SSL Certificate from SSL.com causes "Certificate revocation validation failure" on MID Server

NStefanisko
Tera Expert

‎07-12-2023 03:40 PM

Version: Tokyo
Mid: tokyo-07-08-2022__patch4a-01-03-2023_01-11-2023_0813


I just got a new *. SSL certificate from SSL.com. 
At first I was getting an error that the validation path could not be found. Turns out that I needed to install a CA cert for SSL.com's SubCA authority. OK fine. Now my Eclipse environment behaves, no errors. I move the code over to my Linux machine and test it there using the Java I have installed. Works fine. Try it under agent/jre/bin/java and it's a no go.

"javax.net.ssl.SSLHandshakeException: Certificate revocation validation failure"

The only thing in Google and in these forums that I am finding have to to with a "pre-Quebec" problem that talks about turning off OCSP. Tried the Tokyo way of doing that and still no dice. Our previous cert from GoDaddy has no problems, so there is something special about the revocation check from SSL.com. I'm willing to simply turn off revocation checks altogether, but all the methods for doing that don't seem to work. Any ideas?

I have tried installing the *. cert itself into the cacerts certificate store in agents/jre/lib/security, that did not work either.

0 Helpfuls
  • 1,195 Views
1 REPLY 1

NStefanisko
Tera Expert

‎07-12-2023 04:28 PM - edited ‎07-12-2023 04:32 PM

here's some test code.

From the agent directory:
When running using the system java and the MID Server's jar files, I get the expected output: "403"

When running using the MID Servers JRE I get the exception "javax.net.ssl.SSLHandshakeException: Certificate revocation validation failure"


jre/bin/java -cp ".:lib/*:extlib/*" test

 

import java.net.HttpURLConnection;
import java.net.URL;

public class test {

        public static void main(String[] args)
        {
                HttpURLConnection uc;
                int code;

                try
                {
                        System.setProperty("com.sun.net.ssl.checkRevocation", "false"); // these have no effect
                        System.setProperty("com.sun.security.enableCRLDP", "false");

                        URL url = new URL("https://t581.tier44.net");
                        uc = (HttpURLConnection) url.openConnection();
                        HttpURLConnection.setFollowRedirects(true);
                        uc.connect();
                        code = uc.getResponseCode();
                        System.out.println(code); // expected value 403
                }
                catch(Exception e)
                {
                        System.err.println(e.toString());
                }
        }
}

 

SSL_COM_RSA_SSL_SUBCA.crt
-----BEGIN CERTIFICATE-----
MIIGbzCCBFegAwIBAgIICZftEJ0fB/wwDQYJKoZIhvcNAQELBQAwfDELMAkGA1UE
BhMCVVMxDjAMBgNVBAgMBVRleGFzMRAwDgYDVQQHDAdIb3VzdG9uMRgwFgYDVQQK
DA9TU0wgQ29ycG9yYXRpb24xMTAvBgNVBAMMKFNTTC5jb20gUm9vdCBDZXJ0aWZp
Y2F0aW9uIEF1dGhvcml0eSBSU0EwHhcNMTYwMjEyMTg0ODUyWhcNMzEwMjEyMTg0
ODUyWjBpMQswCQYDVQQGEwJVUzEOMAwGA1UECAwFVGV4YXMxEDAOBgNVBAcMB0hv
dXN0b24xGDAWBgNVBAoMD1NTTCBDb3Jwb3JhdGlvbjEeMBwGA1UEAwwVU1NMLmNv
bSBSU0EgU1NMIHN1YkNBMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEA
hPYpOunhcxiF6xNzl6Tsm/Q89rnu2jVTXTBOZPaBkSD1Ic4lm7qkYwlZ/UgV5nn1
5ohhceYDC2AlR9RvGbP+26qrNcuE0XOdHJOB4SoY4d6OqLAQ6ZB0LdERK1Saa5lp
QlqHE8936dpr3hGWyqMb2LsdUuhQIzwNkLU/n9HO35irKCbKgS3FeejqkdqK5l6B
b11693o4bz9UZCUdBcQ/Xz06tA5cfnHvYkmmjxhj1lLTKwkQhWuIDrpbwWLO0QVO
c29s9ieomRKm8sYMyiBG4QqRQ/+bXwp48cF0qAByGWD6b8/gG4Xq1IBgO5p+aWFS
0mszkk5rsh4b3XbTHohP3oWQIOV20WWdtVWXiQuBB8RocAl0Ga//b+epiGgME5JX
LWXD1aDg/xHy8MUsaMlh6jDfVIFepkPnkwXDpR/n36hpgKa9dErMkgbYeEaPanLH
Yd0kv4xQ36PlMMs9WhoDErGcEG9KxAXN4Axr5wl6PTDn/lXcUFvQoIq/5CSP+Kt5
jq9tK/gRrAc4AWqRugDvQPYUm00Rqzj5Oxm5NVQYDzbyoA66CD68LETuVrfa9GuW
9MAZRO6CDzonAezIdNHsslDb1H8VN/k0zMxjI+0ub4IAmc3I5GfZtvYcpjtMj8L4
2TDS34/COov/Pf2HZ/XXGlzjZ7WPmLl4fdB6hhjs2BsCAwEAAaOCAQYwggECMDAG
CCsGAQUFBwEBBCQwIjAgBggrBgEFBQcwAYYUaHR0cDovL29jc3BzLnNzbC5jb20w
HQYDVR0OBBYEFCYUfuDc16b34tQEJ99h8cLs5zLKMA8GA1UdEwEB/wQFMAMBAf8w
HwYDVR0jBBgwFoAU3QQJB6L1en1SUxKSle44gCUNplkwEQYDVR0gBAowCDAGBgRV
HSAAMDsGA1UdHwQ0MDIwMKAuoCyGKmh0dHA6Ly9jcmxzLnNzbC5jb20vc3NsLmNv
bS1yc2EtUm9vdENBLmNybDAOBgNVHQ8BAf8EBAMCAYYwHQYDVR0lBBYwFAYIKwYB
BQUHAwEGCCsGAQUFBwMCMA0GCSqGSIb3DQEBCwUAA4ICAQAi6e/iSV5DEqDO6XjQ
SIIzXgc255yv6Oc2sqZnvRyVBHtHvo62jMoHY3Xunc/EofbeS4aHdYBvgkn6CNTj
VkCU+psWwcT3Pg83uP4k4Thu7bXvrClfS+XBlbJiCF/PSJxLrKnxRn+XIGiYl62H
glBhq9K8/fZrI2Qh1mZJmWE0FlxEDCb4i8SBNi8lmDogaFi8/yl32Z9ahmhxcLit
DU/XyKA0yOqvIrOGKH95v+/l8fQkzE1VEFvj+iyv4TXd7mRZDOsfqfIDZhrpou02
kXH/hcXlrR++t8kjj9wt8HHQ+FkryWI6bU3KPRJR6N8EH2EHi23Rp8/kyMs+gwaz
zMqnkNPbMME723rXk6/85sjOUaZCmhmRIx9rgqIWQesU962J0FruGOOasLT7WbZi
FsmSblmpjUAo49sIRi7X493qegyCEAa412ynybhQ7LVsTLEPxVbdmGVih3jVTif/
Nztr2Isaaz4LpMEo4mGCiGxec5mKr1w8AE9n6D91CvxR5/zL1VU1JCVC7sAtkdki
vnN1/6jEKFJvlUr5/FX04JXeomIjXTI8ciruZ6HIkbtJup1n9Zxvmr9JQcFTsP2c
bRbjaT7JD6MBidAWRCJWClR/5etTZwWwWrRCrzvIHC7WO6rCzwu69a+l7ofCKlWs
y702dmPTKEdEfwhgLx0LxJr/Aw==
-----END CERTIFICATE-----

 

0 Helpfuls