<div dir="ltr"><br><div class="gmail_extra"><br><br><div class="gmail_quote">On Fri, Mar 7, 2014 at 5:11 PM, Stefan Miklosovic <span dir="ltr"><<a href="mailto:smikloso@redhat.com" target="_blank">smikloso@redhat.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">Hi,<br>
<br>
we are doing HTTPS tests on UPS integration tests where UPS Java client is used to send some payload to UPS, it seems it is not sufficient to have only plain HTTP sender when we are sending it to HTTPS endpoint.<br>
<br>
When JBoss AS is set up with keystore and truststore in https connector for web subsystem like this:<br>
<br>
<connector name="https" protocol="HTTP/1.1" scheme="https" socket-binding="https" secure="true"><br>
<ssl name="aerogear-ssl" key-alias="aerogear"<br>
password="aerogear"<br>
certificate-key-file="${jboss.server.config.dir}/aerogear.keystore"<br>
protocol="ALL"<br>
verify-client="none"<br>
certificate-file="${jboss.server.config.dir}/aerogear.keystore"<br>
ca-certificate-file="${jboss.server.config.dir}/aerogear.truststore"/><br>
</connector><br>
<br>
and UPS Java client sends some payload (with HttpUrlConnection, not secure connection), this exception is thown from it:<br></blockquote><div><br></div><div>I guess we can use, for https, the <span style="font-family:arial,sans-serif;font-size:13px">HttpsUrlConnection - that;s what you are basically asking, right ? </span></div>
<div><span style="font-family:arial,sans-serif;font-size:13px"><br></span></div><div><span style="font-family:arial,sans-serif;font-size:13px">Mind to create PR for that ? </span></div><div><span style="font-family:arial,sans-serif;font-size:13px"><br>
</span></div><div><span style="font-family:arial,sans-serif;font-size:13px">Thanks!</span></div><div><span style="font-family:arial,sans-serif;font-size:13px">Matthias</span></div><div><br></div><div> </div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-color:rgb(204,204,204);border-left-style:solid;padding-left:1ex">
<br>
SEVERE: Send did not succeed: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target<br>
<br>
This basically means that server was not able to mark that connection as trusted.<br>
<br>
In order to use custom trustStore and trustStorePassword, they are propagated to test like system properties<br>
<br>
System.setProperty("javax.net.ssl.trustStore", "aerogear.truststore");<br>
System.setProperty("javax.net.ssl.trustStorePassword", "aerogear");<br>
<br>
however any attempt to set them in test itself like that is not successful since it is "too late". When they are set like -D properties with maven, it is executed without any problems.<br>
<br>
This does not work as well <a href="https://github.com/aerogear/aerogear-unifiedpush-java-client#known-issues" target="_blank">https://github.com/aerogear/aerogear-unifiedpush-java-client#known-issues</a> since we are not using jsse (and can not) because of this issue <a href="https://issues.jboss.org/browse/JBPAPP6-711" target="_blank">https://issues.jboss.org/browse/JBPAPP6-711</a> which was repaired in 7.1.2 and that release is not community release anymore so we can not base tests on EAP and we are running them on 7.1.1. (we can not run them on WF as well since it is not compatible with EAP but 7.1.1 is).<br>
<br>
So this is chicken-egg problem. When verify-client is "none" plain http from UPS Java client is not validated. When we do want client authentication (verify-client=want/true), UPS sender is not https aware. Additionally, we can not use "jsse" due to JBPAPP6-711.<br>
<br>
Ideas?<br>
<br>
Stefan Miklosovic<br>
Red Hat Brno - JBoss Mobile Platform<br>
<br>
e-mail: <a href="mailto:smikloso@redhat.com">smikloso@redhat.com</a><br>
irc: smikloso<br>
_______________________________________________<br>
aerogear-dev mailing list<br>
<a href="mailto:aerogear-dev@lists.jboss.org">aerogear-dev@lists.jboss.org</a><br>
<a href="https://lists.jboss.org/mailman/listinfo/aerogear-dev" target="_blank">https://lists.jboss.org/mailman/listinfo/aerogear-dev</a><br>
</blockquote></div><br><br clear="all"><div><br></div>-- <br>Matthias Wessendorf <br><br>blog: <a href="http://matthiaswessendorf.wordpress.com/" target="_blank">http://matthiaswessendorf.wordpress.com/</a><br>sessions: <a href="http://www.slideshare.net/mwessendorf" target="_blank">http://www.slideshare.net/mwessendorf</a><br>
twitter: <a href="http://twitter.com/mwessendorf" target="_blank">http://twitter.com/mwessendorf</a>
</div></div>