Java Security

linux, j2sdk1.4.2_01, jboss

Dear experts out there,

I am very very new to Servlet and Https and I hope someone can guide me in this problem I am facing. I have a servlet that needs to access a remote servlet using Https. Normal Http is fine with the codes below but I face problems using HttpsURLConnection.


protected void doPost(HttpServletRequest request, HttpServletResponse response)
throws ServletException, IOException {

StringBuffer strMsg = new StringBuffer();

Enumeration enumParam = request.getParameterNames();
while (enumParam.hasMoreElements()){
String strParaName = (String) enumParam.nextElement();
if (!bStart){
strMsg.append("&");
}
strMsg.append(strParaName + "=" + request.getParameter(strParaName));
bStart = false;
}

// Forwarding to PaymentRequestPBBSimulator Servlet
System.out.println("POST to second servlet...");

/*********** Portion to be modified *************/
URL objUrl = new URL(m_str_UrlPymtReq);
System.out.println("Open connection");
HttpURLConnection objOutClient1 = (HttpURLConnection) objUrl.openConnection();
/*********** Portion to be modified *************/

objOutClient1.setDoOutput(true);
objOutClient1.setRequestMethod("POST");

logger.info("Get output stream");
OutputStream outSend = objOutClient1.getOutputStream();
logger.info("Write");
outSend.write(strMsg.toString().getBytes());
outSend.flush();

......... more codes ..........
}


When I modified the portion (with comments) to the codes below (with importing javax.net.ssl.HttpsURLConnection) :

System.setProperty("java.protocol.handler.pkgs", "com.sun.net.ssl.internal.www.protocol");
Security.addProvider(new com.sun.net.ssl.internal.ssl.Provider());
System.setProperty("javax.net.ssl.trustStore", "trustedcerts");
System.setProperty("javax.net.ssl.trustStorePassword", "mypassword");
URL objUrl = new URL(m_str_UrlPymtReq);
System.out.println("Open connection");
HttpsURLConnection objOutClient1 = (HttpsURLConnection) objUrl.openConnection();


I got the "ClassCastException" error at open connection :

********* First Error **********
11:48:35,237 ERROR [Engine] StandardWrapperValve[PaymentRequestClientSimulator]: Servlet.service() for servlet PaymentRequestClientSimulator threw exception
java.lang.ClassCastException
at com.mlifestyle.pss.services.idd.pbb.PaymentRequestClientSimulatorServlet.doPost(PaymentRequestClientSimulatorServlet.java:126)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:760)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:853)
...........
at org.apache.catalina.connector.http.HttpProcessor.run(HttpProcessor.java:1151)
at java.lang.Thread.run(Thread.java:534)
********* First Error **********


After getting bits and pieces from the java.sun.com web site, I changed the import to com.sun.net.ssl.HttpsURLConnection and I get another error at getoutputstream

********* Second Error **********
11:14:26,265 ERROR [Engine] StandardWrapperValve[PaymentRequestClientSimulator]: Servlet.service() for servlet PaymentRequestClientSimulator threw exception
javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: No trusted certificate found
at com.sun.net.ssl.internal.ssl.BaseSSLSocketImpl.a(DashoA6275)
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.a(DashoA6275)
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.a(DashoA6275)
at com.sun.net.ssl.internal.ssl.SunJSSE_az.a(DashoA6275)
at com.sun.net.ssl.internal.ssl.SunJSSE_az.a(DashoA6275)
at com.sun.net.ssl.internal.ssl.SunJSSE_ax.a(DashoA6275)
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.a(DashoA6275)
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.j(DashoA6275)
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(DashoA6275)
at sun.net.www.protocol.https.HttpsClient.afterConnect(DashoA6275)
at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(DashoA6275)
at sun.net.www.protocol.http.HttpURLConnection.getOutputStream(HttpURLConnection.java:558)
at com.sun.net.ssl.internal.www.protocol.https.HttpsURLConnectionOldImpl.getOutputStream(DashoA6275)
at com.mlifestyle.pss.services.idd.pbb.PaymentRequestClientSimulatorServlet.doPost(PaymentRequestClientSimulatorServlet.java:131)
....................
********* Second Error **********


I have the server keystore ready in the server/default/conf folder and I have successfully exported and imported the server cert using keytool to the trustedcerts keystore and put it in the same folder and even the folder where the servlets are but nothing works.

Please help. Thanks.

ltkhoo