Question

I’m trying to authenticate with a server over HTTPS. I’m having problems with the handshake. I think this is due to the fact that when I go to the URL in my browser, a popup box appears. If I cancel that, I can then go to a form which will allow me to login again. The server security is TAM.

Its actually at the start where I’m having problems. When I try to run this code:

        HttpResponse response = httpclient.execute(httpget);

I get an IOException error stating that javax.net.ssl.SSLPeerUnverifiedException: peer not authenticated. The sample code I’m using is from Apache HTTPClient docs. I’ve tried to also use the built in java authentication methods, but I get other problems with the handshake, saying the certificate isn’t trusted.

Anyway, I’m pretty stuck at the moment, which is frustrating because I thought this type of stuff should be basic enough.

So, could someone be so kind as to direct me to some sample code for authentication over HTTPS?

Thanks.

EDIT:
Just to add another error I get when using the built in java http auth, relating to the certificate:

javax.net.ssl.SSLHandshakeException: com.ibm.jsse2.util.g: PKIX path building failed: 
java.security.cert.CertPathBuilderException: PKIXCertPathBuilderImpl could not build a valid CertPath.; internal cause is: 
java.security.cert.CertPathValidatorException: The certificate issued by CN=XXX Internal Root CA, O=XXX Corporation, C=US is not trusted; internal cause is: 
java.security.cert.CertPathValidatorException: Certificate chaining error

Answer 1

The problem here is Windows. Or more specifically the WinInet API, apparently.

I can create a custom TrustManager that accepts all certs, and it can connect fine. Also, if I try my code without the hack on linux, then it works fine. So whatever way Windows handle the keystore is giving me problems.