System.setProperty() doesn't seem to take new keystore

Question

Hi,
I've spent a few hours hunting around on google and can't seem to find a solution to my problem so hopefully someone here can help.
I've written a simulator for people at work that tests HTTPS connections using .jks keystores. Each time they make a request they pass in a few basic variables like IP Address and Port number etc but also the keystore file to use.
The first HTTPS request always works fine, assuming they've passed in the correct keystore, but if they then change the keystore and point to another server it fails even if using the correct keystore. Here is the part of the code where the keystore is set.
public HttpsURLConnection getHTTPSRequest(URL url) throws IOException {
          System.setProperty("javax.net.ssl.trustStore", ToolWindow.sHTTPSKeystoreLocation);
          System.setProperty("javax.net.ssl.keyStoreType", "JKS");
          System.out.println(ToolWindow.sHTTPSKeystoreLocation);
          System.out.println(System.getProperty("javax.net.ssl.trustStore"));
          HttpsURLConnection httpsURL = (HttpsURLConnection)url.openConnection();
          httpsURL.setHostnameVerifier(new HostnameVerifier()
               public boolean verify(String hostname, SSLSession session)
                    return true;
          httpsURL.setRequestProperty("Content-Type","text/xml");
          httpsURL.setDoOutput(true);
          httpsURL.setDoInput(true);
          httpsURL.setConnectTimeout(iConnectTimeout);
          httpsURL.setReadTimeout(iReadTimeout);
          return httpsURL;
     }The System.out.println output always shows the correct keystore that's being passed in but the following exception gets thrown:
nested exception is:
     javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
I know the path and certificate are good because if I restart the application and put in the same values it works but each time I change the keystore it stops working. It seems like System.setProperty() isn't using the new keystore supplied when making the connection but then my System.out.println output would show that surely.
Any help would be appreciated.
Thanks.

Answer 1

Hi ejp,
Thanks for pointing me in the right direction. I eventually found a solution which I will share here in case anyone else has a similar problem. The reason why I couldn't put all private keys into a single keystore is that the tool I'm writing is for our Operations team to be able to test keystores that we give out to individual customers. From a security point of view it wouldn't be a good idea to give out every customers keystore to everyone else.
Here is how I did my implementation.
In my original class that creates the HttpsURLConnection only line changed as follows:
public HttpsURLConnection getHTTPSRequest(URL url, SSLSocketFactory sslSF) throws IOException { // pass in SSLSocketFactory
     HttpsURLConnection httpsURL = (HttpsURLConnection)url.openConnection();
     httpsURL.setSSLSocketFactory(sslSF); // set SSLSocketFactory
     httpsURL.setHostnameVerifier(new HostnameVerifier()
          public boolean verify(String hostname, SSLSession session)
               return true;
     httpsURL.setRequestProperty("Content-Type","text/xml");
     httpsURL.setDoOutput(true);
     httpsURL.setDoInput(true);
     httpsURL.setConnectTimeout(iConnectTimeout);
     httpsURL.setReadTimeout(iReadTimeoutDefault);
     return httpsURL;
}and here is the code I added to build the SSLSocketFactory...
KeyStore ks = KeyStore.getInstance("JKS"); // create new KeyStore object and pass in instance to constructor
ks.load(new FileInputStream(ToolWindow.getHTTPSKeystoreFile()), ToolWindow.getKeystorePassword()); // load keystore file and password in to KeyStore instance
KeyManagerFactory kmf = KeyManagerFactory.getInstance("SunX509"); // create a new KeyManagerFactory object and pass in instance to constructor
kmf.init(ks, ToolWindow.getKeystorePassword()); // initialize the KeyManagerFactory and pass in the KeyStore object and keystore password as variables
TrustManagerFactory tmf = TrustManagerFactory.getInstance("SunX509"); // create a new TrustManagerFactory object and pass in instance to constructor
tmf.init(ks); // initialize the TrustManagerFactory and pass in the KeyManagerFactory object as a variable
SSLContext c = SSLContext.getInstance("SSL"); // create a new SSLContext object and pass in instace to constructor
c.init(kmf.getKeyManagers(), tmf.getTrustManagers(), null); // initialize SSLContext and pass in Trust/KeyManagerFactory as variables
SSLSocketFactory sf = c.getSocketFactory(); // create my SSLSocketFactory to be passed in to HttpsURLConnection
HttpsURLConnection urlc = getHTTPSRequest(url,sf); // create a HttpsURLConnection by calling my method listed at the top of this post and passing in the variables I have herby described.Hope this helps someone else who runs into the same problem as me!