Access Gmail (or a secure website) without getting a PKIX certification path error

Sending email through gmail resulted in a PKIX error. The same goes for sending email from Tomcat.

After resolving the problem , I hope you find this post helpful. This post provides you with a step-by-step diagnosis of these errors.

Step 1 . I tried to solve the problem using this post and another post , but that didn't help me. In most cases this will be enough. You can use keytool to list certificates through "keytool -list -keystore"% JAVA_HOME% / jre / lib / security / cacerts "'

I added the certificate by clicking the gmail URL lock icon and exporting / importing the certificate into the cacert file of my used version of JDK. I could see with keytool -list that the certificate was added. This process is well described in (related) posts.

Step 2A : Did I use the correct trust store? I added JVM arguments for direct certificate lookup, for example -Djavax.net.ssl.trustStore = ".... / jre / lib / security / cacerts" -Djavax.net.ssl.trustStorePassword = "changeit".

Step 2B . When I change the value of the cacerts file in cacertsXYZ, I get an error. Thus, it confirmed that "cacert" was used.

Called: javax.mail.MessagingException: unable to send SMTP host command; nested exception: javax.net.ssl.SSLException: java.lang.RuntimeException: Unexpected error: java.security.InvalidAlgorithmParameterException: trustAnchors parameter must be non-empty

Step 2C . Was this also for my Tomcat web server? I confirmed in the cacerts of my JRE_HOME that the certificate was there. In Tomcat, my JRE_HOME is "C: \ Program Files \ Java \ jdk1.8.0_144 \ jre". My JAVA_HOME = C: \ Program Files \ Java \ jdk1.8.0_144.

3. Java SSLPoke, , Google / smtp.gmail.com. : SSL google.com mail.google.com 443.

try {
            SSLSocketFactory sslsocketfactory = (SSLSocketFactory) SSLSocketFactory.getDefault();
            // **Fail** TLS - SSLSocket sslsocket = (SSLSocket) sslsocketfactory.createSocket("smtp.gmail.com", 587);
            // **Fail** SSL - SSLSocket sslsocket = (SSLSocket) sslsocketfactory.createSocket("smtp.gmail.com", 465);
            // **OK**
            SSLSocket sslsocket = (SSLSocket) sslsocketfactory.createSocket("google.com", 443);
            // OK
            SSLSocket sslsocket2 = (SSLSocket) sslsocketfactory.createSocket("mail.google.com", 443);

            InputStream in = sslsocket.getInputStream();
            OutputStream out = sslsocket.getOutputStream();
            out.write(1); // write test byte to get reaction.
            while (in.available() > 0) {
                System.out.print(in.read());
            }
            System.out.println("Successfully connected");
        } catch (Exception exception) {
            exception.printStackTrace();
        }

4: ? JDK1.8, v152. - . JDK JRE? JRE lib\security\cacerts. SSL (465), TLS (587). .

5: openssl ( s_client -connect smtp.gmail.com:587 -starttls smtp) , (Avast) . , . :

java.lang.RuntimeException: javax.mail.AuthenticationFailedException

6. - virusscanner openssl : CN = Google Internet Authority G3 : num = 20: .

OpenSSL > s_client -connect smtp.gmail.com:587 -starttls smtp CONNECTED (00000280) depth = 1 C = US, O = Google Trust Services, CN = Google Internet Authority G3 : num = 20: .

gmail - google, , , . Google.

7. . (-) . , :

. mkyong .

+4
1
, .

1 - , google/gmail ;-) 1 . CA .. . .

2 - 2 , Java- SSLPoke Java .

3 - , openssl , . 3.

4 - " " Gmail. " gmail" ", . Google

+3

Source: https://habr.com/ru/post/1690175/


All Articles