Mailing-List: contact httpclient-users-help@hc.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "HttpClient User Discussion" <httpclient-users@hc.apache.org>
Received-SPF: pass (nike.apache.org: domain of lists@nabble.com designates
 216.139.236.158 as permitted sender)
Message-ID: <23615152.post@talk.nabble.com>
Date: Tue, 19 May 2009 05:14:03 -0700 (PDT)
From: realflash <flash666@yahoo.com>
To: httpclient-users@hc.apache.org
Subject: Re: using SSL in a development environment
In-Reply-To: <b72ac2190808150921w2783899dqb1aca4a9fc19ee04@mail.gmail.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Transfer-Encoding: 7bit
References: <b72ac2190808150921w2783899dqb1aca4a9fc19ee04@mail.gmail.com>


Bill Higgins-2 wrote:
> 
> Hi I'm working in a development environment where our servers use
> self-signed certificates. I want to use HttpClient 4 to connect to these
> servers and basically ignore any security errors that come back. I was
> hoping I could use org.apache.http.conn.ssl.SSLSocketFactory to do this by
> using SSLSocketFactory's ALLOW_ALL_HOSTNAME_VERIFIER verifier, but it
> failed
> with a javax.net.ssl.SSLPeerUnverifiedException with message "peer not
> authenticated".
> 
> A colleague suggested that I need to create my own implementation of
> LayeredSocketFactory, e.g. "TrustingSSLSocketFactory", but I was hoping
> there was a way to get SSLSocketFactory to work for me, if I could
> configure
> it the right way. Here is the code I am currently using. Please let me
> know
> if there's something simple I can change to use SSLSocketFactory in my
> development environment with servers with self-signed certs.
> 
> PS - I'm using HttpCore 4.0 Beta 2 and HttpClient 4.0 Alpha 4.
> 

For those who want to avoid the factory creation, Howard Abrams has produced
a neat solution to this problem by inserting a new security provider that
ignores cert problems. You just need to add two class files to your project
and call one method and bingo. You may also need to call
ALLOW_ALL_HOSTNAME_VERIFIER if the cert doesn't match the hostname.

http://www.howardism.org/Technical/Java/SelfSignedCerts.html
-- 
View this message in context: http://www.nabble.com/using-SSL-in-a-development-environment-tp19001545p23615152.html
Sent from the HttpClient-User mailing list archive at Nabble.com.


---------------------------------------------------------------------
To unsubscribe, e-mail: httpclient-users-unsubscribe@hc.apache.org
For additional commands, e-mail: httpclient-users-help@hc.apache.org