Uploaded image for project: 'JDK'
  1. JDK
  2. JDK-7079685

Failure to validate wildcard certificate

XMLWordPrintable

      FULL PRODUCT VERSION :
      java version "1.7.0"
      Java(TM) SE Runtime Environment (build 1.7.0-b147)
      Java HotSpot(TM) 64-Bit Server VM (build 21.0-b17, mixed mode)

      ADDITIONAL OS VERSION INFORMATION :
      Microsoft Windows [Version 6.1.7601]
      x86_64 x86_64 x86_64 GNU/Linux

      EXTRA RELEVANT SYSTEM CONFIGURATION :
      Default installation. No modifications.

      A DESCRIPTION OF THE PROBLEM :
      Java 7 fails to connect to a website with GeoTrust wildcard certificate.
      The same certificate is accepted by Java 5 and 6 and also by all the browsers I tested.
      A sample site which can be tested: https://yossis.artifactoryonline.com
      The certificate Common Name (CN) is: *.artifactoryonline.com

      STEPS TO FOLLOW TO REPRODUCE THE PROBLEM :
      The simplest way to reproduce is to attempt a connection with java.net.URL.


      ERROR MESSAGES/STACK TRACES THAT OCCUR :
      Exception in thread "main" javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
              at sun.security.ssl.Alerts.getSSLException(Unknown Source)
              at sun.security.ssl.SSLSocketImpl.fatal(Unknown Source)
              at sun.security.ssl.Handshaker.fatalSE(Unknown Source)
              at sun.security.ssl.Handshaker.fatalSE(Unknown Source)
              at sun.security.ssl.ClientHandshaker.serverCertificate(Unknown Source)
              at sun.security.ssl.ClientHandshaker.processMessage(Unknown Source)
              at sun.security.ssl.Handshaker.processLoop(Unknown Source)
              at sun.security.ssl.Handshaker.process_record(Unknown Source)
              at sun.security.ssl.SSLSocketImpl.readRecord(Unknown Source)
              at sun.security.ssl.SSLSocketImpl.performInitialHandshake(Unknown Source)
              at sun.security.ssl.SSLSocketImpl.startHandshake(Unknown Source)
              at sun.security.ssl.SSLSocketImpl.startHandshake(Unknown Source)
              at sun.net.www.protocol.https.HttpsClient.afterConnect(Unknown Source)
              at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(Unknown Source)
              at sun.net.www.protocol.https.HttpsURLConnectionImpl.connect(Unknown Source)
              at com.yossis.net.connect.main(connect.java:20)
      Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
              at sun.security.validator.PKIXValidator.doBuild(Unknown Source)
              at sun.security.validator.PKIXValidator.engineValidate(Unknown Source)
              at sun.security.validator.Validator.validate(Unknown Source)
              at sun.security.ssl.X509TrustManagerImpl.validate(Unknown Source)
              at sun.security.ssl.X509TrustManagerImpl.checkTrusted(Unknown Source)
              at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(Unknown Source)
              ... 12 more
      Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
              at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(Unknown Source)
              at java.security.cert.CertPathBuilder.build(Unknown Source)
              ... 18 more

      D:\Work\Josh\connect\target>java.exe -jar connect.jar https://yossis.artifactoryonline.com
      Exception in thread "main" javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
              at sun.security.ssl.Alerts.getSSLException(Unknown Source)
              at sun.security.ssl.SSLSocketImpl.fatal(Unknown Source)
              at sun.security.ssl.Handshaker.fatalSE(Unknown Source)
              at sun.security.ssl.Handshaker.fatalSE(Unknown Source)
              at sun.security.ssl.ClientHandshaker.serverCertificate(Unknown Source)
              at sun.security.ssl.ClientHandshaker.processMessage(Unknown Source)
              at sun.security.ssl.Handshaker.processLoop(Unknown Source)
              at sun.security.ssl.Handshaker.process_record(Unknown Source)
              at sun.security.ssl.SSLSocketImpl.readRecord(Unknown Source)
              at sun.security.ssl.SSLSocketImpl.performInitialHandshake(Unknown Source)
              at sun.security.ssl.SSLSocketImpl.startHandshake(Unknown Source)
              at sun.security.ssl.SSLSocketImpl.startHandshake(Unknown Source)
              at sun.net.www.protocol.https.HttpsClient.afterConnect(Unknown Source)
              at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(Unknown Source)
              at sun.net.www.protocol.https.HttpsURLConnectionImpl.connect(Unknown Source)
              at com.yossis.net.connect.main(connect.java:20)
      Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
              at sun.security.validator.PKIXValidator.doBuild(Unknown Source)
              at sun.security.validator.PKIXValidator.engineValidate(Unknown Source)
              at sun.security.validator.Validator.validate(Unknown Source)
              at sun.security.ssl.X509TrustManagerImpl.validate(Unknown Source)
              at sun.security.ssl.X509TrustManagerImpl.checkTrusted(Unknown Source)
              at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(Unknown Source)
              ... 12 more
      Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
              at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(Unknown Source)
              at java.security.cert.CertPathBuilder.build(Unknown Source)
              ... 18 more


      REPRODUCIBILITY :
      This bug can be reproduced always.

      ---------- BEGIN SOURCE ----------
      import java.io.IOException;
      import java.net.URL;

      public class connect {
          public static void main(String[] args) throws IOException {
              new URL("https://yossis.artifactoryonline.com").openConnection().connect();
          }
      }

      ---------- END SOURCE ----------

            xuelei Xuelei Fan
            webbuggrp Webbug Group
            Votes:
            0 Vote for this issue
            Watchers:
            0 Start watching this issue

              Created:
              Updated:
              Resolved:
              Imported:
              Indexed: