Java ошибка сертификата

As the various other answers to this question show, there are many different possible causes for this error message. The reason why it is happening to you may be totally different from the reasons why it is happening to me. And unfortunately, the error message is completely failing to point at the actual source of the problem, so it is completely unhelpful in troubleshooting. It is in fact entirely misleading.

So, instead of giving you yet one more from the myriad of possible causes of this error message, what I will do instead is show you how to troubleshoot this problem so as to find out what is causing it in your particular situation.

At work we commonly use the following two commands to enable some software to talk to various servers, for example to enable IntelliJ IDEA to talk to our internal maven repositories:

[Elevated]keytool 
    -printcert -rfc -sslserver maven.services.{our-company}.com:443 > public.crt

[Elevated]keytool
    -import -storepass changeit -noprompt -trustcacerts -alias services.{our-company}.com 
    -keystore libsecuritycacerts -file public.crt

Now, what sometimes happens is that the keytool -printcert command is unable to do its job, either due to misconfiguration, or simply because of temporary connectivity issues, such as the firewall preventing it, the user forgot to start his VPN, whatever. It is a fact of life that this may happen. This is not actually the problem.

The problem is that when the stupid tool encounters such an error, it does not emit the error message to the standard error device, it emits it to the standard output device!

So here is what ends up happening:

• When you execute the first command, you don’t see any error message, so you have no idea that it failed. However, instead of a key, the public.crt file now contains an error message saying keytool error: java.lang.Exception: No certificate from the SSL server.
• When you execute the second command, it reads public.crt and it finds the text of the error message instead of a key in it, so it fails, saying keytool error: java.lang.Exception: Input not an X.509 certificate.

Bottom line is: after keytool -printcert ... > public.crt always dump the contents of public.crt to make sure it is actually a key and not an error message before proceeding to run keytool -import ... -file public.crt

Июн 26, 2018 23:06

При подключении к панели управления SAN свитча Brocade, запускается JAVA-апплет. Итогом запуска получил сообщение:

Для решения этой проблемы необходимо внести изменения в файл java.security. Файл находится в JDK_HOME/jre/lib/security/java.security, обычно это  пути «C:Program FilesJavajre7libsecurity» для 64-битных версий JAVA или «C:Program Files (x86)Javajre7libsecurity» для 32-битных версий.

В этом файле надо поправить строку:

jdk.certpath.disabledAlgorithms=MD2, RSA keySize < 1024

На

jdk.certpath.disabledAlgorithms=MD2, RSA keySize < 256

или просто закомментировать.

Таким образом понижаем уровень безопасности, но получаем возможность работы с Java апплетом.

Problem :
Unable to launch Java applications with  error «Failed to validate certificate, The application will not be executed.» error.
Failed to validate certificate,
The application will not be executed.
sun.security.validator.ValidatorException:
PKIX path validation failed:
java.security.cert.CertPathValidatorException: algorithm constraints
check failed
at sun.security.validator.PKIXValidator.doValidate(Unknown Source)
at sun.security.validator.PKIXValidator.engineValidate(Unknown Source)
in this case i run for brocade san switch

Description:
Starting
with Java/JRE 7u40, Java requires the application (the jar file
executed via jnlp) to be signed by a certificate with a minimum public
key size of 1024 bits.
At this time the Live Health jnlps are
signed with a certificate of less than 1024 bits (we use 512 bits),
causing a security validation failure.

solution :

Changing the value 1024 to 256 solves the issue in eHealth Live clients
(as they are currently signed by a certificate with a 512-bit key). This
change in java.security has to be done by a user with the administrator
role, and java must be restarted in order for changes to take effect.

— edit java security @ : C:Program Files (x86)Javajre1.8.0_181libsecurityjava.security


jdk.certpath.disabledAlgorithms=MD2, MD5, SHA1 jdkCA & usage TLSServer,
    RSA keySize < 1024, DSA keySize < 1024, EC keySize < 224

to :

jdk.certpath.disabledAlgorithms=MD2, MD5, SHA1 jdkCA & usage TLSServer,
    RSA keySize < 256, DSA keySize < 256, EC keySize < 224

==> tested on windows 10 with