How to pass ssl certificates with GET REST API call

Question

I have a webserver running on different machine. I am able to use postman client and load cert.pem and key.pem files and successfully do a get request.

Now I want to do this programatically in Java. To do that I added the PKCS12 to keystore as below :

keytool -importkeystore -destkeystore keystore.jks -srcstoretype PKCS12 -srckeystore keystore.p12

keytool -list -keystore keystore.jks

Now in the code I did this:

String url = "https://localhost:9443/server/api/v1/"+id+"/_history/"+history;
URL obj = new URL(url);
System.setProperty("javax.net.ssl.keyStore", "/Users/rc/Downloads/test101/jks/keystore.jks");

System.setProperty("javax.net.ssl.keyStorePassword", "asdfgh");
System.setProperty("javax.net.ssl.keyStoreType", "JKS");            


HttpURLConnection con = (HttpURLConnection) obj.openConnection();

    con.setRequestMethod("GET");

        //add request header
con.setRequestProperty("Content-Type", "application/json");
con.setRequestProperty("Accept", "application/json");

int responseCode = con.getResponseCode();       
System.out.println("\nSending 'GET' request to URL : " + url);      
System.out.println("Response Code : " + responseCode);

I am getting:

  Exception in thread "main" javax.net.ssl.SSLHandshakeException: java.security.cert.CertificateException: No subject alternative DNS name matching localhost found.
at sun.security.ssl.Alerts.getSSLException(Alerts.java:192)
at sun.security.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1959)
at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:302)
at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:296)
at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1514)
at sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:216)
at sun.security.ssl.Handshaker.processLoop(Handshaker.java:1026)
at sun.security.ssl.Handshaker.process_record(Handshaker.java:961)
at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1072)
at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1385)
at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1413)
at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1397)
at sun.net.www.protocol.https.HttpsClient.afterConnect(HttpsClient.java:559)
at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(AbstractDelegateHttpsURLConnection.java:185)
at sun.net.www.protocol.http.HttpURLConnection.getInputStream0(HttpURLConnection.java:1564)
at sun.net.www.protocol.http.HttpURLConnection.getInputStream(HttpURLConnection.java:1492)
at java.net.HttpURLConnection.getResponseCode(HttpURLConnection.java:480)
at sun.net.www.protocol.https.HttpsURLConnectionImpl.getResponseCode(HttpsURLConnectionImpl.java:347)
at com.ibm.fhir.celgene.poc.GetMetadata.main(GetMetadata.java:38)
 Caused by: java.security.cert.CertificateException: No subject alternative DNS name matching localhost found.
at sun.security.util.HostnameChecker.matchDNS(HostnameChecker.java:214)
at sun.security.util.HostnameChecker.match(HostnameChecker.java:96)
at sun.security.ssl.X509TrustManagerImpl.checkIdentity(X509TrustManagerImpl.java:455)
at sun.security.ssl.X509TrustManagerImpl.checkIdentity(X509TrustManagerImpl.java:436)
at sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:200)
at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:124)
at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1496)
... 14 more

SOLUTION:

I have to generate jssecacerts and save it in a particular location. The piece I am missing is in this link:

 http://www.mkyong.com/webservices/jax-ws/suncertpathbuilderexception-unable-to-find-valid-certification-path-to-requested-target/

Answer 1

You are trying to connect via http://, but should use https://. Look at your URL:

String url = "http://localhost:9443/server/api/v1/"+id+"/_history/"+history;

"java.net.SocketException: Unexpected end of file" means that the server accepted and then closed the connection without sending a response. I believe port 9443 for HTTPS connection is not ready to accept HTTP connection.