JAVA - Certificate Exception

[schmetzgilles]

Bonjour,

dans le cadre d'un travail je dois réaliser une application qui semble toute bête, et elle l'est en plus.. qui doit simplement envoyer des requêtes en AXL (XML Cisco) vers un CallManager afin d'en obtenir des informations basiques dans un premier temps.

Alors mon problème réside dans un exception que je n'arrive pas à résoudre:

"Error: java.net.ssl.SSLHandshakeException: java.security.cert.CertificateException: No subject alternative presence"

Ceci se produit quand je tente de m'authentifier sur mon CallManager à l'adresse: [https://x.x.x.x:8443/axl/]

Adresse que je sais accéder en allant via mon browser (Chrome) manuellement.

Pour mon code:

<code>

// Instanciation du service client (créé par wsimport)

        AXLAPIService axlService = new AXLAPIService();

        AXLPort axlPort = axlService.getAXLPort();

        // Création de l'URL et des paramètres pour accéder au service

        urlAxl = "[https://]" + ipHost + ":8443/axl/";

        ((BindingProvider) axlPort).getRequestContext().put(BindingProvider.ENDPOINT_ADDRESS_PROPERTY, urlAxl);

        ((BindingProvider) axlPort).getRequestContext().put(BindingProvider.USERNAME_PROPERTY, adminUsername);

        ((BindingProvider) axlPort).getRequestContext().put(BindingProvider.PASSWORD_PROPERTY, adminPassword);

        GetCallManagerReq axlParams = new GetCallManagerReq();

        taLog.append("\nGetCallManagerReq done");

        axlParams.setName("gsc-cucm-pub");

        taLog.append("\naxlparames done: " + axlParams.getName().toString());

        try{

            GetCallManagerRes getCallManagerResponse = axlPort.getCallManager(axlParams);

            taLog.append("\nProduct =" + getCallManagerResponse.getReturn().getCallManager().getName());

        }catch(Exception exept)

        {

            taLog.append(exept.getMessage());

        }

</code>

Les informations login/password/ip sont correctes et ont été testées manuellement à côté.

J'ai également réalisé l'importation de mon certificat dans mon keystore avec succès via ligne de commande dans ...\Java\jre7\lib\security\cacerts

J'espère que la communauté pourra m'aider, s'il vous faut des infos supplémentaire je suis disponible aussi.

Merci,

Gilles

[amoherek]

Hi Gilles,

I have moved your forum question to the AXL space.

In your code, try adding the text in bold:

using System.Security.Cryptography.X509Certificates;

namespace ConsoleApplication1

{

  class Program

  {

  static void Main(string[] args)

  {

     ServicePointManager.Expect100Continue = false;

Please let me know if this works for you.

Thanks,

Adrienne

[dstaudt]

Also, as AXL uses HTTPS/TLS, be aware that you will need to import the UCM certificate into your local Java's cacerts keystore.

This tutorial has some details on how to import the UCM certificate:

https://developer.cisco.com/site/collaboration/management/axl/learn/how-to/axl-java-sample-application.gsp

[schmetzgilles]

Thank you,

I already try to follow the tutorial on Cisco's link but the problem still persist on the keystore, I actually can't be sure that my keytsore is created as expected... ( keystore -list doesn't run in the cmd )

I'm not at the office for the week-end but I'll let you know on monday.

And Adrienne, the "Expect100Continue", isn't it for a .NET programming? My client application is a Java one... Can you confirm?

Thanks again,

Gilles

ps: Please don't pay attention to my written english, this is clearly not my native language...

[schmetzgilles]

Hi,

The code you gave me deals with .NET application...

I really don't know how to fix my certificate's problems. Also, the exemple are uncomplete on Cisco's siteweb. How to really import the CUCM certificate into a local keystore using Java 7 with .crt files and not .cert?

The thing is the exemple they code can't help, the complex part is hidden...

Thank's for help,

Gilles

[dstaudt]

This link may have some additional clues on Java certificate management and import:

java - How do I find out what keystore my JVM is using? - Stack Overflow

Certificate files exported from Firefox are generally .pem format, I think.

[schmetzgilles · Accepted solution]

Hi,

thanks for the answer, I couldn't understand my exception but it's now solved.

Briefly;

The certificate was well added into my local keystore...

The problem was that the RFC dealing with SSL connection specify that we have to use a hostname and not an ip address to reach the server. The problem was that I had no access to my own server using the hostname, due to an error in the DNS configuration that was not made by myself.

Little problem that couldn't be seen in my IDE..;

Thanks again, problem solved.

Gilles.