Migration from httpclient4 to httpclient5

Question

in our project we switched from apache httpclient 4 to httpclient 5 now we have a ssl problem in one module. The code in httpclient 4 was

private void buildHttpClient() throws MalformedURLException {
  try {
      URL aURL = new URL(BASE_URL);
    String host = aURL.getAuthority();
    SSLSocketFactory socketFactory = (SSLSocketFactory) SSLSocketFactory.getDefault();
      HostnameVerifier defaultHostnameVerifier = SSLConnectionSocketFactory.getDefaultHostnameVerifier();
      SSLConnectionSocketFactory systemSocketFactory = new SSLConnectionSocketFactory(socketFactory, defaultHostnameVerifier);
    CredentialsProvider provider = new BasicCredentialsProvider();
    provider.setCredentials(
        new AuthScope(new HttpHost(host)), 
        new UsernamePasswordCredentials(USER, PASSWORD));
    httpclient = HttpClients.custom()
        .setDefaultCredentialsProvider(provider)
        .setSSLSocketFactory(systemSocketFactory)
        .build();
  } catch (MalformedURLException e) {
    throw new MalformedURLException(BASE_URL);
  }
}

the new code is

private void buildClient() throws MalformedURLException {

  URL aURL = new URL(BASE_URL);
  String host = aURL.getAuthority();

      final BasicCredentialsProvider credsProvider = new BasicCredentialsProvider();
      credsProvider.setCredentials(
              new AuthScope(host, 443),
              new UsernamePasswordCredentials(USER, PASSWORD.toCharArray()));

      SSLContext ctx = SSLContexts.createDefault();
      final SSLConnectionSocketFactory sslSocketFactory = SSLConnectionSocketFactoryBuilder.create()
              .setSslContext(ctx)
              .build();
      final HttpClientConnectionManager cm = PoolingHttpClientConnectionManagerBuilder.create()
              .setSSLSocketFactory(sslSocketFactory)
              .build();
      
  httpclient = HttpClients.custom()
        .setConnectionManager(cm)
        .setDefaultCredentialsProvider(credsProvider)
        .build();
}

httpclient is CloseableHttpClient in both cases. Testin locally never got a problem but testing on the customer server shows now PKIX path building failed: com.ibm.security.cert.IBMCertPathBuilderException: unable to find valid certification path to requested target When i roll back to an old deployment it works on the server but the new one doesn't work. The keystore deployed by the customer should be correct and I don't want to use an own keystore.

Can somebody describe where I should look, or what is the problem with the ssl?

Answer 1

You are getting a certification error. You can add following static block in order to close SSL verification.

static {
    // this part is needed cause Lebocoin has invalid SSL certificate, that
    // cannot be normally processed by Java
    TrustManager[] trustAllCertificates = new TrustManager[] { new X509TrustManager() {
        @Override
        public X509Certificate[] getAcceptedIssuers() {
            return null; // Not relevant.
        }

        @Override
        public void checkClientTrusted(X509Certificate[] certs, String authType) {
            // Do nothing. Just allow them all.
        }

        @Override
        public void checkServerTrusted(X509Certificate[] certs, String authType) {
            // Do nothing. Just allow them all.
        }
    } };

    HostnameVerifier trustAllHostnames = (String hostname, SSLSession session) -> true // Just
                                                                                        // allow
                                                                                        // them
                                                                                        // all.
    ;

    try {
        System.setProperty("jsse.enableSNIExtension", "false");
        SSLContext sc = SSLContext.getInstance("SSL");
        sc.init(null, trustAllCertificates, new SecureRandom());
        HttpsURLConnection.setDefaultSSLSocketFactory(sc.getSocketFactory());
        HttpsURLConnection.setDefaultHostnameVerifier(trustAllHostnames);
    } catch (GeneralSecurityException e) {
        throw new ExceptionInInitializerError(e);
    }
}