Validating a server's certificate

Question

I am writing an app that does an https post of a request and gets a result returned. The company that I am interacting with has a certificate from verisign. I know nothing about certificates! I need to validate their certificate in code as I do this transaction. I need to validate that their cert is current, check the authority and the url. Anyone have an example of this type of action? Do I do this right before the post or does this happen during the post? Sorry I am such a newbie!
Thanks!
Bill

Answer 1

Hello!!!
I've a similar problem. I need validate a client certificate against my server. I'm researching in this field and I've learning some things. You need have one keystore, this is the place where the certificates are stored. In this keystore you need have the CA root certificates (Certificate Authory or similar), so to speak, the trusted certificates (verisign, thawte, etc). Your application trust by default in this entities. You can add more entities when you want, only you need the CA root certificates to import them. Afterwards, you need validate a client certificate against this keystore, so the client cert must have a sign from a CA inside it. Then we're going to validate the cert asking to the keystore if the client cert exists inside it, first look for the same CA root that the client cert have and if this CA root exists then we will look for final client cert, and if this certificate exists then the process will be ok.
This is the process more or less, I'm sorry if I can't explain me better, so you can read more of this in the java tutorial or the JSSE tutorial, or JCE tutorial.
If you have installed J2SE in your machine, you will see the keystore in C:\Documents and Settings\<your_user>\.keystore
and c:\j2sdk1.4.1_02\jre\lib\security\cacert
This is my code, works, but I need do finish it:
package autenticacion;
import java.security.KeyStore;
import java.security.Security;
import java.security.cert.CertificateFactory;
import java.security.cert.X509Certificate;
import java.util.*;
import com.novell.ldap.LDAPConnection;
import com.novell.ldap.LDAPException;
import com.novell.ldap.LDAPJSSESecureSocketFactory;
import com.sun.net.ssl.SSLContext;
import java.io.*;
public class TestCert {
KeyStore keyStore;
String keyStorePath;
char[] keyStorePassword;
public TestCert(){
     this.keyStore = null;
     this.keyStorePath = "";
     this.keyStorePassword = null;
public TestCert(KeyStore keyStore, String keyStorePath, char[] keyStorePassword){
     this.keyStore = keyStore;
     this.keyStorePath = keyStorePath;
     this.keyStorePassword = keyStorePassword;
public static void main( String[] args )
     FileInputStream keyStoreIStream = null;
try
String keyStorePath = "D:/JAVA/j2sdk1.4.1_02/jre/lib/security/cacerts";//"c:/Documents and Settings/instalador/.keystore";
char[] keyStorePassword = "changeit".toCharArray();//"password".toCharArray();
String pathFileName = "c:/mykeyFile.cert";
//dynamically set SunJSSE as a security provider
Security.addProvider(new com.sun.net.ssl.internal.ssl.Provider());
// Open the keystore file.
try
// Open the stream to read in the keystore.
keyStoreIStream = new FileInputStream(keyStorePath);
catch( FileNotFoundException e )
// If the path does not exist then a null stream means
// the keystore is initialized empty. If an untrusted
// certificate chain is trusted by the user, then it will be
// saved in the file pointed to by keyStorePath.
keyStoreIStream = null;
// Create a KeyStore Object
KeyStore keyStore = KeyStore.getInstance(KeyStore.getDefaultType());
// Init the Keystore with the contents of the keystore file.
// If the input stream is null the keystore is initialized empty.
keyStore.load(keyStoreIStream, keyStorePassword);
// Close keystore input stream
if(keyStoreIStream != null)
keyStoreIStream.close();
keyStoreIStream = null;
          //Array en el que se guardan todos los certificados que nos envien.
               //X509Certificate[] chain = (X509Certificate[]) request.getAttribute("java.security.cert.X509Certificate");
//isChainTrusted
               TestCert test = new TestCert( keyStore, keyStorePath, keyStorePassword );
               X509Certificate[] cert = test.getCertFromFile(pathFileName);
               test.getAcceptedIssuers();
               System.out.println(test.isChainTrusted(cert));
catch( Exception e )
     e.printStackTrace();
System.out.println( "main Error: " + e.toString() );
} finally{
     try{
          if(keyStoreIStream!=null){
               keyStoreIStream.close();
     }catch( Exception e){
          e.printStackTrace();
     System.out.println( "main Error: " + e.toString() );
// getAcceptedIssuers retrieves all of the certificates in the keyStore
// and returns them in an X509Certificate array.
public X509Certificate[] getAcceptedIssuers()
X509Certificate[] X509Certs = null;
try
// See how many certificates are in the keystore.
int numberOfEntry = keyStore.size();
// If there are any certificates in the keystore.
if(numberOfEntry > 0)
// Create an array of X509Certificates
X509Certs = new X509Certificate[numberOfEntry];
// Get all of the certificate alias out of the keystore.
Enumeration aliases = keyStore.aliases();
// Retrieve all of the certificates out of the keystore
// via the alias name.
int i = 0;
while (aliases.hasMoreElements())
     String alias = (String)aliases.nextElement();
System.out.println(alias);
X509Certs[i] = (X509Certificate)keyStore.getCertificate(alias);
System.out.println(X509Certs);
i++;
catch( Exception e )
System.out.println( "getAcceptedIssuers Exception: "
+ e.toString() );
X509Certs = null;
return X509Certs;
// isChainTrusted searches the keyStore for any certificate in the
// certificate chain.
private boolean isChainTrusted(X509Certificate[] chain)
boolean trusted = false;
try
// Start with the root and see if it is in the Keystore.
// The root is at the end of the chain.
for (int i = chain.length - 1; i >= 0; i-- )
if (keyStore.getCertificateAlias(chain[i]) != null)
trusted = true;
break;
catch( Exception e )
System.out.println( "isChainTrusted Exception: "
+ e.toString() );
trusted = false;
return trusted;
* Obtiene el certificado de un fichero y lo pasa a un objeto de la clase X509Certificate.
private X509Certificate[] getCertFromFile(String filename){
          X509Certificate chain[] = null;
          FileInputStream fis = null;
          try{
          //The following example parses a PKCS#7-formatted certificate reply stored in a file and extracts all the certificates from it:
          Vector v = new Vector();
          fis = new FileInputStream(filename);
          CertificateFactory cf = CertificateFactory.getInstance("X.509");
          Collection c = cf.generateCertificates(fis);
          Iterator i = c.iterator();
          while (i.hasNext()) {
          X509Certificate cert = (X509Certificate)i.next();
          System.out.println(cert);
          v.add(cert);
               chain = new X509Certificate[v.size()];
               chain = (X509Certificate [] ) v.toArray(chain);
          } catch (Exception ex){
               ex.printStackTrace();               
          } finally {
               try{
                    fis.close();
               }catch (Exception ex){
                    ex.printStackTrace();               
          return chain;
If you do finish your code I'd like you tell me something.
Bye.