RE: Certificate is not signed by a trusted certificate authority - java error

You are right scott. It had to be installed via DCM. We thought you had to
install it through java like all other systems. But apparently the iSeries
is "special" in how it works. Once we installed it through DCM it worked.
Thanks for all the help. 



Mike Wills
Lawson Programmer/Administrator
Taylor Development
Email: mnwills@xxxxxxxxxxxxxx
Direct Line: (507) 625-3187

-----Original Message-----
From: Scott Klement [mailto:klemscot@xxxxxxxxxxxx] 
Sent: Tuesday, November 11, 2003 3:37 PM
To: Midrange Systems Technical Discussion
Subject: Re: Certificate is not signed by a trusted certificate authority -
ja va error



On Tue, 11 Nov 2003, Wills, Mike N. (TC) wrote:
>
> I am trying to connect to an internal SSL site with java and keep on 
> getting this error:
> com.taylor.docgate.DocgateException: DocgateDAOAImpl.Login.IOException:
> javax.net.ssl.SSLHandshakeException: Certificate is not signed by a 
> trusted certificate authority.

Where are you running this Java?   If this is on the iSeries, I believe
that it uses the Digital Certificate Manager to assign certs, set up who is
trusted, etc.

If this is on some other sort of system, then that advice certainly wouldn't
apply. :)


> How do get java to accept our SSL site as a trusted site? We do have a 
> "root certificate" for the company.

Not sure what that means.   Every SSL certificate is assigned by a
certificate authority ("CA".)  You can't generate a cert without doing
that...   if your certificate was generated by VeriSign or a similar
service, then they used their own CA certificate, and VeriSign and similar
companies CA certs are usually already installed and trusted.

But any rate, whether or not a certificate is trusted depends on whether
your system trusts the CA.  So, install the CA certificate that you want
trusted into your Digital Cert Mgr.  Then look up that application, and tell
it to trust that CA.


> What we are beginning to think is that java is either not using the 
> right cacerts file or it doesn't like the new entry in the file. Can 
> anyone at all help me out?

I'm not sure what the 'cacerts' file is, since I always install certificates
using the Digital Cert Mgr, I have no idea what the files are
called.   Or, are we talking about a non-iSeries installation?

I've done SSL in C in both Windows and Unix using OpenSSL, and I've done SSL
on the iSeries in RPG using both GSKit and the SSL_xxx APIs (both of which
use the Digital Cert Mgr) I didn't answer your question on the
Java400 list because I've never done it in Java.   If there's any special
considerations for doing it with Java, I don't know what they are.

_______________________________________________
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list
To post a message email: MIDRANGE-L@xxxxxxxxxxxx To subscribe, unsubscribe,
or change list options,
visit: http://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxx Before posting, please take a
moment to review the archives at http://archive.midrange.com/midrange-l.