Using HttpClient to POST to Form but Getting SSLPeerUnverifiedException yet browser Works Fine

Question

Using HttpClient 4.1.0, we're trying to connect to a remote server that normally would be connected to using a form. By the way, this will be for production use but I would not call the information we're sending sensitive. I'm not sure if they will insist on an https connection anyway.

When we try to call httpClient.execute(httpPost), it throws a SSLPeerUnverifiedException

We're creating a DefaultHttpClient using a ThreadSafeClientConnManager and have verified that the https registry is associated with a SSLSocketFactory.

We're connecting to a url like this: https://some.thingchangedtoprotectthem.com/servlet/servlet.Something

Why would the browser work like a charm, but using a server side process blows up with that exception? Is it because the browser comes with verisign certificates and HttpClient does not?

System.out and Stack trace below:
    schemeSocketFactory = org.apache.http.conn.ssl.SSLSocketFactory
    javax.net.ssl.SSLPeerUnverifiedException: peer not authenticated
          at com.sun.net.ssl.internal.ssl.SSLSessionImpl.getPeerCertificates(SSLSessionImpl.java:345)
          at org.apache.http.conn.ssl.AbstractVerifier.verify(AbstractVerifier.java:128)
          at org.apache.http.conn.ssl.SSLSocketFactory.connectSocket(SSLSocketFactory.java:390)
          at org.apache.http.impl.conn.DefaultClientConnectionOperator.openConnection(DefaultClientConnectionOperator.java:148)
          at org.apache.http.impl.conn.AbstractPoolEntry.open(AbstractPoolEntry.java:149)
          at org.apache.http.impl.conn.AbstractPooledConnAdapter.open(AbstractPooledConnAdapter.java:121)
          at org.apache.http.impl.client.DefaultRequestDirector.tryConnect(DefaultRequestDirector.java:562)
          at org.apache.http.impl.client.DefaultRequestDirector.execute(DefaultRequestDirector.java:415)
          at org.apache.http.impl.client.AbstractHttpClient.execute(AbstractHttpClient.java:820)
          at org.apache.http.impl.client.AbstractHttpClient.execute(AbstractHttpClient.java:754)
          at org.apache.http.impl.client.AbstractHttpClient.execute(AbstractHttpClient.java:732)

After thinking about this more, there may be one or two items they want secure but I will check on that. I may change my strategy entirely. — finneycanhelp, May 29 '11 at 17:56

score 2 · Accepted Answer · edited May 23 '17 at 11:55

2

Yes indeed. You should to have a look at this blog post where the author describes how to download and install a certificate in your keystore. It's written as an article for Android developers, but it most definitely applies to your case.

Worst case, this question will tell you how to trust all certificates, though that's not a very good idea. ;)

edited May 23 '17 at 11:55

Community

1
1

answered May 29 '11 at 16:48

stevevls

10,675
1
45
50

score 1 · Answer 2 · answered May 29 '11 at 16:45

1

"Is it because the browser comes with verisign certificates and HttpClient does not?"

Almost certainly.

See this message for ideas on how to fix it.

answered May 29 '11 at 16:45

Nemo

70,042
10
116
153

Using HttpClient to POST to Form but Getting SSLPeerUnverifiedException yet browser Works Fine

2 Answers2