Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]

Groups > comp.lang.java.programmer > #34757 > unrolled thread

SSL anomalies

Back to article view | Back to comp.lang.java.programmer

Contents

  SSL anomalies Roedy Green <inquiry@mindprod.com> - 2016-07-05 03:12 -0700
    Re: SSL anomalies Arne Vajhøj <arne@vajhoej.dk> - 2016-07-05 21:51 -0400
      Re: SSL anomalies Roedy Green <inquiry@mindprod.com> - 2016-07-05 20:36 -0700
        Re: SSL anomalies Roedy Green <inquiry@mindprod.com> - 2016-07-06 01:14 -0700
        Re: SSL anomalies Arne Vajhøj <arne@vajhoej.dk> - 2016-07-06 22:42 -0400
      Re: SSL anomalies Roedy Green <inquiry@mindprod.com> - 2016-07-12 08:02 -0700
        Re: SSL anomalies Arne Vajhøj <arne@vajhoej.dk> - 2016-07-12 22:11 -0400

#34757 — SSL anomalies

Java leaves something to be desired in SSL/TLS support. Part of the
problem can be missing root certificates in cacerts. That can be fixed
by tracking down the root certificates and installing them. However,
there are a number of URLs that browsers handle without trouble that
Java for no good reason fails on. Here is a list of some of them. If
you can get them to work under Java, please let me know.

https://www.ashampoo.com/en/cad/pin/7110/burning-software/burning-studio-free
https://handbrake.fr
https://www.htmlvalidator.com/download/registered.php?versionin=110
https://www.meinbergglobal.com/english/sw/ntp.htm
https://tortoisesvn.net

Just do a URLConnection. You don't have to read any bytes, just
connect.
If you want some software to experiment with Java’s SSL , try the
Download utility in the FileTransfer package.
http://mindprod.com/products1.html#FILETRANSFER


Comodo SSL Certificate Analyser
https://sslanalyzer.comodoca.com/
is useful tool to have an detailed look at the certificates.

[toc] | [next] | [standalone]

#34762

On 7/5/2016 6:12 AM, Roedy Green wrote:
> Java leaves something to be desired in SSL/TLS support. Part of the
> problem can be missing root certificates in cacerts. That can be fixed
> by tracking down the root certificates and installing them. However,
> there are a number of URLs that browsers handle without trouble that
> Java for no good reason fails on. Here is a list of some of them. If
> you can get them to work under Java, please let me know.
>
> https://www.ashampoo.com/en/cad/pin/7110/burning-software/burning-studio-free
> https://handbrake.fr
> https://www.htmlvalidator.com/download/registered.php?versionin=110
> https://www.meinbergglobal.com/english/sw/ntp.htm
> https://tortoisesvn.net
>
> Just do a URLConnection. You don't have to read any bytes, just
> connect.

????

All the above works perfect with latest Java 8 except https://handbrake.fr
that throws an exception due to some certificate error.

(it is using a "StartCom Ltd." certificate which I assume
is not that common)

> If you want some software to experiment with Java’s SSL , try the
> Download utility in the FileTransfer package.
> http://mindprod.com/products1.html#FILETRANSFER

Since that code apparently gives errors in more cases
than standard code, then that sounds like a very bad idea.

Arne

[toc] | [prev] | [next] | [standalone]

#34764

On Tue, 5 Jul 2016 21:51:52 -0400, Arne Vajhøj <arne@vajhoej.dk>
wrote:

>
>All the above works perfect with latest Java 8 except https://handbrake.fr
>that throws an exception due to some certificate error.

could I please see the code you are using?

[toc] | [prev] | [next] | [standalone]

#34765

On Tue, 05 Jul 2016 20:36:35 -0700, Roedy Green <inquiry@mindprod.com>
wrote:

>
>could I please see the code you are using?

Here is what I am doing

        final HttpURLConnection urlc = ( HttpURLConnection )
url.openConnection();
            // if this is https: urlc will be a
sun.net.www.protocol.https.DelegateHttpsURLConnection object
            urlc.setAllowUserInteraction( false );
            urlc.setDoInput( true );
            urlc.setDoOutput( false );// nothing beyond original
request
            urlc.setUseCaches( false );
            urlc.setRequestMethod( "GET" );    // <-- vhere we decide
GET, HEAD, POST ectc.
            setStandardProperties( urlc );
            return connectAndProcessResponse( encoding, urlc ); 


    protected void setStandardProperties( URLConnection urlc )
        {
        urlc.setConnectTimeout( connectTimeout );
        urlc.setReadTimeout( readTimeout );
        if ( userAgent != null )
            {
            urlc.setRequestProperty( "User-Agent", userAgent ); 
//    "Mozilla/5.0 (Windows NT 10.0; WOW64; rv:47.0) Gecko/20100101
Firefox/47.00";
            }
        if ( urlc instanceof HttpURLConnection )
            {
            // setFollowRedirects sets default for class.
            ( ( HttpURLConnection ) urlc ).setInstanceFollowRedirects(
followRedirects ); // true
            }
        if ( referer != null )
            {
            // note HTTP spells referrer incorrectly.
            urlc.setRequestProperty( "Referer", referer );
            }
        for ( int i = 0; i < requestProperties.length; i += 2 )
            {
            urlc.setRequestProperty( requestProperties[ i ],
requestProperties[ i + 1 ] );
            }
        urlc.setRequestProperty( "Accept", acceptProperty );
//  "application/octet-stream," +
 "application/x-java-jnlp-file," +
 "application/x-java-serialized-object," +
                                              "application/xhtml+xml,"
+
                                              "application/xml," +
                                              "application/zip," +
                                              "image/gif," +
                                              "image/jpeg," +
                                              "image/png," +
                                              "text/css," +
                                              "text/html," +
                                              "text/plain," +
                                              "text/x-java-source," +
                                              "text/xml," +
                                              "*;q=.2,*/*;q=.2";

        urlc.setRequestProperty( "Accept-Charset", acceptCharset );
 // "iso-8859-1,utf-8,utf-16;q=0.7,*;q=0.3";
        // no deflate, could be added later if we can find code to
handle it.
        urlc.setRequestProperty( "Accept-Encoding", acceptEncoding );
//"gzip,x-gzip,identity";
        // relaxed, prefer English
        final Locale locale = Locale.getDefault();
        // e.g. en-CA,en;q=0.9
        urlc.setRequestProperty( "Accept-Language",
locale.toString().replace( '_', '-' ) + "," +
 locale.getLanguage() + ";q=0.9" );
        }// /method

[toc] | [prev] | [next] | [standalone]

#34767

On 7/5/2016 11:36 PM, Roedy Green wrote:
> On Tue, 5 Jul 2016 21:51:52 -0400, Arne Vajhøj <arne@vajhoej.dk>
> wrote:
>> All the above works perfect with latest Java 8 except https://handbrake.fr
>> that throws an exception due to some certificate error.
>
> could I please see the code you are using?

Sure.

import java.net.HttpURLConnection;
import java.net.URL;

public class Test {
     public static void test(String urlstr) {
         try {
             URL url = new URL(urlstr);
             HttpURLConnection con = (HttpURLConnection) 
url.openConnection();
             con.connect();
             System.out.println(urlstr);
             System.out.println(con.getHeaderFields());
             con.disconnect();
         } catch (Exception e) {
             e.printStackTrace();
         }
     }
     public static void main(String[] args) {
         //test("http://www.vajhoej.dk/");
 
test("https://www.ashampoo.com/en/cad/pin/7110/burning-software/burning-studio-free");
     	test("https://handbrake.fr");
 
test("https://www.htmlvalidator.com/download/registered.php?versionin=110");
     	test("https://www.meinbergglobal.com/english/sw/ntp.htm");
     	test("https://tortoisesvn.net");
     }
}

Arne

[toc] | [prev] | [next] | [standalone]

#34869

On Tue, 5 Jul 2016 21:51:52 -0400, Arne Vajhøj <arne@vajhoej.dk>
wrote:

>
>All the above works perfect with latest Java 8 except https://handbrake.fr
>that throws an exception due to some certificate error.


I discovered that  this seems to be the crucial difference.

 // If you set this false, and the site supports SNI, you will not be
able to connect.
// You have to try it both ways or keep track on a site by site basis
 // System.setProperty( "jsse.enableSNIExtension", "false" );

to be determined if it explains everything.

[toc] | [prev] | [next] | [standalone]

#34873

On 7/12/2016 11:02 AM, Roedy Green wrote:
> On Tue, 5 Jul 2016 21:51:52 -0400, Arne Vajhøj <arne@vajhoej.dk>
> wrote:
>> All the above works perfect with latest Java 8 except https://handbrake.fr
>> that throws an exception due to some certificate error.
>
> I discovered that  this seems to be the crucial difference.
>
>  // If you set this false, and the site supports SNI, you will not be
> able to connect.
> // You have to try it both ways or keep track on a site by site basis
>  // System.setProperty( "jsse.enableSNIExtension", "false" );
>
> to be determined if it explains everything.

To me this is a text book example of something not to set
by default and only set for a specific case when deemed
absolutely necessary.

Arne

[toc] | [prev] | [standalone]

Back to top | Article view | comp.lang.java.programmer

csiph-web