Downloading files from a HTTPS server

[Pranabesh Sinha]

Hi
I want to download a file from a server over https, I get the following error


javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
at com.sun.net.ssl.internal.ssl.Alerts.getSSLException(Unknown Source)
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.fatal(Unknown Source)
at com.sun.net.ssl.internal.ssl.Handshaker.fatalSE(Unknown Source)
at com.sun.net.ssl.internal.ssl.Handshaker.fatalSE(Unknown Source)
at com.sun.net.ssl.internal.ssl.ClientHandshaker.serverCertificate(Unknown Source)
at com.sun.net.ssl.internal.ssl.ClientHandshaker.processMessage(Unknown Source)
at com.sun.net.ssl.internal.ssl.Handshaker.processLoop(Unknown Source)

I have the URL of the file and I use URLConnection.

Thanks

[Sebastian Janisch]

Hello,

please put code, stacktraces etc. in code tags.

Try this approach:

URLConnection connection = new URL("https://domain.com").openConnection();

if(connection instanceof HttpsURLConnection) {
    /*
     * https implementation
     */
} else {
    /*
     * regular implementation
     */
}  

[Pranabesh Sinha]

Hi,
Here is a code that I copied from the web

  /**
 * A simple example that uses HttpClient to perform a GET using Basic
 * Authentication. Can be run standalone without parameters.
 *
 * You need to have JSSE on your classpath for JDK prior to 1.4
 *
 * @author Michael Becke
 */
public class BasicAuthenticationExample {
    
    /**
     * Constructor for BasicAuthenticatonExample.
     */
    public BasicAuthenticationExample() {
        super();
    }
    
    public static void main(String[] args) throws Exception {
        HttpClient client = new HttpClient();
        
       client.getState().setCredentials(
                new AuthScope("an https address", 443),
                new UsernamePasswordCredentials("login id", "password")
                );
        
        GetMethod get = new GetMethod(
                "an https address which points to a file");
        
        get.setDoAuthentication( true );
        
        try {
            // execute the GET
            int status = client.executeMethod( get );
            
            // print the status and response
            System.out.println(status + "\n" + 
                    get.getResponseBodyAsString());
            
        } finally {
            // release any connection resources used by the method
            get.releaseConnection();
        }
    }
}  

Because of line 33 I get this error

  Exception in thread "main" javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
	at com.sun.net.ssl.internal.ssl.Alerts.getSSLException(Unknown Source)
	at com.sun.net.ssl.internal.ssl.SSLSocketImpl.fatal(Unknown Source)
	at com.sun.net.ssl.internal.ssl.Handshaker.fatalSE(Unknown Source)
	at com.sun.net.ssl.internal.ssl.Handshaker.fatalSE(Unknown Source)
	at com.sun.net.ssl.internal.ssl.ClientHandshaker.serverCertificate(Unknown Source)
	at com.sun.net.ssl.internal.ssl.ClientHandshaker.processMessage(Unknown Source)
	at com.sun.net.ssl.internal.ssl.Handshaker.processLoop(Unknown Source)
	at com.sun.net.ssl.internal.ssl.Handshaker.process_record(Unknown Source)
	at com.sun.net.ssl.internal.ssl.SSLSocketImpl.readRecord(Unknown Source)
	at com.sun.net.ssl.internal.ssl.SSLSocketImpl.performInitialHandshake(Unknown Source)
	at com.sun.net.ssl.internal.ssl.SSLSocketImpl.writeRecord(Unknown Source)
	at com.sun.net.ssl.internal.ssl.AppOutputStream.write(Unknown Source)
	at java.io.BufferedOutputStream.flushBuffer(Unknown Source)
	at java.io.BufferedOutputStream.flush(Unknown Source)
	at org.apache.commons.httpclient.HttpConnection.flushRequestOutputStream(HttpConnection.java:828)
	at org.apache.commons.httpclient.HttpMethodBase.writeRequest(HttpMethodBase.java:2116)
	at org.apache.commons.httpclient.HttpMethodBase.execute(HttpMethodBase.java:1096)
	at org.apache.commons.httpclient.HttpMethodDirector.executeWithRetry(HttpMethodDirector.java:398)
	at org.apache.commons.httpclient.HttpMethodDirector.executeMethod(HttpMethodDirector.java:171)
	at org.apache.commons.httpclient.HttpClient.executeMethod(HttpClient.java:397)
	at org.apache.commons.httpclient.HttpClient.executeMethod(HttpClient.java:323)
	at BasicAuthenticationExample.main(BasicAuthenticationExample.java:50)
Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
	at sun.security.validator.PKIXValidator.doBuild(Unknown Source)
	at sun.security.validator.PKIXValidator.engineValidate(Unknown Source)
	at sun.security.validator.Validator.validate(Unknown Source)
	at com.sun.net.ssl.internal.ssl.X509TrustManagerImpl.validate(Unknown Source)
	at com.sun.net.ssl.internal.ssl.X509TrustManagerImpl.checkServerTrusted(Unknown Source)
	at com.sun.net.ssl.internal.ssl.X509TrustManagerImpl.checkServerTrusted(Unknown Source)
	... 18 more
Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
	at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(Unknown Source)
	at java.security.cert.CertPathBuilder.build(Unknown Source)
	... 24 more
  

Now the reason for this error is of course that the certificate sent by my server is not already in my list of trusted certificates.
My question is how to get the certificate into the trusted list.

Thanks

[Pranabesh Sinha]

Hi
I made a mistake in the earlier post, the error occurs due to line 33 not 29.

Thanks

[Rob Spoor]

And what happens if you try to connect using URL, URLConnection and HttpsURLConnection as Sebastian suggested?

[Sunny X Narula]

Hand shake exception is caused due to java not being to handle SSL connections by default.
As per my understanding when you open a secure internet connection over https you need to exchange certificates which the server uses to identify the caller and so that the security of the transferred information can be ensured.
Also this is a session specific thing.
I have had the problem when working with websphere and these are the settings I do to solve it.

// Setting security privilege for https call

Security.setProperty( "ssl.SocketFactory.provider", "com.ibm.jsse2.SSLSocketFactoryImpl");
Security.setProperty( "ssl.ServerSocketFactory.provider", "com.ibm.jsse2.SSLServerSocketFactoryImpl"); 

You need to know who you are talking to and use an appropriate handler. May be there is some sort of generic handler that can be used for all https connections.