Re: Certificate is not signed by a trusted certificate authority - ja va error

[Scott Klement <klemscot@xxxxxxxxxxxx>]

On Tue, 11 Nov 2003, Wills, Mike N. (TC) wrote:
>
> I am trying to connect to an internal SSL site with java and keep on getting
> this error:
> com.taylor.docgate.DocgateException: DocgateDAOAImpl.Login.IOException:
> javax.net.ssl.SSLHandshakeException: Certificate is not signed by a trusted
> certificate authority.

Where are you running this Java?   If this is on the iSeries, I believe
that it uses the Digital Certificate Manager to assign certs, set up who
is trusted, etc.

If this is on some other sort of system, then that advice certainly
wouldn't apply. :)


> How do get java to accept our SSL site as a trusted site? We do have a "root
> certificate" for the company.

Not sure what that means.   Every SSL certificate is assigned by a
certificate authority ("CA".)  You can't generate a cert without doing
that...   if your certificate was generated by VeriSign or a similar
service, then they used their own CA certificate, and VeriSign and similar
companies CA certs are usually already installed and trusted.

But any rate, whether or not a certificate is trusted depends on whether
your system trusts the CA.  So, install the CA certificate that you want
trusted into your Digital Cert Mgr.  Then look up that application, and
tell it to trust that CA.


> What we are beginning to think is that java is either not using the right
> cacerts file or it doesn't like the new entry in the file. Can anyone at all
> help me out?

I'm not sure what the 'cacerts' file is, since I always install
certificates using the Digital Cert Mgr, I have no idea what the files are
called.   Or, are we talking about a non-iSeries installation?

I've done SSL in C in both Windows and Unix using OpenSSL, and I've done
SSL on the iSeries in RPG using both GSKit and the SSL_xxx APIs (both of
which use the Digital Cert Mgr) I didn't answer your question on the
Java400 list because I've never done it in Java.   If there's any special
considerations for doing it with Java, I don't know what they are.