JSSE for CDC Package Not Found During Compilation
Problem: When compiling a program that uses the JSSE 1.0.3 for CDC 1.0.2 packages, one of the following errors occurs:
Package com.sun.net.ssl not found in import.
Package javax.net not found in import.
Package javax.net.ssl not found in import.
Package javax.security.cert not found in import.
Cause: The JSSE for CDC JAR files are not installed with J2SE.
Solution: JSSE for CDC is meant to be installed with an instance of Java ME, as described in the downloaded documentation at
docs/install/install.html. When compiled with
javac, which comes from a J2SE installation, the command line should include the JSSE for CDC JAR files on the classpath, using the
-classpath option.
Runtime Exception: SSL Service Not Available
Problem: When running a program that uses JSSE 1.0.3 for CDC 1.0.2, an exception occurs indicating that an SSL service is not available. For example, an exception similar to one of the following occurs:
Exception in thread "main"
java.net.SocketException: no SSL Server Sockets
Exception in thread "main":
SSL implementation not available
Cause 1: The cryptographic service provider is not registered properly.
Solution 1: Before using JSSE 1.0.3 for CDC 1.0.2, you must register the
SunJSSE provider, either statically by modifying the
java.security file or dynamically by calling the
Security.addProvider method, as described in the downloaded documentation at
docs/install/install.html.
Cause 2: There was a problem with
SSLContext initialization, for example due to a corrupted keystore. (Note: One vendor has shipped a keystore in an unknown format, and that may cause this type of error.)
Solution 2: Check initialization parameters. Ensure any keystores specified are valid (e.g., by trying to use the J2SE
keytool to examine them).
Runtime Exception: untrusted cert chains
Problem: When negotiating an SSL connection, the client or server throws one of the following exceptions:
javax.net.ssl.SSLException: untrusted server cert chain
javax.net.ssl.SSLException: untrusted client cert chain
Cause 1: This is generally caused by the remote side sending a certificate that is unknown to the local side.
Solution 1: The best way to debug this type of problem is to turn on debugging and watch as certificates are loaded and when certificates are received via the network connection. Most likely, the received certificate is unknown to the trust mechanism because the wrong trust file was loaded.
Cause 2: The system clock is not set correctly.
Solution 2: If the clock is not set correctly, the perceived time may be outside the validity period on one of the certificates, and unless the certificate can be replaced with a valid one from a trust store, the system must assume that the certificate is invalid, and therefore throw the exception.
Runtime Exception: Class Definition Not Found
Problem: When running a program that uses JSSE 1.0.3 for CDC 1.0.2, an exception occurs indicating that a JSSE class definition cannot be found. For example, an exception similar to the following occurs:
Exception in thread "main" java.lang.NoClassDefFoundError:
javax/net/ssl/SSLServerSocketFactory
Cause: The JSSE for CDC JAR files are not on the class path.
Solution: Ensure that the JSSE for CDC JAR files (
jcert.jar,
jnet.jar, and
jsse.jar) are explicitly named on the class path.
Runtime Exception: No Cipher Suites in Common
Problem: When using Netscape Navigator or Microsoft Internet Explorer (IE) to access files on a server that only has DSA-based certificates, a runtime exception occurs indicating that there are no cipher suites in common.
Cause: By default, certificates created with
keytool use DSA public keys. Navigator and IE do not use DSA public keys in their enabled cipher suites.
Solution: To interact with Navigator or IE, you should create certificates that use RSA-based keys. To do this, you need to specify the
-keyalg RSA option when using the J2SE
keytool. For example:
keytool -genkey -alias duke -keystore testkeys -keyalg rsa
Printer View