How To Avoid javax.net.ssl.SSLPeerUnverifiedException: peer not authenticated Problem Using Apache HttpClient

How To Avoid javax.net.ssl.SSLPeerUnverifiedException: peer not authenticated Problem Using Apache HttpClient

I use Apache’s HttpClient library for all my URL related needs. It is a marvelous library that does most of the job behind the scenes. Compared the Java’s URL class, it is not as easy to use as Apache’s HttpClient. While using this library, a site that I commonly check for updates threw the exception message javax.net.ssl.SSLPeerUnverifiedException: peer not authenticated.

When I checked the site, it seemed that its SSL certificated had expired. The only workaround for this is to create your own TrustManager. This class actually checks if the SSL certificate is valid. The scheme used by SSL is called X.509 and Java has a specific TrustManager for this scheme, called X509TrustManager.

This handy method created by theskeleton is just the perfect solution to have your HttpClient object bypass any SSL related errors and ensures that it accepts all SSL certificates of a site, whether it is expired or not.

public   static  HttpClient wrapClient(HttpClient base) {
     try  {
        SSLContext ctx  =  SSLContext.getInstance( " TLS " );
        X509TrustManager tm  =   new  X509TrustManager() {
             public   void  checkClientTrusted(X509Certificate[] xcs, String string)  throws  CertificateException { }
 
             public   void  checkServerTrusted(X509Certificate[] xcs, String string)  throws  CertificateException { }
 
             public  X509Certificate[] getAcceptedIssuers() {
                 return   null ;
            }
        };
        ctx.init( null ,  new  TrustManager[]{tm},  null );
        SSLSocketFactory ssf  =   new  SSLSocketFactory(ctx);
        ssf.setHostnameVerifier(SSLSocketFactory.ALLOW_ALL_HOSTNAME_VERIFIER);
        ClientConnectionManager ccm  =  base.getConnectionManager();
        SchemeRegistry sr  =  ccm.getSchemeRegistry();
        sr.register( new  Scheme( " https " , ssf,  443 ));
         return   new  DefaultHttpClient(ccm, base.getParams());
    }  catch  (Exception ex) {
         return   null ;
    }
}

Another way is to recreate the keystore, for the keystore you should have the site in the CN=XXX.
the command as below:
1. Create keystore

keytool -genkey -dname "cn=daXXX.XXX.com,o=,c=" -storepass MB7BROKERpzn -keystore pznKeyStore.jks -alias pznsigned

2. Export the cert
keytool -export -keystore pznKeyStore.jks -alias pznsigned -file pznsslcert.cer
3. Create trust store for client
keytool -genkey -dname "cn=da957203.fmr.com,o=,c=" -storepass MB7BROKERpzn -keystore pznTrustStore.jks -alias pzntrustsigned
4. import the server cert
keytool -import -alias pzntrust -file pznsslcert.cer -keystore pznTrustStore.jks -storepass MB7BROKERpzn
5. use http client to call the server

        try {
            KeyStore trustStore  = KeyStore.getInstance(KeyStore.getDefaultType());
            FileInputStream instream = new FileInputStream(new File(trustfname));
            try {
                trustStore.load(instream, passphrase.toCharArray());
            } finally {
                try { instream.close(); } catch (Exception ignore) {}
            }
            SSLSocketFactory socketFactory = new SSLSocketFactory(trustStore);
            Scheme sch = new Scheme("https", 443, socketFactory);
            httpclient.getConnectionManager().getSchemeRegistry().register(sch);
        } catch (Exception e1) {
            // TODO Auto-generated catch block
            e1.printStackTrace();
        }