Re: Problems with certificates form HTTPS connections
Jeroen Frijters <[email protected]> Tue, 7 Feb 2017 12:42:21 +0000
| Newsgroups | gmane.comp.java.ikvm.devel |
|---|---|
| Message-ID | <AM2PR08MB0051BE713451FAD51AB23747A2430@AM2PR08MB0051.eurprd08.prod.outlook.com> |
--===============6028497722844226455== Content-Language: en-US Content-Type: multipart/alternative; boundary="_000_AM2PR08MB0051BE713451FAD51AB23747A2430AM2PR08MB0051eurp_" --_000_AM2PR08MB0051BE713451FAD51AB23747A2430AM2PR08MB0051eurp_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Hi Volker, The trusted root certificates are read from the system via the .NET class X= 509Store (the code is in vfs.cs). The problem with this approach is that Windows downloads the trusted root c= ertificates on-demand and so the content of this store depends on what webs= ites the user has visited. I didn't know this when I designed this mechanis= m, but I also don't want to be in the business of distributing trusted root= certificates, so I don't really know how to solve this. Regards, Jeroen From: Volker Berlin [mailto:[email protected]] Sent: Tuesday, February 7, 2017 11:56 To: IKVM List <[email protected]> Subject: [Ikvm-developers] Problems with certificates form HTTPS connection= s Hi Jeroen, We have problems with HTTPS connections from a docker installation. The cer= tificate can't validate. For validating the Java VM use the root certificat= es saved in <java.home>\lib\security\cacerts. In IKVM this is a virtual fil= e. We receive different files if we read it directly inside IKVM on differe= nt systems. That the core Questions: * From where read IKVM the cacerts file? * Any idea how we can fix this? Volker How we have read the file: File cert =3D new File(java.lang.System.getProperty("java.home") + File.sep= arator + "lib" + File.separator + "security" + File.separator + "cacerts"); FileInputStream input =3D new FileInputStream(cert); FileOutputStream output =3D new FileOutputStream("c:\\temp\\cert_export.txt= "); int data =3D input.read(); while(data !=3D -1) { output.write(data); data =3D input.read(); } input.close(); output.close(); --_000_AM2PR08MB0051BE713451FAD51AB23747A2430AM2PR08MB0051eurp_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable <html xmlns:v=3D"urn:schemas-microsoft-com:vml" xmlns:o=3D"urn:schemas-micr= osoft-com:office:office" xmlns:w=3D"urn:schemas-microsoft-com:office:word" = xmlns:x=3D"urn:schemas-microsoft-com:office:excel" xmlns:m=3D"http://schema= s.microsoft.com/office/2004/12/omml" xmlns=3D"http://www.w3.org/TR/REC-html= 40"> <head> <meta http-equiv=3D"Content-Type" content=3D"text/html; charset=3Dus-ascii"= > <meta name=3D"Generator" content=3D"Microsoft Word 15 (filtered medium)"> <style><!-- /* Font Definitions */ @font-face {font-family:"Cambria Math"; panose-1:2 4 5 3 5 4 6 3 2 4;} @font-face {font-family:Calibri; panose-1:2 15 5 2 2 2 4 3 2 4;} /* Style Definitions */ p.MsoNormal, li.MsoNormal, div.MsoNormal {margin:0in; margin-bottom:.0001pt; font-size:12.0pt; font-family:"Times New Roman",serif; color:black;} a:link, span.MsoHyperlink {mso-style-priority:99; color:#0563C1; text-decoration:underline;} a:visited, span.MsoHyperlinkFollowed {mso-style-priority:99; color:#954F72; text-decoration:underline;} p.msonormal0, li.msonormal0, div.msonormal0 {mso-style-name:msonormal; mso-margin-top-alt:auto; margin-right:0in; mso-margin-bottom-alt:auto; margin-left:0in; font-size:12.0pt; font-family:"Times New Roman",serif; color:black;} span.EmailStyle19 {mso-style-type:personal-reply; font-family:"Calibri",sans-serif; color:windowtext;} .MsoChpDefault {mso-style-type:export-only; font-size:10.0pt;} @page WordSection1 {size:8.5in 11.0in; margin:1.0in 1.0in 1.0in 1.0in;} div.WordSection1 {page:WordSection1;} --></style><!--[if gte mso 9]><xml> <o:shapedefaults v:ext=3D"edit" spidmax=3D"1026" /> </xml><![endif]--><!--[if gte mso 9]><xml> <o:shapelayout v:ext=3D"edit"> <o:idmap v:ext=3D"edit" data=3D"1" /> </o:shapelayout></xml><![endif]--> </head> <body bgcolor=3D"white" lang=3D"EN-US" link=3D"#0563C1" vlink=3D"#954F72"> <div class=3D"WordSection1"> <p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ca= libri",sans-serif;color:windowtext">Hi Volker,<o:p></o:p></span></p> <p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ca= libri",sans-serif;color:windowtext"><o:p> </o:p></span></p> <p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ca= libri",sans-serif;color:windowtext">The trusted root certificates are = read from the system via the .NET class X509Store (the code is in vfs.cs).<= o:p></o:p></span></p> <p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ca= libri",sans-serif;color:windowtext"><o:p> </o:p></span></p> <p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ca= libri",sans-serif;color:windowtext">The problem with this approach is = that Windows downloads the trusted root certificates on-demand and so the c= ontent of this store depends on what websites the user has visited. I didn’t know this when I designed this mechan= ism, but I also don’t want to be in the business of distributing trus= ted root certificates, so I don’t really know how to solve this.<o:p>= </o:p></span></p> <p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ca= libri",sans-serif;color:windowtext"><o:p> </o:p></span></p> <p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ca= libri",sans-serif;color:windowtext">Regards,<o:p></o:p></span></p> <p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ca= libri",sans-serif;color:windowtext">Jeroen<o:p></o:p></span></p> <p class=3D"MsoNormal"><span style=3D"font-size:11.0pt;font-family:"Ca= libri",sans-serif;color:windowtext"><o:p> </o:p></span></p> <div style=3D"border:none;border-left:solid blue 1.5pt;padding:0in 0in 0in = 4.0pt"> <div> <div style=3D"border:none;border-top:solid #E1E1E1 1.0pt;padding:3.0pt 0in = 0in 0in"> <p class=3D"MsoNormal"><b><span style=3D"font-size:11.0pt;font-family:"= ;Calibri",sans-serif;color:windowtext">From:</span></b><span style=3D"= font-size:11.0pt;font-family:"Calibri",sans-serif;color:windowtex= t"> Volker Berlin [mailto:[email protected]] <br> <b>Sent:</b> Tuesday, February 7, 2017 11:56<br> <b>To:</b> IKVM List <[email protected]><br> <b>Subject:</b> [Ikvm-developers] Problems with certificates form HTTPS con= nections<o:p></o:p></span></p> </div> </div> <p class=3D"MsoNormal"><o:p> </o:p></p> <p>Hi Jeroen,<o:p></o:p></p> <p>We have problems with HTTPS connections from a docker installation. The = certificate can't validate. For validating the Java VM use the root certifi= cates saved in <java.home>\lib\security\cacerts. In IKVM this is a vi= rtual file. We receive different files if we read it directly inside IKVM on different systems.<o:p></o:p></p> <div> <p class=3D"MsoNormal">That the core Questions: <br> <br> * From where read IKVM the cacerts file?<br> * Any idea how we can fix this?<br> <br> Volker<br> <br> <br> How we have read the file: <br> <br> <o:p></o:p></p> <div> <p class=3D"MsoNormal" style=3D"mso-margin-top-alt:auto;mso-margin-bottom-a= lt:auto">File cert =3D new File(java.lang.System.getProperty("java.hom= e") + File.separator + "lib" + File.separator &#= 43; "security" + File.separator + "cacerts");<o= :p></o:p></p> <p class=3D"MsoNormal" style=3D"mso-margin-top-alt:auto;mso-margin-bottom-a= lt:auto">FileInputStream input =3D new FileInputStream(cert);<o:p></o:p></p= > <p class=3D"MsoNormal" style=3D"mso-margin-top-alt:auto;mso-margin-bottom-a= lt:auto">FileOutputStream output =3D new FileOutputStream("c:\\temp\\c= ert_export.txt");<o:p></o:p></p> <p class=3D"MsoNormal" style=3D"mso-margin-top-alt:auto;mso-margin-bottom-a= lt:auto">int data =3D input.read();<o:p></o:p></p> <p class=3D"MsoNormal" style=3D"mso-margin-top-alt:auto;mso-margin-bottom-a= lt:auto">while(data !=3D -1)<o:p></o:p></p> <p class=3D"MsoNormal" style=3D"mso-margin-top-alt:auto;mso-margin-bottom-a= lt:auto">{<o:p></o:p></p> <p class=3D"MsoNormal" style=3D"mso-margin-top-alt:auto;mso-margin-bottom-a= lt:auto"> output.write(data);<o:p></o:p></p> <p class=3D"MsoNormal" style=3D"mso-margin-top-alt:auto;mso-margin-bottom-a= lt:auto"> data =3D input.read();<o:p></o:p></p> <p class=3D"MsoNormal" style=3D"mso-margin-top-alt:auto;mso-margin-bottom-a= lt:auto">}<o:p></o:p></p> <p class=3D"MsoNormal" style=3D"mso-margin-top-alt:auto;mso-margin-bottom-a= lt:auto">input.close();<o:p></o:p></p> <p class=3D"MsoNormal" style=3D"mso-margin-top-alt:auto;mso-margin-bottom-a= lt:auto">output.close();<o:p></o:p></p> <p class=3D"MsoNormal" style=3D"mso-margin-top-alt:auto;mso-margin-bottom-a= lt:auto"> <o:p></o:p></p> <p class=3D"MsoNormal" style=3D"mso-margin-top-alt:auto;mso-margin-bottom-a= lt:auto"> <o:p></o:p></p> </div> </div> </div> </div> </body> </html> --_000_AM2PR08MB0051BE713451FAD51AB23747A2430AM2PR08MB0051eurp_-- --===============6028497722844226455== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline ------------------------------------------------------------------------------ Check out the vibrant tech community on one of the world's most engaging tech sites, SlashDot.org! http://sdm.link/slashdot --===============6028497722844226455== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline _______________________________________________ Ikvm-developers mailing list [email protected] https://lists.sourceforge.net/lists/listinfo/ikvm-developers --===============6028497722844226455==--