSLSession.getPeerCertificateChain().