Errors when using HttpsURLConnection

[Kurt Kopf]

I think this is just an easy configuration issue, but so far I've had no luck searching...

Java 1.6 x64
Eclipse Helios x64
Tomcat 6.0.26
Windows 7 Ult x64 and Mac OS X

I'm building an app that executes facebook graph requests (which are required to go over https). The code that I have works on my OS X box, but not on my Win7 machines. I have JAVA_HOME pointed to the jdk install directory (not the JRE inside of that).

At first, I was getting the following exception:

java.security.InvalidAlgorithmParameterException: the trustAnchors parameter must be non-empty
	java.security.cert.PKIXParameters.setTrustAnchors(PKIXParameters.java:183)
	java.security.cert.PKIXParameters.<init>(PKIXParameters.java:103)
	java.security.cert.PKIXBuilderParameters.<init>(PKIXBuilderParameters.java:87)
	sun.security.validator.PKIXValidator.<init>(PKIXValidator.java:57)
	sun.security.validator.Validator.getInstance(Validator.java:161)
	com.sun.net.ssl.internal.ssl.X509TrustManagerImpl.getValidator(X509TrustManagerImpl.java:108)
	com.sun.net.ssl.internal.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:204)
	com.sun.net.ssl.internal.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:249)
	com.sun.net.ssl.internal.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1053)
	com.sun.net.ssl.internal.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:128)
	com.sun.net.ssl.internal.ssl.Handshaker.processLoop(Handshaker.java:529)
	com.sun.net.ssl.internal.ssl.Handshaker.process_record(Handshaker.java:465)
	com.sun.net.ssl.internal.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:884)
	com.sun.net.ssl.internal.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1120)
	com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1147)
	com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1131)
	sun.net.www.protocol.https.HttpsClient.afterConnect(HttpsClient.java:434)
	sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(AbstractDelegateHttpsURLConnection.java:166)
	sun.net.www.protocol.http.HttpURLConnection.getInputStream(HttpURLConnection.java:1049)
	java.net.HttpURLConnection.getResponseCode(HttpURLConnection.java:373)
	sun.net.www.protocol.https.HttpsURLConnectionImpl.getResponseCode(HttpsURLConnectionImpl.java:318)
...

After adding the following to one of my loaded .properties files, the situation improved slightly:

javax.net.ssl.trustStore=C:\\Program Files\\Java\\jdk1.6.0_20\\jre\\lib\\security\\cacerts

Now I'm getting the following:

java.lang.NoClassDefFoundError: Could not initialize class javax.crypto.SunJCE_b
	javax.crypto.KeyGenerator.a(DashoA13*..)
	javax.crypto.KeyGenerator.<init>(DashoA13*..)
	javax.crypto.KeyGenerator.getInstance(DashoA13*..)
	com.sun.net.ssl.internal.ssl.JsseJce.getKeyGenerator(JsseJce.java:223)
	com.sun.net.ssl.internal.ssl.RSAClientKeyExchange.<init>(RSAClientKeyExchange.java:89)
	com.sun.net.ssl.internal.ssl.ClientHandshaker.serverHelloDone(ClientHandshaker.java:673)
	com.sun.net.ssl.internal.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:230)
	com.sun.net.ssl.internal.ssl.Handshaker.processLoop(Handshaker.java:529)
	com.sun.net.ssl.internal.ssl.Handshaker.process_record(Handshaker.java:465)
	com.sun.net.ssl.internal.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:884)
	com.sun.net.ssl.internal.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1120)
	com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1147)
	com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1131)
	sun.net.www.protocol.https.HttpsClient.afterConnect(HttpsClient.java:434)
	sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(AbstractDelegateHttpsURLConnection.java:166)
	sun.net.www.protocol.http.HttpURLConnection.getInputStream(HttpURLConnection.java:1049)
	java.net.HttpURLConnection.getResponseCode(HttpURLConnection.java:373)
	sun.net.www.protocol.https.HttpsURLConnectionImpl.getResponseCode(HttpsURLConnectionImpl.java:318)
...

Of course the JCE and JSSE jars are in the JAVA_HOME/jre/lib dir, and Eclipse has them listed with my selected JRE.

So my first obvious question is, how do I fix this and what am I missing here?

Second, what's different between the default installations/configurations of the above software on these two different OS's?

Thanks in advance for any help.

[Kurt Kopf]

Attempted to switch to BouncyCastle JCE implementation by doing the following:

Security.insertProviderAt(new BouncyCastleProvider(), 0);

and now getting the error:

java.lang.SecurityException: Cannot locate policy or framework files!
	javax.crypto.SunJCE_b.i(DashoA13*..)
	javax.crypto.SunJCE_b.g(DashoA13*..)
	javax.crypto.SunJCE_b$1.run(DashoA13*..)
	java.security.AccessController.doPrivileged(Native Method)
	javax.crypto.SunJCE_b.<clinit>(DashoA13*..)
	javax.crypto.KeyAgreement.getInstance(DashoA13*..)
	com.sun.net.ssl.internal.ssl.JsseJce.getKeyAgreement(JsseJce.java:241)
	com.sun.net.ssl.internal.ssl.JsseJce.isEcAvailable(JsseJce.java:158)
	com.sun.net.ssl.internal.ssl.CipherSuite$KeyExchange.isAvailable(CipherSuite.java:271)
	com.sun.net.ssl.internal.ssl.CipherSuite.isAvailable(CipherSuite.java:143)
	com.sun.net.ssl.internal.ssl.CipherSuiteList.buildAvailableCache(CipherSuiteList.java:210)
	com.sun.net.ssl.internal.ssl.CipherSuiteList.getDefault(CipherSuiteList.java:233)
	com.sun.net.ssl.internal.ssl.SSLSocketImpl.init(SSLSocketImpl.java:508)
	com.sun.net.ssl.internal.ssl.SSLSocketImpl.<init>(SSLSocketImpl.java:451)
	com.sun.net.ssl.internal.ssl.SSLSocketFactoryImpl.createSocket(SSLSocketFactoryImpl.java:56)
	sun.net.www.protocol.https.HttpsClient.createSocket(HttpsClient.java:362)
	sun.net.NetworkClient.doConnect(NetworkClient.java:145)
	sun.net.www.http.HttpClient.openServer(HttpClient.java:394)
	sun.net.www.http.HttpClient.openServer(HttpClient.java:529)
	sun.net.www.protocol.https.HttpsClient.<init>(HttpsClient.java:272)
	sun.net.www.protocol.https.HttpsClient.New(HttpsClient.java:329)
	sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.getNewHttpClient(AbstractDelegateHttpsURLConnection.java:172)
	sun.net.www.protocol.http.HttpURLConnection.plainConnect(HttpURLConnection.java:801)
	sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(AbstractDelegateHttpsURLConnection.java:158)
	sun.net.www.protocol.http.HttpURLConnection.getInputStream(HttpURLConnection.java:1049)
	java.net.HttpURLConnection.getResponseCode(HttpURLConnection.java:373)
	sun.net.www.protocol.https.HttpsURLConnectionImpl.getResponseCode(HttpsURLConnectionImpl.java:318)

Not sure if that helps, but I'm focusing on getting BouncyCastle to work instead at the moment.

[Kurt Kopf]

Actually think I got the BouncyCastle provider working... looks like my java.home property was set incorrectly (set to <jdk>/jre/lib when it should have been <jdk>/jre).

I'm still trying to figure out the original issue with the default JCE.

[Kurt Kopf]

After further testing, it also appears that fixing my "java.home" path in my properties file fixed the default JCE implementation as well.

Hopefully this helps someone else out there

[Jacob Anawalt]

I experienced "the trustAnchors parameter must be non-empty" today using OpenJDK 6 on Debian 5.0. The "java-6-sun" package ran just fine, but the "java-6-openjdk" package java failed. The OpenJDK default trustStore jre/lib/security/cacerts file is missing [0]. I just switched to using java-6-sun instead of fixing the cacerts file for OpenJDK.

[0] http://download.oracle.com/javase/1.4.2/docs/guide/security/jsse/JSSERefGuide.html#X509TrustManager