Win2k3 AD problem with autoenrolled Server Certificate

Question

Hi there
I was running into some problems using an SSL connection to our company active directory server on the win2k3 plattform. During the SSL Handshake, the AD sends his CertificateChain in which the Server Certificate has marked the alternateSubjectName as critical (inside it is actually the FQDN). Because the RFC says, that all extended fields marked as critical should be known and java 1.5 ssl implementation doesn't, the SSL connection will hang up before the handshake has been made.
Because the AD's certificate was enrolled automatically and my administrator isn't willing to change the certificate, i hung on this problem now for several days.
How can I avoid that this field is unknown an will generate an exception? Do I really have to implement my own PKIXCertPathChecker to do a workaround? Any suggestion is welcome.
Ah and if someone is interested what I am doing: I am using Spring LDAP to do a usermanagement software which has the focus on creating, locking and deleting users. In advance it must be possible to set any password within an administrator account. Spring LDAP is built up on (as far as I know) JNDI.
The field marked as critical is:
[5]: ObjectId: 2.5.29.17 Criticality=true
SubjectAlternativeName [
[DNSName: server.domain.com]]and the exception (from the ssl debug log):
http-10001-1, SEND TLSv1 ALERT:  fatal, description = certificate_unknown
http-10001-1, WRITE: TLSv1 Alert, length = 2
[Raw write]: length = 7
0000: 15 03 01 00 02 02 2E                               .......
http-10001-1, called closeSocket()
http-10001-1, handling exception: javax.net.ssl.SSLHandshakeException: java.security.cert.CertificateException: Certificate contains unsupported critical extensions: [2.5.29.17]
user.SaveAction:persistIfValid() - Unknown error while perstisting object:Unable to communicate with LDAP server; nested exception is javax.naming.CommunicationException: simple bind failed: server.domain.com:
636 [Root exception is javax.net.ssl.SSLHandshakeException: java.security.cert.CertificateException: Certificate contains unsupported critical extensions: [2.5.29.17]]

Answer 1

hi adler_steven
thanks for your advice. I already read those threads some days ago but nothing helped me. I still got the error because of this subjectAlternativeName field. I tried to write an own implementation of PKIXCertPathChecker which can handle the 2.5.29.17 extension. But I cannot hang in the code where i need it (only possible if I overwrite some JNDI classes which I try to avoid because of future updates!). My last hope is now to implement my own SSLSocketFactory.
Or does someone of you know how to make an SSLContext static? ;-)
[edit]
Chronology of my SSL handshake:
-- Client Hello
-- Server Hello, Certificate, Certificate Request, Server Hello Done
-- Client tries to read the Certificate chain from the server, fails because of unknown extension and sends back an Alert (Certificate Unknown) <-- which is a little bit confusing, because in my official exception is written as javax.net.ssl.SSLHandshakeException: java.security.cert.CertificateException: Certificate contains unsupported critical extensions: [2.5.29.17]
[edit]
Edited by: AnAnAsbAnAnAshAkAr on Oct 11, 2007 8:55 AM