Jersey with self signed certificate - jersey

Question

I am currently working in a dev environment where we are using self signed certificates. I've been trying for a little over a day now to get jersey to ignore the self signed certificate. This is purely for a POC environment, I wouldn't dream of doing thi sin production. While I've found many answers on the interweb about how to make this work, something is still off.
Here's my current test class:
public class JerseyTestClient {
private static final Logger LOG = Logger.getLogger(JerseyTestClient.class.getName());
public static void sendTestRequest() {
try {
Client client = Client.create(configureClient());
WebResource webResource = client.resource("https://server/endpoint/");
ClientResponse response = webResource.accept("application/json").get(ClientResponse.class);
if (response.getStatus() != 200) {
throw new RuntimeException("Failed : HTTP error code : " + response.getStatus());
}
List<Hardware> output = response.getEntity(new GenericType<List<Hardware>>() {});
LOG.severe("Output from Server .... \n");
LOG.severe("Nr of entries: " + output.size());
} catch (Exception e) {
LOG.log(Level.SEVERE, " test request failed", e);
}
}
public static ClientConfig configureClient() {
TrustManager[ ] certs = new TrustManager[ ] {
new X509TrustManager() {
#Override
public X509Certificate[] getAcceptedIssuers() {
LOG.severe("getAcceptedIssuers");
return null;
}
#Override
public void checkServerTrusted(X509Certificate[] chain, String authType)
throws CertificateException {
LOG.severe("checkServerTrusted");
}
#Override
public void checkClientTrusted(X509Certificate[] chain, String authType)
throws CertificateException {
LOG.severe("checkClientTrusted");
}
}
};
SSLContext ctx = null;
try {
ctx = SSLContext.getInstance("TLS");
ctx.init(null, certs, null);
} catch (java.security.GeneralSecurityException e) {
LOG.log(Level.SEVERE, "Error", e);
}
HttpsURLConnection.setDefaultSSLSocketFactory(ctx.getSocketFactory());
HttpsURLConnection.setDefaultHostnameVerifier(new HostnameVerifier() {
#Override
public boolean verify(String hostname, SSLSession session) {
LOG.severe("verify");
return true;
}
});
ClientConfig config = new DefaultClientConfig();
try {
config.getProperties().put(HTTPSProperties.PROPERTY_HTTPS_PROPERTIES, new HTTPSProperties(
new HostnameVerifier() {
#Override
public boolean verify(String hostname, SSLSession session) {
LOG.severe("verify");
return true;
}
},
ctx
));
} catch(Exception e) {
LOG.log(Level.SEVERE, "Error", e);
}
return config;
}
}
While everything seems right, the log lines in the TrustManager and in the HostnameVerifier never show up in the logs, and the connection still failes with an SSL Handshaking Exception on the get(ClientResponse.class).
I've been going over this for a while now and when I compare this to all the tutorials and people saying they fixed it, I can't find a difference.
If someone could point out the flaw that should be in there somehwere....

Answer 1

My company BITPlan has published an open source project to simplify handling of Jersey 1.19 see
https://github.com/BITPlan/com.bitplan.simplerest
The test case:
https://github.com/BITPlan/com.bitplan.simplerest/blob/master/src/test/java/com/bitplan/rest/test/TestBasicAuth.java
creates an SSL connection with no client certificate being used.
This leads to:
Schwerwiegend: SSL Client certificate is missing for /hello/hello
but the testcase nevertheless runs
The handling on the Clientside is done with:
https://github.com/BITPlan/com.bitplan.simplerest/blob/master/src/main/java/com/bitplan/rest/SSLClientHelper.java
if you should have any trouble with this you might want to file an issue
via https://github.com/BITPlan/com.bitplan.simplerest/issues