SSL - client side - trusting untrusted certificates?

[Ivan Jouikov]

Basically I have a web-based spider, that works just like any other spider. One problem though � it won�t spider SSL pages that have untrusted certificates. So I was thinking of a good way to make it trust ALL the certificates (since it uses the URL class to read the pages)

So, I researched it and found an �old-fashioned� way to do this � by overriding TrustManager, and making it trust everything, and saving it in SSLContext or something. Basically, it would look like this:





TRUST MANAGER;

package org.ablogic.search;
 
import javax.net.ssl.*;
 
import java.security.cert.CertificateException;
import java.security.cert.X509Certificate;
 
/**
 *
 * @author Ivan Jouikov ([e-mail])
 * @version 0.1
 */
public class AllTrustManager implements X509TrustManager
{
 
public X509Certificate [] getAcceptedIssuers()
{
return new X509Certificate[0];
}
 
public void checkClientTrusted( X509Certificate [] arg0, String arg1 )
throws CertificateException
{
}
 
public void checkServerTrusted( X509Certificate [] arg0, String arg1 )
throws CertificateException
{
}
}
 

Custom socket factory:

package org.ablogic.search;
 
import java.io.IOException;
import java.net.InetAddress;
import java.net.Socket;
 
import javax.net.SocketFactory;
import javax.net.ssl.SSLContext;
import javax.net.ssl.SSLSocketFactory;
import javax.net.ssl.TrustManager;
 
/**
 *import com.sun.net.ssl.*;
 * @author Ivan Jouikov ([e-mail])
 * @version 0.1
 */
public class AllTrustSSLSocketFactory extends SSLSocketFactory
{
private SSLSocketFactory factory;
 
public AllTrustSSLSocketFactory()
{
System.out.println( "DummySocketFactory instantiated" );
try
{
SSLContext sslcontext = SSLContext.getInstance( "TLS" );
sslcontext.init( null, // No KeyManager required
new TrustManager[]
{new AllTrustManager()}, new java.security.SecureRandom() );
factory = (SSLSocketFactory) sslcontext.getSocketFactory();
 
} catch ( Exception ex )
{
ex.printStackTrace();
}
}
 
public static SocketFactory getDefault()
{
return new AllTrustSSLSocketFactory();
}
 
public Socket createSocket( Socket socket, String s, int i, boolean flag )
throws IOException
{
return factory.createSocket( socket, s, i, flag );
}
 
public Socket createSocket( InetAddress inaddr, int i, InetAddress inaddr1,
int j ) throws IOException
{
return factory.createSocket( inaddr, i, inaddr1, j );
}
 
public Socket createSocket( InetAddress inaddr, int i ) throws IOException
{
return factory.createSocket( inaddr, i );
}
 
public Socket createSocket( String s, int i, InetAddress inaddr, int j )
throws IOException
{
return factory.createSocket( s, i, inaddr, j );
}
 
public Socket createSocket( String s, int i ) throws IOException
{
return factory.createSocket( s, i );
}
 
public String [] getDefaultCipherSuites()
{
return factory.getSupportedCipherSuites();
}
 
public String [] getSupportedCipherSuites()
{
return factory.getSupportedCipherSuites();
}
}

And here�s the sample code that I would use to test this:

import java.io.BufferedReader;
import java.io.InputStreamReader;
import java.net.URL;
import java.security.Security;
 
/**
 *
 * @author Ivan Jouikov ([e-mail])
 * @version 0.1
 */
public class Test
{
public static void main( String [] args ) throws Exception
{
 Security.setProperty( "ssl.SocketFactory.provider","org.ablogic.search.AllTrustSSLSocketFactory");
 
// Create a URL for the desired page
        URL url = new URL("https://www.royaleskincare.com");
    
        // Read all the text returned by the server
        BufferedReader in = new BufferedReader(new InputStreamReader(url.openStream()));
        String str;
        while ((str = in.readLine()) != null)
            System.out.println(str);
        in.close();
}
}

The only �real� piece here is the �Security.setProperty�, which sort of replaces default socket factory with my crappy implementation.

I believe this used to work back on 1.4.2, but I am running 1.5, and here�s the problem that I get when executing the following code:

DummySocketFactory instantiated
Exception in thread "main" java.io.IOException: HTTPS hostname wrong:  should be <www.royaleskincare.com>
at sun.net.www.protocol.https.HttpsClient.checkURLSpoofing(HttpsClient.java:493)
at sun.net.www.protocol.https.HttpsClient.afterConnect(HttpsClient.java:418)
at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(AbstractDelegateHttpsURLConnection.java:170)
at sun.net.www.protocol.http.HttpURLConnection.getInputStream(HttpURLConnection.java:837)
at sun.net.www.protocol.https.HttpsURLConnectionImpl.getInputStream(HttpsURLConnectionImpl.java:234)
at java.net.URL.openStream(URL.java:1007)
at org.ablogic.search.Test.main(Test.java:28)

Any thoughts on how I could fix the �HttpsClient� to make it accept invalid certificates? Going back to 1.4.2 is not an option�

Thanks in advance for your help.



________________________________________
Best Regards,

Ivan V. Jouikov
[phone]