Re: Valid certificate chain failing with unable to find valid certification path to requested

2014-04-04 Thread Ognjen Blagojevic
On 4.4.2014 5:23, Toby Lazar wrote: I've run my client program with the -Djavax.net.debug=all option. First it listed out all of the trusted authorities. Mine is GoDaddy and this is the record: That one is not the issuer of your certificate. GoDaddy has many issuing certificates. The

Re: Valid certificate chain failing with unable to find valid certification path to requested

2014-04-04 Thread jeffery.scott.crump
Ognjen, You were correct. The GoDaddy GA2 certificate was not in the root distributions. I re-keyed it to GA1 and that fixed the problems. Thank you all. Jeff Crump Sent from Windows Mail From: Ognjen Blagojevic Sent: ‎Friday‎, ‎April‎ ‎4‎, ‎2014 ‎3‎:‎14‎ ‎AM To: Tomcat Users

Re: Valid certificate chain failing with unable to find valid certification path to requested

2014-04-04 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Ognjen, On 4/4/14, 4:14 AM, Ognjen Blagojevic wrote: On 4.4.2014 5:23, Toby Lazar wrote: I've run my client program with the -Djavax.net.debug=all option. First it listed out all of the trusted authorities. Mine is GoDaddy and this is the

Re: Valid certificate chain failing with unable to find valid certification path to requested

2014-04-04 Thread Ognjen Blagojevic
Chris, On 4.4.2014 16:27, Christopher Schultz wrote: So they don't have a big Daddy certificate that has signed all of their intermediate certificates? Boo. That would fix nearly everything. Actually, having different root certificates, one for SHA-1, and one for SHA-2 is recommended

Re: Valid certificate chain failing with unable to find valid certification path to requested

2014-04-03 Thread Christopher Schultz
-BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Jeffrey, On 4/3/14, 2:25 PM, jeffery.scott.cr...@gmail.com wrote: I’m using tomcat 7.0.50 on CentOS 6.5 on a headless blade server; 8 processor cores, 18 GB RAM. My java client is opening an HttpsURLConnection: SSLContext sc =

Re: Valid certificate chain failing with unable to find valid certification path to requested

2014-04-03 Thread jeffery.scott.crump
Chris, Sent from Windows Mail From: Christopher Schultz Sent: ‎Thursday‎, ‎April‎ ‎3‎, ‎2014 ‎1‎:‎55‎ ‎PM To: Tomcat Users List -BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Jeffrey, On 4/3/14, 2:25 PM, jeffery.scott.cr...@gmail.com wrote: I’m using tomcat 7.0.50 on CentOS 6.5

Re: Valid certificate chain failing with unable to find valid certification path to requested

2014-04-03 Thread Toby Lazar
On Thu, Apr 3, 2014 at 2:58 PM, jeffery.scott.cr...@gmail.com wrote: Chris, Sent from Windows Mail From: Christopher Schultz Sent: Thursday, April 3, 2014 1:55 PM To: Tomcat Users List -BEGIN PGP SIGNED MESSAGE- Hash: SHA256 Jeffrey, On 4/3/14, 2:25 PM,

Re: Valid certificate chain failing with unable to find valid certification path to requested

2014-04-03 Thread Ognjen Blagojevic
On 4.4.2014 0:27, Toby Lazar wrote: As others have noted here on other threads, you can use: http://portecle.sourceforge.net/ to see exactly which certificates your server is providing clients (Examine SSL/TLS connection). Viewing server certificates via browsers can be misleading since they

Re: Valid certificate chain failing with unable to find valid certification path to requested

2014-04-03 Thread James H. H. Lampert
I've only barely glanced at this thread, so forgive me if I'm saying something that's already been mentioned, or that's irrelevant. But yesterday, I was tearing my hair out over something similar while setting up a keystore for a customer: it seems that the customer's CA of choice had assumed

Re: Valid certificate chain failing with unable to find valid certification path to requested

2014-04-03 Thread jeffery.scott.crump
I tried ssllabs but it doesn't support SSL on port 8443, but digicert did show that everything was correct in the chain. I've run my client program with the -Djavax.net.debug=all option. First it listed out all of the trusted authorities. Mine is GoDaddy and this is the record: 04/03/2014

Re: Valid certificate chain failing with unable to find valid certification path to requested

2014-04-03 Thread Toby Lazar
On Thu, Apr 3, 2014 at 10:03 PM, jeffery.scott.cr...@gmail.com wrote: I tried ssllabs but it doesn't support SSL on port 8443, but digicert did show that everything was correct in the chain. Your certificate is a good certificate but it doesn't mean your client should trust it. ssllabs may