Problem with GF and SSL: IE accepts certificate but Firefox doesn't

[glassfish-2]

Hi,

I'm looking for a SSL certificate for my server. I have a strange problem with a test certificate, and I have too little knowledge about SSL to troubleshoot this, so I would be grateful for any hints how to tackle this.

I have received a 30-day test certificate and I installed it in Glassfish version b09d-fcs. I followed the various instructions about installing certificates in Glassfish:

http://wiki.glassfish.java.net/gfwiki/Wiki.jsp?page=How_to_ssl_versign
http://blogs.sun.com/swchan/entry/how_to_use_verisign_cert
http://blogs.sun.com/enterprisetechtips/entry/using_ssl_with_glassfish_v2

The problem is that Internet Explorer 7 accepts the certificate without warning, but Firefox 2 does display a warning that the certificate cannot be verified. When I look at the certificate properties in Internet Explorer, it displays the intermediate certificates. When I look at the certificate properties in Firefox, it does not display the intermediate certificates.

So where should I start to find out what is wrong? Can this be a Glassfish configuration problem, or could it be a problem in Firefox?

If anybody wants to take a look, the problem should be reproducible by looking at the following URL with IE and Firefox:

https://www.pluginsmithy.com:8181

Thanks
Stephan
[Message sent by forum member 'smuehlst' (smuehlst)]

http://forums.java.net/jive/thread.jspa?messageID=251975

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@...
For additional commands, e-mail: users-help@...

[glassfish-2]

Stephen,

Security is hard to understand, so don't feel you are alone :)

BTW, I just connected to your site and could see "Magnolia" Small is beautiful page. This is in
Firefox 2.0. So, I am not sure what your problem is. Browser restart, cleanup of cache, removal
of certs etc?

- Kedar
[Message sent by forum member 'km' (km)]

http://forums.java.net/jive/thread.jspa?messageID=251983

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@...
For additional commands, e-mail: users-help@...

[glassfish-2]

Hello Kedar,

>...
> BTW, I just connected to your site and could see
> "Magnolia" Small is beautiful page. This is in
> Firefox 2.0. So, I am not sure what your problem is.
> Browser restart, cleanup of cache, removal
> of certs etc?
>

did you click on the https: link in my previous post, and didn't you get a warning about the certificate? I can reproduce the behavior I described with Firefox 2 under Windows and Linux.

Regards
Stephan
[Message sent by forum member 'smuehlst' (smuehlst)]

http://forums.java.net/jive/thread.jspa?messageID=251991

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@...
For additional commands, e-mail: users-help@...

[glassfish-2]

Hi Stephan,

Oh Yes, I did get a "warning" when I clicked on the link for your site,
because Ff thinks that this is not a trusted CA and wants you to make
sure that you are connecting to the correct site and that the CA is someone you know.

Somehow, in IE's database, this CA is a trusted CA and hence IE does not show you  the
warning dialog.

If you look further into IE settings maybe you'll find that this CA is one it trusts.

- Kedar
[Message sent by forum member 'km' (km)]

http://forums.java.net/jive/thread.jspa?messageID=251993

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@...
For additional commands, e-mail: users-help@...

[glassfish-2]

Hello Kedar,

> Somehow, in IE's database, this CA is a trusted CA
> and hence IE does not show you  the
> warning dialog.
>
> If you look further into IE settings maybe you'll
> find that this CA is one it trusts.

as far as I can see both Firefox and IE do know the top-level CA that is relevant here, which is "UTN-USERFirst-Hardware" as displayed in the Firefox settings. But IE recognizes the intermediate CAs between www.pluginsmithy.com and "UTN-USERFirst-Hardware", and Firefox does not.

I was able to track down a site that does use a certificate from the same CA (PositiveSSL):

https://vc10.eukhost.com/~lionblad/lionblade/

When I invoke that site with Firefox, the page opens without warning, and when looking at the certificate I can see the following certificate hierarchy: "vc10.eukhost.com" -> "PositiveSSL CA" -> "UTN-USERFirst-Hardware" -> "AddTrust External CA Root". When I invoke my own site I can only see "www.pluginsmithy.com" but no hierarchy above that.

I also did a packet trace when connecting both to https://vc10.eukhost.com/~lionblad/lionblade/ and to https://www.pluginsmithy.com:8181/, and I can see that vc10.eukhost.com does return the intermediate certificates *and* the www.pluginsmithy.com certificate, while www.pluginsmithy.com only returns the www.pluginsmithy.com certificate. So I'm currently suspecting that I did something wrong when configuring Glassfish, but the mystery is how IE does get the correct certificate hierarchy.

Regards
Stephan
[Message sent by forum member 'smuehlst' (smuehlst)]

http://forums.java.net/jive/thread.jspa?messageID=252002

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@...
For additional commands, e-mail: users-help@...

[glassfish-2]

Just a thought, but to confirm / clear whether its a glassfish issue, have you tried taking the same certificate and importing it into say SunOne Web, Apache or IIS and see everything works as expected?

I checked out your cert in Firefox 2 and IE 6 and the Issuer is different across the two. I don't know if thats because I'm not receiving the intermediate or its just a difference in the browsers.

Also, just for my own curiosity, do you not have any plans to front-end your app tier with a web-tier?

HTH,

Andrew
[Message sent by forum member 'areplogle' (areplogle)]

http://forums.java.net/jive/thread.jspa?messageID=252117

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@...
For additional commands, e-mail: users-help@...

[glassfish-2]

> Just a thought, but to confirm / clear whether its a
> glassfish issue, have you tried taking the same
> certificate and importing it into say SunOne Web,
> Apache or IIS and see everything works as expected?

No I did not yet try this, but this is a good suggestion, I will see whether I can set up the certificate with Apache.

> I checked out your cert in Firefox 2 and IE 6 and the
> Issuer is different across the two. I don't know if
> thats because I'm not receiving the intermediate or
> its just a difference in the browsers.

I switched the certificate intermediately back to the default one that comes with Glassfish, but as far as I remember this was before I posted this thread, so it would be very strange to get different issuers of the certificate...

> Also, just for my own curiosity, do you not have any
> plans to front-end your app tier with a web-tier?

I have a web-tier which is implemented with the Magnolia CMS, and a web application implemented with JSF. Because I will run the site in a memory-constrained environment (virtual server with 400 MB physical RAM) I'm leaving out anything unnecessary, including Apache. What you currently see is the Magnolia login dialog. Because I'm still building and testing the site I have protected it with a password.

> HTH,
>
> Andrew

Thanks
Stephan
[Message sent by forum member 'smuehlst' (smuehlst)]

http://forums.java.net/jive/thread.jspa?messageID=252151

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@...
For additional commands, e-mail: users-help@...

[Jeanfrancois Arcand-2]

Hi,

might be a bug in GlassFish. Can you switch your https port to listen
using blocking socket? Just edit
${glassfish.home}/domains/domain1/config/domain.xml and set the
blocking-enabled="true":

  <http-listener acceptor-threads="1" address="0.0.0.0"
blocking-enabled="true" default-virtual-server="server" enabled="true"
family="inet" .... >

and see if that works. Also what is your current ssl element
configuration under your https lister (look for something like:

  <ssl cert-nickname="s1as" client-auth-enabled="false"
ssl2-enabled="false" ssl3-enabled="false" tls-enabled="true"
tls-rollback-enabled="tr
ue"/>

Thanks

-- Jeanfrancois

glassfish@... wrote:

>> Just a thought, but to confirm / clear whether its a
>> glassfish issue, have you tried taking the same
>> certificate and importing it into say SunOne Web,
>> Apache or IIS and see everything works as expected?
>
> No I did not yet try this, but this is a good suggestion, I will see whether I can set up the certificate with Apache.
>
>> I checked out your cert in Firefox 2 and IE 6 and the
>> Issuer is different across the two. I don't know if
>> thats because I'm not receiving the intermediate or
>> its just a difference in the browsers.
>
> I switched the certificate intermediately back to the default one that comes with Glassfish, but as far as I remember this was before I posted this thread, so it would be very strange to get different issuers of the certificate...
>
>> Also, just for my own curiosity, do you not have any
>> plans to front-end your app tier with a web-tier?
>
> I have a web-tier which is implemented with the Magnolia CMS, and a web application implemented with JSF. Because I will run the site in a memory-constrained environment (virtual server with 400 MB physical RAM) I'm leaving out anything unnecessary, including Apache. What you currently see is the Magnolia login dialog. Because I'm still building and testing the site I have protected it with a password.
>
>> HTH,
>>
>> Andrew
>
> Thanks
> Stephan
> [Message sent by forum member 'smuehlst' (smuehlst)]
>
> http://forums.java.net/jive/thread.jspa?messageID=252151
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@...
> For additional commands, e-mail: users-help@...
>

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@...
For additional commands, e-mail: users-help@...

[glassfish-2]

Hello Jeanfrancois,

>...
> might be a bug in GlassFish. Can you switch your
> https port to listen
> using blocking socket? Just edit
> ${glassfish.home}/domains/domain1/config/domain.xml
> and set the
> blocking-enabled="true":
>
> <http-listener acceptor-threads="1"
>  address="0.0.0.0"
> locking-enabled="true"
> default-virtual-server="server" enabled="true"
> family="inet" .... >
>
> and see if that works. Also what is your current ssl
> element
> configuration under your https lister (look for
> something like:
>

I made the proposed change, restarted Glassfish and visited again https://www.pluginsmithy.com:8181 with Firefox 2.0.0.11 on Linux. The symptoms haven't change, the certificate is still not recognized.

This are the current settings for the https listener in my domain.xml (I believe I haven't changed anything from the defaults except the "cert-nickname"):

<http-listener acceptor-threads="1" address="0.0.0.0" blocking-enabled="true" default-virtual-server="server" enabled="true" family="inet" id="http-listener-2" port="8181" security-enabled="true" server-name="" xpowered-by="true">
  <ssl cert-nickname="pluginsmithy" client-auth-enabled="false" ssl2-enabled="false" ssl3-enabled="true" tls-enabled="true" tls-rollback-enabled="true"/>
</http-listener>

Can I do anything else to troubleshoot this?

Thanks
Stephan
[Message sent by forum member 'smuehlst' (smuehlst)]

http://forums.java.net/jive/thread.jspa?messageID=252560

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@...
For additional commands, e-mail: users-help@...

[Jeanfrancois Arcand-2]

Hi,

glassfish@... wrote:

> Hello Jeanfrancois,
>
>> ...
>> might be a bug in GlassFish. Can you switch your
>> https port to listen
>> using blocking socket? Just edit
>> ${glassfish.home}/domains/domain1/config/domain.xml
>> and set the
>> blocking-enabled="true":
>>
>> <http-listener acceptor-threads="1"
>>  address="0.0.0.0"
>> locking-enabled="true"
>> default-virtual-server="server" enabled="true"
>> family="inet" .... >
>>
>> and see if that works. Also what is your current ssl
>> element
>> configuration under your https lister (look for
>> something like:
>>
>
> I made the proposed change, restarted Glassfish and visited again https://www.pluginsmithy.com:8181 with Firefox 2.0.0.11 on Linux. The symptoms haven't change, the certificate is still not recognized.
>
> This are the current settings for the https listener in my domain.xml (I believe I haven't changed anything from the defaults except the "cert-nickname"):
>
> <http-listener acceptor-threads="1" address="0.0.0.0" blocking-enabled="true" default-virtual-server="server" enabled="true" family="inet" id="http-listener-2" port="8181" security-enabled="true" server-name="" xpowered-by="true">
>   <ssl cert-nickname="pluginsmithy" client-auth-enabled="false" ssl2-enabled="false" ssl3-enabled="true" tls-enabled="true" tls-rollback-enabled="true"/>
> </http-listener>
>
> Can I do anything else to troubleshoot this?

Hum....I would have liked the blocking mode to work so it would have
been easy to fix. Now since the two mode are failing, this is a little
more complicated. Before filling a bug, one last try: can you add, in
domain.xml:

-Dcom.sun.enterprise.web.connector.useCoyoteConnector=true

if that doesn't work, can you file a bug:

https://glassfish.dev.java.net/servlets/ProjectIssues

(category security). Try to enter as much as information that you have
so we can easily reproduce the problem.

Thanks

--Jeanfrancois

>
> Thanks
> Stephan
> [Message sent by forum member 'smuehlst' (smuehlst)]
>
> http://forums.java.net/jive/thread.jspa?messageID=252560
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@...
> For additional commands, e-mail: users-help@...
>

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@...
For additional commands, e-mail: users-help@...

[glassfish-2]

>...
> Hum....I would have liked the blocking mode to work
> so it would have
> been easy to fix. Now since the two mode are failing,
> this is a little
> more complicated. Before filling a bug, one last try:
> can you add, in
> domain.xml:
>
> -Dcom.sun.enterprise.web.connector.useCoyoteConnector=
> true

I assume that I was supposed to add that as a JVM option, correct? I added this as a JVM option, restarted Glassfish and retried, and the behavior hasn't changed with Firefox.

> if that doesn't work, can you file a bug:
>
> https://glassfish.dev.java.net/servlets/ProjectIssues
>
> (category security). Try to enter as much as
> information that you have
> so we can easily reproduce the problem.
>

I will try to collect the information, but it is probably not "easily reproducible" with my information information alone, because it will mean to order a test certificate from the SSL certificate provider that I used.

Just to make sure that I don't bother the developers unnecessarily: Is it sufficiently proven that I didn't make a mistake when setting up the certificate in Glassfish because of the fact that Internet Explorer accepts the certificate without warning? Could it not be possible that IE maybe has built-in knowledge about the intermediate certificates that Firefox doesn't have?

Thanks
Stephan
[Message sent by forum member 'smuehlst' (smuehlst)]

http://forums.java.net/jive/thread.jspa?messageID=252826

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@...
For additional commands, e-mail: users-help@...

[glassfish-2]

Salut,

I've no idea why it works with IE but not with Firefox :-( Maybe you should ask the question to the Firefox user list? Sorry I can't help more here....

Thanks

-- Jeanfrancois
[Message sent by forum member 'jfarcand' (jfarcand)]

http://forums.java.net/jive/thread.jspa?messageID=253046

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@...
For additional commands, e-mail: users-help@...

[glassfish-2]

Hello Jeanfrancois,

I finally solved this problem, and the end of the story is that the test certificate was not correctly imported into the keystore.

In my original post I had mentioned three blog/wiki entries that I had read for instructions. But the one that I actually followed was the last one (http://blogs.sun.com/enterprisetechtips/entry/using_ssl_with_glassfish_v2), which proposes to use a small Java program to import the certificate into the keystore. This Java program seems not to work correctly in my case.

After rereading the instructions of the certificate provider I imported the certificate with keytool, and that did work. Also Firefox does now see the intermediate certificates and accepts the test certificate without any warning.

Thanks
Stephan
[Message sent by forum member 'smuehlst' (smuehlst)]

http://forums.java.net/jive/thread.jspa?messageID=253573

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@...
For additional commands, e-mail: users-help@...

[glassfish-2]

Hi,


> In my original post I had mentioned three blog/wiki
> entries that I had read for instructions. But the one
> that I actually followed was the last one
> (http://blogs.sun.com/enterprisetechtips/entry/using_s
> sl_with_glassfish_v2), which proposes to use a small
> Java program to import the certificate into the
> keystore. This Java program seems not to work
> correctly in my case.

I am curious what is wrong with the java code. This tip was written by me and i  would like to know in what way you used it and how does your keystore listing look after running this piece of code.

Thanks.
[Message sent by forum member 'kumarjayanti' (kumarjayanti)]

http://forums.java.net/jive/thread.jspa?messageID=253695

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@...
For additional commands, e-mail: users-help@...

[Jeanfrancois Arcand-2]

Thanks Stephan,

if you can blog about how you did it, that would be great! Or better,
you can add the steps to the troubleshooting guide here:

http://wiki.glassfish.java.net/Wiki.jsp?page=TroubleshootingGuide

A+

-- Jeanfrancois


glassfish@... wrote:

> Hello Jeanfrancois,
>
> I finally solved this problem, and the end of the story is that the test certificate was not correctly imported into the keystore.
>
> In my original post I had mentioned three blog/wiki entries that I had read for instructions. But the one that I actually followed was the last one (http://blogs.sun.com/enterprisetechtips/entry/using_ssl_with_glassfish_v2), which proposes to use a small Java program to import the certificate into the keystore. This Java program seems not to work correctly in my case.
>
> After rereading the instructions of the certificate provider I imported the certificate with keytool, and that did work. Also Firefox does now see the intermediate certificates and accepts the test certificate without any warning.
>
> Thanks
> Stephan
> [Message sent by forum member 'smuehlst' (smuehlst)]
>
> http://forums.java.net/jive/thread.jspa?messageID=253573
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: users-unsubscribe@...
> For additional commands, e-mail: users-help@...
>

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@...
For additional commands, e-mail: users-help@...

[glassfish-2]

Hello Kumar,

I followed your procedure with one difference. I did not delete the "s1as" default self-signed certificate and recreated it, but I created directly a new one with a different alias.

These were the steps according to my protocol:

1) Create private key:

keytool -genkeypair -keyalg RSA -keystore glassfish/domains/domain1/config/keystore.jks -validity 700 -alias pluginsmithy

2) Generate CSR:

keytool -certreq -alias pluginsmithy -file pluginsmithy.csr -keystore  glassfish/domains/domain1/config/keystore.jks

3) Requested and received test certificate from the vendor

4) Imported the Comodo intermediate certificates according to the following URL, but did not yet install the certificate itself

https://support.comodo.com/index.php?_m=knowledgebase&_a=viewarticle&kbarticleid=897

5) Invoked the Java program from your blog entry (I had renamed the Main class to ImportCert), www.pluginsmithy.com.crt is the file containing the test certificate

java ImportCert www.pluginsmithy.com.crt keystore.jks <keystore password> pluginsmithy

When I do a keytool -list -v on the keystore after that, I see the pluginsmithy certificate like this:

Alias name: pluginsmithy
Creation date: Jan 15, 2008
Entry type: keyEntry
Certificate chain length: 1
Certificate[1]:
Owner: CN=www.pluginsmithy.com, OU=EuropeanSSL Trial, OU=Provided by www.EuropeanSSL.eu (EUNETIC GmbH), OU=Domain Control Validated
Issuer: CN=PositiveSSL CA, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GB
Serial number: a29bf232df45295531e739d764c39f99
Valid from: Wed Jan 02 01:00:00 CET 2008 until: Sat Feb 02 00:59:59 CET 2008
Certificate fingerprints:
         MD5:  B2:E4:FC:64:8F:05:B5:FD:03:62:B6:93:7C:4E:0F:5E
         SHA1: DE:42:CD:7D:F0:21:64:21:1D:F3:96:D1:8E:CA:31:23:59:59:62:87

The procedure that actually worked was to follow the procedure from the support.comodo.com website until the last step. Instead of running the Java program I did the following (I had restored the keystore to state after the Comodo certificates were imported but before the Java program was invoked):

keytool -import -trustcacerts -alias pluginsmithy -file www.pluginsmithy.com.crt -keystore keystore.jks

When I do a keytool list -v on the keystore after that, the entry under the "pluginsmithy" alias looks different:

Alias name: pluginsmithy
Creation date: Jan 13, 2008
Entry type: keyEntry
Certificate chain length: 4
Certificate[1]:
Owner: CN=www.pluginsmithy.com, OU=EuropeanSSL Trial, OU=Provided by www.EuropeanSSL.eu (EUNETIC GmbH), OU=Domain Control Validated
Issuer: CN=PositiveSSL CA, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GB
Serial number: a29bf232df45295531e739d764c39f99
Valid from: Wed Jan 02 01:00:00 CET 2008 until: Sat Feb 02 00:59:59 CET 2008
Certificate fingerprints:
         MD5:  B2:E4:FC:64:8F:05:B5:FD:03:62:B6:93:7C:4E:0F:5E
         SHA1: DE:42:CD:7D:F0:21:64:21:1D:F3:96:D1:8E:CA:31:23:59:59:62:87
Certificate[2]:
Owner: CN=PositiveSSL CA, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GB
Issuer: CN=UTN-USERFirst-Hardware, OU=http://www.usertrust.com, O=The USERTRUST Network, L=Salt Lake City, ST=UT, C=US
Serial number: 4ccd4a9a5b4513218ccf902f8b2b5171
Valid from: Mon Sep 18 02:00:00 CEST 2006 until: Sat May 30 12:48:38 CEST 2020
Certificate fingerprints:
         MD5:  DE:AA:8D:D6:00:57:F5:BD:4C:42:E1:2E:EE:9B:41:DD
         SHA1: DD:C5:8C:53:DF:2E:F2:B2:66:20:BF:1C:A7:D4:15:FF:98:CD:B4:84
Certificate[3]:
Owner: CN=UTN-USERFirst-Hardware, OU=http://www.usertrust.com, O=The USERTRUST Network, L=Salt Lake City, ST=UT, C=US
Issuer: CN=AddTrust External CA Root, OU=AddTrust External TTP Network, O=AddTrust AB, C=SE
Serial number: 26211bf52aeb51b00bfa9fdd8d36da9e
Valid from: Tue Jun 07 10:09:10 CEST 2005 until: Sat May 30 12:48:38 CEST 2020
Certificate fingerprints:
         MD5:  35:F3:4B:25:5C:F0:C9:FE:C0:0F:02:81:25:00:91:CF
         SHA1: F5:EF:6B:80:C1:3C:1C:D3:22:8E:4F:A1:4F:A4:CA:E7:C0:C8:5A:79
Certificate[4]:
Owner: CN=AddTrust External CA Root, OU=AddTrust External TTP Network, O=AddTrust AB, C=SE
Issuer: CN=AddTrust External CA Root, OU=AddTrust External TTP Network, O=AddTrust AB, C=SE
Serial number: 1
Valid from: Tue May 30 12:48:38 CEST 2000 until: Sat May 30 12:48:38 CEST 2020
Certificate fingerprints:
         MD5:  1D:35:54:04:85:78:B0:3F:42:42:4D:BF:20:73:0A:3F
         SHA1: 02:FA:F3:E2:91:43:54:68:60:78:57:69:4D:F5:E4:5B:68:85:18:68

You see that there's now a certificate chain of length 4 instead of 1 under the pluginsmithy alias which includes the intermediate certificates.

I hope this helps you to find out whether I made a mistake or whether there's a flaw in your program.

Thanks
Stephan
[Message sent by forum member 'smuehlst' (smuehlst)]

http://forums.java.net/jive/thread.jspa?messageID=254056

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@...
For additional commands, e-mail: users-help@...

[glassfish-2]

Hello Jeanfrancois,

> Thanks Stephan,
>
> if you can blog about how you did it, that would be
> great! Or better,
> you can add the steps to the troubleshooting guide
> here:
>

unfortunately I don't understand what went wrong, so there's little that I could add to the troubleshooting guide... :-) Because my research and my questions on the list did lead nowhere and in the end even the Glassfish experts had no idea, I just took a step back and restarted with alternative instructions which did turn out to work.

So thanks once more for your help. I hope my other reply in this thread to Kumar's question will shed some light on what the problem was.

Regards
Stephan
[Message sent by forum member 'smuehlst' (smuehlst)]

http://forums.java.net/jive/thread.jspa?messageID=254060

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@...
For additional commands, e-mail: users-help@...

[glassfish-2]

Thanks. I tried to post a comment on my original tip with a code modification that might solve the issue.

rgds,
Kumar
[Message sent by forum member 'kumarjayanti' (kumarjayanti)]

http://forums.java.net/jive/thread.jspa?messageID=254127

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@...
For additional commands, e-mail: users-help@...

[glassfish-2]

Hi,
I am having the same problem Stephan had but with an SSL certificate issued by VeriSign (non trial version) - I get a security popup message in FireFox that the certificate was issued by an unrecognized authority. In IE it works fine. VeriSign customer support sent me an intermediate certificate and told me I need to install it in glassfish and this is suppose to fix it but I have no idea how to install the intermediate certificate in glassfish. Can someone please tell me how to install it ?

Thanks,
Asaf
[Message sent by forum member 'asafb' (asafb)]

http://forums.java.net/jive/thread.jspa?messageID=281003

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@...
For additional commands, e-mail: users-help@...

[glassfish-2]

Please use keytool and import the cert into GlassFish truststore  domains/domainx/cacerts.jks

Can you send the exception that you are seeing.

thanks.
[Message sent by forum member 'kumarjayanti' (kumarjayanti)]

http://forums.java.net/jive/thread.jspa?messageID=281209

---------------------------------------------------------------------
To unsubscribe, e-mail: users-unsubscribe@...
For additional commands, e-mail: users-help@...