• View
• Edit
• History
• Print

SSLSockets

Notes about using Vert.x Sockets with SSL. This illustrates the problem, how to tackle it and a solution.

Meta Summary

This nicely illustrates one way to solve problems:

1. Reproduce the problem
2. Track down the error message(s)
3. Search for similar exceptions
4. Implement a solution

In this case, I had to add better error reporting to accessors because the inner Exception that describes the cause was not being reported.

Problem

Running a model that uses Vert.x and SSL over sockets was failing:

In addition, a Ptolemy error window pops up that says: Client: Failed to connect: General SSLEngine Problem

The problems with the above window:

1. There is no notion of the cause of the error
2. There is no notion of what code generated the error
3. The name of the actor that caused the dialog is not shown. It says "Client", which is probably the name, but it is not totally clear to me that it is the name.

A Ptolemy Stack Trace Window with a Go to Actor button would help.

NetServerImpl

On standard out or err, the message

  Nov 23, 2015 6:20:56 PM io.vertx.core.net.impl.NetServerImpl
  SEVERE: Client from origin /127.0.0.1:63791 failed to connect over ssl

Comes from io/vertx/core/net/impl/NetServerImpl.java:

It looks like io.netty.handler.ssl.SslHandler has a role here.

This seems like a bit of a time sink, so let's look at the other error information.

Ptolemy Error Window

One issue here is that the error window (see above) has no stack trace.

A little sleuthing indicates that ptolemy/actor/lib/jjs/JavaScript.java contains an error(String message) method that is invoked by ptolemy/actor/lib/jjs/VertxHelperBase.java

Adding error(String message, Throwable throwable) to JavaScript.java and modifying _error() in VertxHelperBase to call

Means that we get an error window with a stack trace:

The stack trace is:

Vert.x Example Aside

Maybe looking at this the Vert.x example at https://github.com/vert-x/vertx-examples/blob/master/src/raw/java/ssl/SSLClient.java would help:

This calls setTrustAll(true), which is fine for example code, but not very secure.

• setTrustAll() - "Set whether all server certificates should be trusted".
• See How to ignore PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException? (StackOverflow) indicates that this will enable Man In The Middle (MITM) attacks.
• About self-signed certificates and MITM, see https://www.sslshopper.com/article-when-are-self-signed-certificates-acceptable.html

Error Handling Aside

The VertxHelperBase error handling was updated to properly include the exception that is being thrown and the actor.

PKIX path building failed

With the change to error handling, the new exception is below:

Search for the Error Message

I searched for

  PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

and StackOverflow had a number of suggestions that boiled down to two choices

1. Ignore or automatically add the certificate
2. Add the certificate by hand

Add the cert to cacerts

It looks like the thing to do is to add the cert to the cacerts file

Export the cert:

Find the cacerts file. Under Mac OS X, I have JAVA_HOME set so that I can use ant.

As root, update the cacerts file. The default password is changeit:

Success!

If I run the model, then it works.