wood burning stoves 2.0
The moose likes Security and the fly likes SSLHandshakeException: certificate expired Big Moose Saloon
  Search | Java FAQ | Recent Topics | Flagged Topics | Hot Topics | Zero Replies
Register / Login

JavaRanch » Java Forums » Engineering » Security
Bookmark "SSLHandshakeException: certificate expired" Watch "SSLHandshakeException: certificate expired" New topic

SSLHandshakeException: certificate expired

Vijay Rastogi

Joined: Jun 16, 2004
Posts: 2

We are trying to establish SSL connection to a secure web application from another application and both the applications are
running in WAS4.0.7. We are getting SSLHandShake exception while trying to get the data in https mode but if we make a connection in http mode, we are successfully able to retrieve the data.

javax.net.ssl.SSLHandshakeException: certificate expired
at com.ibm.jsse.be.a(Unknown Source)
at com.ibm.jsse.be.startHandshake(Unknown Source)
at com.ibm.net.ssl.www.protocol.https.b.n(Unknown Source)
at com.ibm.net.ssl.www.protocol.https.p.connect(Unknown Source)
at com.ibm.net.ssl.www.protocol.http.bw.getOutputStream(Unknown Source)
at com.ibm.net.ssl.internal.www.protocol.https.HttpsURLConnection.getOutputStream(Unknown Source)
at com.myapp.net..................

In some of the articles on the net, it is suggested to use the jsse jar provided by sun but we don't have such flexibility to use jsse jar provided by sun.

How to fix this issue.

tommy k. lee

Joined: Jun 16, 2004
Posts: 20
Have you made sure that the System Date / Times on the two machines are consistent? JSSE is extremely sensitive to System Time and Dates inconsistencies.

SCJP,SCJD SCEA, SCWCD, SCBCD<br />OCP DBA 8i / 9i<br />CISSP, PMP, PHR<br />CCNA, CCDA <br /><a href="http://www.certgear.com" target="_blank" rel="nofollow">http://www.certgear.com</a>
Vijay Rastogi

Joined: Jun 16, 2004
Posts: 2
Yes, we do have the consistent Date/Times for the two applications.
Pallav Jakhotiya

Joined: Jun 17, 2004
Posts: 3
Just check for the validity of the certificate.
Your certificate might have expired.
If possible also check the CRLs for the same.


Pallav Jakhotiya
Zachary Clark

Joined: Aug 06, 2004
Posts: 1
When you establish an https connection WAS will use either the certificates in cacerts or DummyServerKeyFile.jks as the client certificates for authentication. It is likely that whichever of these is being used contains an expired certificate. It is also possible the trust store contains an expired certificate, the exception would be thrown in that case too. Check those keystores and remove or update the expired certs. IBM has patches to do this for you I believe.

Steve Ferguson

Joined: Aug 11, 2004
Posts: 1
To clarify, I was fighting with the same issue, and the cert needed to be reloaded in the cacerts within the jdk that ships with WebSphere. Reloading the one in /opt/WebSphere/AppServer/etc/DummyServerTrustFile.jks had no effect on the expired certificate problem. here is where to get the new root certs for verisign and thawte.

Also, for more info on reloading certs, see this ]article

[ August 11, 2004: Message edited by: Steve Ferguson
[ August 11, 2004: Message edited by: Steve Ferguson ]
It is sorta covered in the JavaRanch Style Guide.
subject: SSLHandshakeException: certificate expired
It's not a secret anymore!