1

I am getting below exception while connecting to HTTPS service.

I have cross checked in multiple forums and understood that the algorithm used in the server might be less secured paring to the standards of Java1.8.

Also by commenting "jdk.certpath.disabledAlgorithms" property in "Java\jdk1.8.0_51\jre\lib\security\java.security" file we could enable the disabled algorithms. But it didn't help, getting same error even after commenting it out.

Other Analyzed points:

  • Updated the unlimited strength local policy jar file.
  • Able to connect to the service with the stand-alone program from same machine.
  • Able to connect to the service from stand-alone program even "jdk.certpath.disabledAlgorithms" property is enabled.

My code uses an self-signed certificate to connect to the HTTPS connections, is the algorithm in that certificate will over ride the default java properties? Any other possibility for below exception?

javax.net.ssl.SSLHandshakeException: java.security.cert.CertificateException: Certificates does not conform to algorithm constraints
at sun.security.ssl.Alerts.getSSLException(Alerts.java:192) ~[na:1.8.0_51]
at sun.security.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1949) ~[na:1.8.0_51]
at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:302) ~[na:1.8.0_51]
at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:296) ~[na:1.8.0_51]
at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1497) ~[na:1.8.0_51]
at sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:212) ~[na:1.8.0_51]
at sun.security.ssl.Handshaker.processLoop(Handshaker.java:979) ~[na:1.8.0_51]
at sun.security.ssl.Handshaker.process_record(Handshaker.java:914) ~[na:1.8.0_51]
at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1062) ~[na:1.8.0_51]
at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1375) ~[na:1.8.0_51]
at sun.security.ssl.SSLSocketImpl.writeRecord(SSLSocketImpl.java:747) ~[na:1.8.0_51]
at sun.security.ssl.AppOutputStream.write(AppOutputStream.java:123) ~[na:1.8.0_51]
at java.io.BufferedOutputStream.flushBuffer(BufferedOutputStream.java:82) ~[na:1.8.0_51]
at java.io.BufferedOutputStream.write(BufferedOutputStream.java:121) ~[na:1.8.0_51]
at org.apache.commons.httpclient.WireLogOutputStream.write(WireLogOutputStream.java:68) ~[commons-httpclient-3.1.jar:na]
at org.apache.commons.httpclient.methods.multipart.FilePart.sendData(FilePart.java:223) ~[commons-httpclient-3.1.jar:na]
at org.apache.commons.httpclient.methods.multipart.Part.send(Part.java:312) ~[commons-httpclient-3.1.jar:na]
at org.apache.commons.httpclient.methods.multipart.Part.sendParts(Part.java:385) ~[commons-httpclient-3.1.jar:na]
at org.apache.commons.httpclient.methods.multipart.MultipartRequestEntity.writeRequest(MultipartRequestEntity.java:164) ~[commons-httpclient-3.1.jar:na]
at org.apache.commons.httpclient.methods.EntityEnclosingMethod.writeRequestBody(EntityEnclosingMethod.java:499) ~[commons-httpclient-3.1.jar:na]
at org.apache.commons.httpclient.HttpMethodBase.writeRequest(HttpMethodBase.java:2114) ~[commons-httpclient-3.1.jar:na]
at org.apache.commons.httpclient.HttpMethodBase.execute(HttpMethodBase.java:1096) ~[commons-httpclient-3.1.jar:na]
at org.apache.commons.httpclient.HttpMethodDirector.executeWithRetry(HttpMethodDirector.java:398) ~[commons-httpclient-3.1.jar:na]
at org.apache.commons.httpclient.HttpMethodDirector.executeMethod(HttpMethodDirector.java:171) ~[commons-httpclient-3.1.jar:na]
at org.apache.commons.httpclient.HttpClient.executeMethod(HttpClient.java:397) ~[commons-httpclient-3.1.jar:na]
at org.apache.commons.httpclient.HttpClient.executeMethod(HttpClient.java:323) ~[commons-httpclient-3.1.jar:na]
AakashM
  • 62,551
  • 17
  • 151
  • 186
TikTik
  • 347
  • 2
  • 8
  • 22
  • Possible duplicate of [java.security.cert.CertificateException: Certificates does not conform to algorithm constraints](http://stackoverflow.com/questions/14149545/java-security-cert-certificateexception-certificates-does-not-conform-to-algori) – ryenus Dec 01 '16 at 04:56

1 Answers1

0

Your problem might be

"My code uses an self-signed certificate to connect to the HTTPS connections"

Don't use self signed certificate or if you must then make it trusted on server and client side.

pepo
  • 8,644
  • 2
  • 27
  • 42
  • I have also tried by using actual certificate instead self-signed, still getting same exception – TikTik Jul 06 '16 at 05:25
  • @Selva And these certificates came from a trusted CA, right? If not import CA certificates to appropriate (intermediate/root) java cert store. – pepo Jul 06 '16 at 20:27
  • Yes, these certificates are trusted CA – TikTik Jul 08 '16 at 10:24