×

Discussion Board

Results 1 to 9 of 9
  1. #1
    Registered User
    Join Date
    Feb 2005
    Posts
    11

    Unknown or invalid certificates + HttpsConnection in J2ME

    Hello Everybody,

    I am using the HttpsConnection of MIDP 2.0 (on a Nokia 6680) to access secure websites. However, should the certificate be invalid or just unknown to the phone, It throws the Certificate exception. Is there a way of dealing with this in the runtime? Like PC browser do - they ask the user if he wants to proceed, even the certificate is invalid.

    How could I do that in Java?

  2. #2
    Super Contributor
    Join Date
    Dec 2005
    Location
    Europe/Poland/Warsaw
    Posts
    1,697

    Re: Unknown or invalid certificates + HttpsConnection in J2ME

    hi,

    what's that cert on server? is it from some 3rd certification issuers or self-signed cert?

    regards,
    peter

  3. #3
    Registered User
    Join Date
    Feb 2005
    Posts
    11

    Re: Unknown or invalid certificates + HttpsConnection in J2ME

    Quote Originally Posted by peterblazejewicz
    hi,

    what's that cert on server? is it from some 3rd certification issuers or self-signed cert?

    regards,
    peter

    Hi Peter!
    The cert is
    a) self signed,
    b) with the wrong name - the cert url does not match the web url.
    c) for bureaucratic reasons the cert cannot be fixed right now.

    But independently from this situation - Java based browser Opera Mini works fine , just warning that the cert is not OK and dangerous (so it is possible in Java).
    Is there a possibility of processing such thing using HttpsConnection - or is there absolutely NO way to use the HttpsConnection with a cert which is for some reason not OK?

    I wonder how it was done in Opera Mini - maybe they have their own Https implementation?

  4. #4
    Super Contributor
    Join Date
    Dec 2005
    Location
    Europe/Poland/Warsaw
    Posts
    1,697

    Re: Unknown or invalid certificates + HttpsConnection in J2ME

    hi,

    OperaMini is not a browser - they use third-tier server (proxy) which processes your "requests" from client, client act as rendering actor only - all http related work, including html processing is done on that third-tier server,

    regards,
    peter

  5. #5
    Registered User
    Join Date
    Feb 2005
    Posts
    11

    Re: Unknown or invalid certificates + HttpsConnection in J2ME

    Quote Originally Posted by peterblazejewicz
    hi,

    OperaMini is not a browser - they use third-tier server (proxy) which processes your "requests" from client, client act as rendering actor only - all http related work, including html processing is done on that third-tier server,

    regards,
    peter
    Thanks for that correction. I did not have any experience with opera mini until 2 two hours ago

    So this means, effectively, there is no way to open a website with an invalid certificate in Java? Ok, to make it exact : in Java using HttpsConnection!
    What do you think?

  6. #6
    Super Contributor
    Join Date
    Dec 2005
    Location
    Europe/Poland/Warsaw
    Posts
    1,697

    Re: Unknown or invalid certificates + HttpsConnection in J2ME

    hi,

    not sure about work-around, not being experienced yet, after seraching sun forums maybe possible solution is to:
    - catch raised exception (invalid cert exception is raised)
    - close https connection
    - open connection using http protocol (no security layer used)
    ?
    Nokia devices have closed certs set unless I'm wrog,

    try that document:
    MIDP 2 0: Introduction to Secure MIDlet Communication (With Example)

    maybe it contains some notes about certs,

    regards,
    Peter

  7. #7
    Registered User
    Join Date
    Feb 2005
    Posts
    11

    Re: Unknown or invalid certificates + HttpsConnection in J2ME

    Thanks for your answer.

    Nope, the workaround would not work I still need Https. To understand what I need think about a normal PC Browser. This would ask you, If you still still want to connect to the site, even if the cert is broken, invalid, expired, or fake. So this option I would like to have in Java, but I was also reading very many papers, docs, forums on this topic and found nothing I tend to think this is not possible.

    Thanks for the link as well.

  8. #8
    Registered User
    Join Date
    Mar 2003
    Posts
    4,105
    Or create a third tier – a proxy – too.
    Futhermore, I would test a Nokia S60 3rd Edition device. There it is possible to accept unknown certificates, however, I never tried this in J2ME HTTPS and whether it works for totally wrong certs like yours.

  9. #9
    Registered User
    Join Date
    Feb 2005
    Posts
    11

    Re: Unknown or invalid certificates + HttpsConnection in J2ME

    Ok now after doing more tests I came to a conclusion that I oversaw something. SO. The midlet would not run on J2me native emulator (wrong cert) neither does it run on some motorola phones (which is irrelevant actually).

    BUT: IT runs on nokia 6680!!! (I wrote it did not run because I myself did a mistake and took a wrong version).

    So on the 6680 it simply says the certificate is untrusted and you can continue!!!

    The problem thus is not solved, but alleviated and I can continue. thanks to all of you for the support.

Similar Threads

  1. Using SSL in J2ME: certificates
    By olejensen in forum Mobile Java Networking & Messaging & Security
    Replies: 10
    Last Post: 2009-04-01, 13:53
  2. ERROR RCmake.exe AND rcomp.exe
    By jifik in forum Symbian Tools & SDKs
    Replies: 2
    Last Post: 2005-10-31, 12:24
  3. Errors compilling and debugging Helloworld
    By doberlet in forum Symbian Tools & SDKs
    Replies: 2
    Last Post: 2004-03-04, 18:08
  4. Codewarrior import .mmp error
    By serenade in forum Symbian Tools & SDKs
    Replies: 1
    Last Post: 2004-02-21, 20:06

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  
×