3

i have one java program that connects to one server and interacts with that server and does (say hello world) simple task.

my java program is to interact with vmware esxi server. with the following code.

ServiceInstance si = new ServiceInstance(new URL("https://10.100.13.36/sdk"), "root", "teamw0rk", true)

true parameter indicates that the ignore certificate to true.

even it is a vmware interaction the library it is purely a problem with certificate.Because when i put false for ignore certificate. i got the general certificate expectation from the library files.

the program is as follows.

package com.vmware.vim25.mo.samples;

import java.net.URL;
import com.vmware.vim25.*;
import com.vmware.vim25.mo.*;

public class HelloVM 
{
    public static void main(String[] args) throws Exception
    {
        long start = System.currentTimeMillis();
        ServiceInstance si = new ServiceInstance(new URL("https://10.100.13.36/sdk"), "root", "teamw0rk", false);
        long end = System.currentTimeMillis();
        System.out.println("time taken:" + (end-start));
        Folder rootFolder = si.getRootFolder();
        String name = rootFolder.getName();
        System.out.println("root:" + name);
        ManagedEntity[] mes = new InventoryNavigator(rootFolder).searchManagedEntities("VirtualMachine");
        if(mes==null || mes.length ==0)
        {
            return;
        }

        VirtualMachine vm = (VirtualMachine) mes[0]; 

        VirtualMachineConfigInfo vminfo = vm.getConfig();
        VirtualMachineCapability vmc = vm.getCapability();

        vm.getResourcePool();
        System.out.println("Hello " + vm.getName());
        System.out.println("GuestOS: " + vminfo.getGuestFullName());
        System.out.println("Multiple snapshot supported: " + vmc.isMultipleSnapshotsSupported());

        si.getServerConnection().logout();
    }

}

the error is related to expecting the ssl certificate.

Exception in thread "main" java.rmi.RemoteException: VI SDK invoke exception:javax.net.ssl.SSLHandshakeException: java.security.cert.CertificateException: No subject alternative names matching IP address 10.100.13.36 found
    at com.vmware.vim25.ws.WSClient.invoke(WSClient.java:182)
    at com.vmware.vim25.ws.WSClient.invoke(WSClient.java:124)
    at com.vmware.vim25.ws.VimStub.retrieveServiceContent(VimStub.java:1521)
    at com.vmware.vim25.mo.ServiceInstance.<init>(ServiceInstance.java:85)
    at com.vmware.vim25.mo.ServiceInstance.<init>(ServiceInstance.java:69)
    at com.vmware.vim25.mo.samples.HelloVM.main(HelloVM.java:16)

As i confirmed the program error is no relation to vmware and it is related to certificate.

the first step i have done is creating the jks file using the following command 

c:/java/jre/bin>keytool -genkey -keyalg RSA -alias selfsigned -keystore keystore.jks -storepass password -validity 360 -keysize 2048

it creates the keystore.jks in the bin folder.

i have to understand how to refer this keystore.jks in the java program.(i am having less knowledge on this...sorry)

how to generate the certificate and what is the meaning of importing the certificate and exporting the certificate.

In my case do i need to import or export..

Initially i posted the question one person..

he answered as " At high level, you will need the server certificate into your keystore and include the keystore in the JVM parameter"

Please clarify my doubts and throw some light on this..

thank you.

Pratap M
  • 1,059
  • 3
  • 21
  • 31

4 Answers4

1

The error you are getting is complaining that the host name in the URL (10.100.13.36) does not match the any of the server names contained in the server's SSL certificate.

CertificateException: No subject alternative names matching IP address 10.100.13.36 found

Can you retry using the actual server name in your URL request? You may need to use the fully qualified name of the server. As you need to match the name of the server that is contained in the SSL certificate that the server is using.

You can use the curl command to take a look at the server's certificate, for example:

curl -v https://10.100.13.36/sdk

Here's what Microsoft's SSL certificate contains:

C:\>curl -v https://www.microsoft.com
* About to connect() to www.microsoft.com port 443 (#0)
*   Trying 64.4.11.20... connected
* Connected to www.microsoft.com (64.4.11.20) port 443 (#0)
* successfully set certificate verify locations:
*   CAfile: c:\tpf$\bin\curl-ca-bundle.crt
  CApath: none
* SSLv3, TLS handshake, Client hello (1):
* SSLv3, TLS handshake, Server hello (2):
* SSLv3, TLS handshake, CERT (11):
* SSLv3, TLS handshake, Server finished (14):
* SSLv3, TLS handshake, Client key exchange (16):
* SSLv3, TLS change cipher, Client hello (1):
* SSLv3, TLS handshake, Finished (20):
* SSLv3, TLS change cipher, Client hello (1):
* SSLv3, TLS handshake, Finished (20):
* SSL connection using RC4-MD5
* Server certificate:
*        subject: C=US; ST=WA; L=Redmond; O=Microsoft Corporation; OU=MSCOM; CN=
www.microsoft.com
*        start date: 2012-03-29 19:29:53 GMT
*        expire date: 2014-03-29 19:29:53 GMT
*        common name: www.microsoft.com (matched)
*        issuer: DC=com; DC=microsoft; DC=corp; DC=redmond; CN=Microsoft Secure
Server Authority
*        SSL certificate verify ok.
> GET / HTTP/1.1
HeatfanJohn
  • 7,143
  • 2
  • 35
  • 41
  • do you mean my server name is wrongly refered.when i tried with true as ignorecertificate it gives correct results to me.. – Pratap M May 31 '12 at 19:08
  • i tried what you mentioned.my server name is correct. the server name is 10.100.13.36 and get method should use /sdk.. – Pratap M May 31 '12 at 19:09
  • When you ran the keytool command, what did you enter when you were asked "What is your first and last name?" – HeatfanJohn May 31 '12 at 20:37
  • When I ran keytool, the string I entered for that question was used as the CN (Common Name) value in the resulting certificate. Typically, the CN value is the host name of the web server which is what's being validated and is expected to be the IP address that you are placing in your url. – HeatfanJohn May 31 '12 at 20:44
  • I just discovered that keytool in Java 7 supports adding Subject Alternative Names to certificates. The option to add would be: -ext san=ip:10.100.13.36 See http://docs.oracle.com/javase/7/docs/technotes/tools/windows/keytool.html for more information. – HeatfanJohn May 31 '12 at 21:21
  • See http://stackoverflow.com/questions/9185489/x509-subject-alternative-name-subjectaltname-ip-address-field for more information about certificate validation including IP address validation. – HeatfanJohn May 31 '12 at 21:23
  • i tried to find out what is the subjectalt name of server.it is that DNSName=localhost.localdomain – Pratap M Jun 01 '12 at 04:42
  • If you're using Java 7, I recommend recreating the certificate using the `-ext san=ip=10.100.13.36` option. The problem with the existing subject alt name is that localhost.localdomain isn't a valid host name (at least for me on Windows Vista). If you can get just "localhost" then calling the service using `https://localhost` should work. Good luck! – HeatfanJohn Jun 01 '12 at 17:50
  • Thank you...i am able to use the server certificate with jvm environment...(by using importing the certificate of server.) – Pratap M Jun 04 '12 at 10:15
0

Short answer:

First test using DNS name of the server instead of IP (long explanation here).

Second if you want to use the certificate, you will have to import the server certificate, not to generate one by yourself...

pgras
  • 12,614
  • 4
  • 38
  • 46
  • the server is located in my system only..it is private address that (by vmware) acts as its own server.. – Pratap M May 31 '12 at 18:54
0

The certificate is used by Tomcat, not your client. See the Tomcat SSL documentation.

user207421
  • 305,947
  • 44
  • 307
  • 483
  • my real problem is that without importing any certificate when i run the application it is saying the dns name is not identified. how my program can resolve the issue of server name identification...first of all before verifying the certificate our program should identify what is the server name (with https check)....it is unable to identify the dns or ip address..how i sure that using keytool will make the server name to be identified correctly(please remember i should only use import form of keytool...because here i am not generating the certificate..) – Pratap M Jun 01 '12 at 05:38
0

Try adding -dname CN=10.100.13.36 when you generate the certificate. I don't think you even need to use subject alternate names. The common name (CN) should be equal to the domain name you used in the URL to connect.

John Watts
  • 8,717
  • 1
  • 31
  • 35