CODEWITHSUNDEEP
javasslconnection
Tony Ennis
Tony Ennis

Reputation: 12299

SSL client - when is the certificate needed?

I have this:

    SSLSocketFactory factory = HttpsURLConnection.getDefaultSSLSocketFactory();
    SSLSocket socket = (SSLSocket) factory.createSocket("www.verisign.com", 443);

This is failing on the 2nd line with a "Connection refused" error.

Now, would I have to install verisign's certificate in my trust store before I can even do the above? I was under the impression that I could connect to an SSL server and execute getPeerCertificates() to get the certificates. Is this not what our browsers do? Otherwise how would they know which signing authority to use?

(Obviously I'm using Verisign as an example. My real URL is far too fugly to use here...)

Upvotes: 2

Views: 975

Answers (3)

user207421
user207421

Reputation: 310903

Connection refused means nothing was listening at the target host:port, or a firewall got in the way. This is logically and temporally prior to anything SSL does.

Upvotes: 1

Eugene Mayevski 'Callback
Eugene Mayevski 'Callback

Reputation: 46050

Usually you don't need to install server's certificate on your computer explicitly. PKI works in the way that your system should be able to validate server's certificate without any prior knowledge about it. However this will work only when your server's certificate has it's roots in on of the "known CAs", i.e. certificate authorities, whose root or other certificates are already listed on the client system. If this is not the case (eg. you have a self-signed or some other custom certificate on the server), you really need to install the certificate on your client system before the mentioned classes can validate server certificate properly.

You can read about certificates and how they are used in SSL here.

Upvotes: 1

Steven Schlansker
Steven Schlansker

Reputation: 38526

Have you checked that the remote service is actually up and running, and that you can connect to it? Perhaps the "Connection refused" error is actually a refused connection. :-)

Upvotes: 1

Related Questions