2

I went through most of the questions on SSLPeerUnverifiedException: No peer certificate on SO, but could not find a solution for my problem. Most of the solution either provide a custom Trust Manager to accept all SSL certificate or provide a custom keystore with default certificates + my server's certificate and allow that. But my problem is different.

I get javax.net.ssl.SSLPeerUnverifiedException: No peer certificate when I use HttpClient I have also tried doing 

    public HttpClient createHttpClient()
    {
        HttpParams params = new BasicHttpParams();
        HttpProtocolParams.setVersion(params, HttpVersion.HTTP_1_1);
        HttpProtocolParams.setContentCharset(params, HTTP.DEFAULT_CONTENT_CHARSET);
        HttpProtocolParams.setUseExpectContinue(params, true);

        SchemeRegistry schReg = new SchemeRegistry();
        schReg.register(new Scheme("http", PlainSocketFactory.getSocketFactory(), 80));
        schReg.register(new Scheme("https", SSLSocketFactory.getSocketFactory(), 443));
        ClientConnectionManager conMgr = new ThreadSafeClientConnManager(params, schReg);

        return new DefaultHttpClient(conMgr, params);
    }

But my link does open in the browser in my device. (Firefox, Chrome and default browser)

I also get no peer certificate when I test the URL with openssl

$ openssl s_client -connect myserver.com:443
CONNECTED(00000003)
write:errno=104
---
no peer certificate available
---
No client certificate CA names sent
---
SSL handshake has read 0 bytes and written 225 bytes
---
New, (NONE), Cipher is (NONE)
Secure Renegotiation IS NOT supported
Compression: NONE
Expansion: NONE
---

I want to know how does the browser open this link without the certificate.

I also tried the URL with Curl and it does seem to give the response

$ curl -v "https://www.myserver.com/url" -H "Accept:application/json"
* About to connect() to www.myserver.com port 443 (#0)
*   Trying 1XX.XX.XX.XXX... connected
* successfully set certificate verify locations:
*   CAfile: none
  CApath: /etc/ssl/certs
* SSLv3, TLS handshake, Client hello (1):
* SSLv3, TLS handshake, Server hello (2):
* SSLv3, TLS handshake, CERT (11):
* SSLv3, TLS handshake, Server finished (14):
* SSLv3, TLS handshake, Client key exchange (16):
* SSLv3, TLS change cipher, Client hello (1):
* SSLv3, TLS handshake, Finished (20):
* SSLv3, TLS change cipher, Client hello (1):
* SSLv3, TLS handshake, Finished (20):
* SSL connection using AES128-SHA
* Server certificate:
*    subject: C=US; ST=Washington; CN=*.myserver.com
*    start date: 2013-09-16 00:00:00 GMT
*    expire date: 2014-09-24 12:00:00 GMT
*    subjectAltName: myserver.com matched
*    issuer: C=US; O=DigiCert Inc; CN=DigiCert Secure Server CA
*    SSL certificate verify ok.
> GET /url HTTP/1.1
> User-Agent: curl/7.22.0 (x86_64-pc-linux-gnu) libcurl/7.22.0 OpenSSL/1.0.1     zlib/1.2.3.4 libidn/1.23 librtmp/2.3
> Host: myserver.com
> Accept:application/json
> 
< HTTP/1.1 200 OK
< Content-Length: 486
< Content-Type: application/json; charset=utf-8
< Server: Microsoft-HTTPAPI/2.0 Microsoft-HTTPAPI/2.0
< Date: Thu, 19 Sep 2013 12:23:33 GMT
< 
* Connection #0 to host myserver.com left intact
* Closing connection #0
* SSLv3, TLS alert, Client hello (1):
{"My JSON Data"}

Thank you in advance for any help

Aalap
  • 2,847
  • 2
  • 26
  • 24
  • `But my link does open in the browser in my device. (Firefox, Chrome and default browser)` ... but it prolly has red X on https – Selvin Sep 19 '13 at 13:10
  • No it doesn't have a red cross on the corner.. Also I couldn't understand how curl command found the certificate while openssl couldnot.. – Aalap Sep 19 '13 at 17:19
  • 1
    Google for: your exeption + even if cert is valid – Selvin Sep 19 '13 at 17:46
  • 1
    SNI blocks openssl. try: openssl s_client -showcerts -servername myserver.com -connect myserver.com:443. by the way i am having the same problem as you – MitchBroadhead Sep 26 '14 at 13:13
  • I was having the same problem but specifying servername as suggested by MitchBroadhead worked for me. Check this https://major.io/2012/02/07/using-openssls-s_client-command-with-web-servers-using-server-name-indication-sni/ for more information. – Sivachandran Aug 21 '15 at 08:58

0 Answers0