Test of java SSL / keystore / cert setup. Check the comment #1 for howto.

SSLPoke.java

import javax.net.ssl.SSLParameters;
import javax.net.ssl.SSLSocket;
import javax.net.ssl.SSLSocketFactory;
import java.io.*;

/** Establish a SSL connection to a host and port, writes a byte and
 * prints the response. See
 * http://confluence.atlassian.com/display/JIRA/Connecting+to+SSL+services
 */
public class SSLPoke {
    public static void main(String[] args) {
        if (args.length != 2) {
            System.out.println("Usage: "+SSLPoke.class.getName()+" <host> <port>");
            System.exit(1);
        }
        try {
            SSLSocketFactory sslsocketfactory = (SSLSocketFactory) SSLSocketFactory.getDefault();
            SSLSocket sslsocket = (SSLSocket) sslsocketfactory.createSocket(args[0], Integer.parseInt(args[1]));

            SSLParameters sslparams = new SSLParameters();
            sslparams.setEndpointIdentificationAlgorithm("HTTPS");
            sslsocket.setSSLParameters(sslparams);

            InputStream in = sslsocket.getInputStream();
            OutputStream out = sslsocket.getOutputStream();

            // Write a test byte to get a reaction :)
            out.write(1);

            while (in.available() > 0) {
                System.out.print(in.read());
            }
            System.out.println("Successfully connected");

        } catch (Exception exception) {
            exception.printStackTrace();
            System.exit(1);
        }
    }
}

Test of java SSL / keystore / cert setup. Came from https://confluence.atlassian.com/download/attachments/117455/SSLPoke.java

Usage:

1. extract cert from server:
   openssl s_client -connect server:443
2. negative test cert / keytool:
   java SSLPoke server 443
   you should get something like
   javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
3. import cert into default keytool:
   keytool -import -alias alias.server.com -keystore $JAVA_HOME/jre/lib/security/cacerts
4. positive test cert / keytool:
   java SSLPoke server 443
   you should get this:
   Successfully connected

Credits:

• atlassian for the base code
• Steve Clark @stclark-incomm for setting SSLParameters

Thanks! Helped us to debug a cert issue.

Doesn't seems work as I thought it should work. it doesn't check if the server certificate is matching with the parameter.

example:

java SSLPoke ip.address.of.sslserver 443
Successfully connected

So it doesn't really check the certificate?

@jackchen858 +1 It does not

It did not work for me.

I always get Successfully connected msg

Make sure you run this with the right java in case you have multiple installations

Works brilliantly. Thanks

Thanks a lot. Followed your instructions. Fix worked perfectly.

How to use it behind a proxy ?

For those not living in the Java World here is how I compiled and used this:

• Copy code to somewhere
• Call Java compiler /usr/java/jdk1.6.0_45/bin/javac /tmp/SSLPoke.java (use your version of Java here)
• Call tool with ClassPath (-cp) that you copied the file to: /usr/java/jdk1.6.0_45/bin/java -cp /tmp SSLPoke my-url.com 443

Very useful thanks.

A note however, instead of updating the java JRE/JDK installation's keystore, best practices dictates that you should define your own truststore (if you have company CA or application certificates for example):

# import certificate into your local TrustStore
keytool -import -trustcacerts -storepass changeit -file "./class 1 root ca.cer" -alias C1_ROOT_CA -keystore ./LocalTrustStore
# use it in JAVA:
java -Djavax.net.ssl.trustStore=./LocalTrustStore -jar SSLPoke.jar $HOST $PORT

Will the default trustStore be overwritten by -Djavax.net.ssl.trustStore or is the new trustStore an addition to the default one? @Tzaphkiel

Thanks for sharing. When I try the negative test , I have the exception :

javax.net.ssl.SSLException: java.lang.RuntimeException: Could not generate DH keypair
at com.sun.net.ssl.internal.ssl.Alerts.getSSLException(Alerts.java:190)
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1747)
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1708)
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.handleException(SSLSocketImpl.java:1691)
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.handleException(SSLSocketImpl.java:1617)
at com.sun.net.ssl.internal.ssl.AppOutputStream.write(AppOutputStream.java:105)
at com.sun.net.ssl.internal.ssl.AppOutputStream.write(AppOutputStream.java:114)
at SSLPoke.main(SSLPoke.java:23)
Caused by: java.lang.RuntimeException: Could not generate DH keypair
at com.sun.net.ssl.internal.ssl.DHCrypt.(DHCrypt.java:114)
at com.sun.net.ssl.internal.ssl.ClientHandshaker.serverKeyExchange(ClientHandshaker.java:559)
at com.sun.net.ssl.internal.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:186)
at com.sun.net.ssl.internal.ssl.Handshaker.processLoop(Handshaker.java:593)
at com.sun.net.ssl.internal.ssl.Handshaker.process_record(Handshaker.java:529)
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:943)
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1188)
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.writeRecord(SSLSocketImpl.java:654)
at com.sun.net.ssl.internal.ssl.AppOutputStream.write(AppOutputStream.java:100)
... 2 more
Caused by: java.security.InvalidAlgorithmParameterException: Prime size must be multiple of 64, and can only range from 512 to 1024 (inclusive)
at com.sun.crypto.provider.DHKeyPairGenerator.initialize(DashoA13*..)
at java.security.KeyPairGenerator$Delegate.initialize(KeyPairGenerator.java:627)
at com.sun.net.ssl.internal.ssl.DHCrypt.(DHCrypt.java:107)

Any idea why I have this ? Another thing can you tell me how I can generate a certificate file from a server ?

@jmara -Djavax.net.ssl.trustStore will override the default truststore (cacerts). You can copy the default one and then add your cert and set it via -Djavax.net.ssl.trustStore so you don't lose the default CAs.

Works well! Thanks

P.S. If you don't use the default keystore, you'll need to pass it and the password for the keystore into your command as arguments.

Thanks guys, these steps helped me debug why a couple of Atlassian products couldn't talk to each other. I got it working for now, but in my "ideal" world since every release of an Atlassian product includes it's own JRE, I will automate the above steps into a script to inject the "peer" applications' (hosted on other servers) certificates into only the "vendored" JRE cacerts to allow them to trust each other and this way I'm not polluting the system but I can link all the applications to each other without a bunch of warnings and failures.

Thanks guys, just a +1 that is helping me debug an SSL issue on Weblogic between AdminServer and NodeManager.

Cheers!

I am having trouble w.r.t local certificate.

$java SSLPoke localwc.in 443
Successfully connected

$ java SSLPoke localwc.in 8443
javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure
...

$ java -Dhttps.protocols=TLSv1,TLSv1.1,TLSv1.2 SSLPoke localwc.in 8443
javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure

$ java -Djavax.ssl.trustStore=~/Developer/apache-tomcat-8.0.26/ssl/cacerts SSLPoke localwc.in 8443
javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure

$ keytool -list -v -keystore ~/Developer/apache-tomcat-8.0.26/ssl/cacerts
##This shows entry for my localhost as localwc.in as

---

Alias name: localwc.in
Creation date: 2 Mar, 2018
Entry type: trustedCertEntry

.....

---

I am accessing 8443 via tomcat.
How can I overcome it?

http://portecle.sourceforge.net/ is also a very useful tool for loading and testing the Java Trust Store database

thanks for the tool here my example how I used it:
Compile

C:\IBM\WebSphere\AppServer\java\8.0\bin\javac C:\tools\JavaSSL\SSLPoke.java

run like

C:\IBM\WebSphere\AppServer\java\8.0\jre\bin\java -cp C:\tools\JavaSSL SSLPoke myserver.com 636

run with keystore

C:\IBM\WebSphere\AppServer\java\8.0\jre\bin\java -Djavax.net.ssl.trustStore=C:\IBM\WebSphere\AppServer\profiles\MyAppSrv01\config\cells\MyNode01Cell\nodes\MyNode01\trust.p12 -Djavax.net.ssl.trustStorePassword=mypass123 -Djavax.net.ssl.trustStoreType=pkcs12 -cp C:\tools\JavaSSL SSLPoke myserver.com 636

Successfully connected

Hi and Thanks! What's the license of this gist? I noticed https://github.com/MichalHecko/SSLPoke which has Apache, but you are the author?

@simonredfern: the code was shamelessly stolen from Atlassian support , there were no license in code or on the site, just code drop.
I found another link to the code https://confluence.atlassian.com/display/JIRA052/Connecting+to+SSL+services which states "Except where otherwise noted, content in this space is licensed under a Creative Commons Attribution 2.5 Australia License".

I built an online ssl trust checker online
https://www.nmmapper.com/troubleshooting/tools/ssl-trust-checker/online/

It did not work for me.

I always get Successfully connected msg

me too.

I just ran across this and had a similar complaint that it isn't validating the hostname. Fortunately it's an easy fix to add SSLParamters

import javax.net.ssl.SSLParameters;
import javax.net.ssl.SSLSocket;
import javax.net.ssl.SSLSocketFactory;
import java.io.*;

/** Establish a SSL connection to a host and port, writes a byte and
 * prints the response. See
 * http://confluence.atlassian.com/display/JIRA/Connecting+to+SSL+services
 */
public class SSLPoke {
    public static void main(String[] args) {
        if (args.length != 2) {
            System.out.println("Usage: "+SSLPoke.class.getName()+" <host> <port>");
            System.exit(1);
        }
        try {
            SSLSocketFactory sslsocketfactory = (SSLSocketFactory) SSLSocketFactory.getDefault();
            SSLSocket sslsocket = (SSLSocket) sslsocketfactory.createSocket(args[0], Integer.parseInt(args[1]));
            SSLParameters sslparams = new SSLParameters();
            sslparams.setEndpointIdentificationAlgorithm("HTTPS");
            sslsocket.setSSLParameters(sslparams);

            InputStream in = sslsocket.getInputStream();
            OutputStream out = sslsocket.getOutputStream();

            // Write a test byte to get a reaction :)
            out.write(1);

            while (in.available() > 0) {
                System.out.print(in.read());
            }
            System.out.println("Successfully connected");

        } catch (Exception exception) {
            exception.printStackTrace();
        }
    }
}

I just ran across this and had a similar complaint that it isn't validating the hostname. Fortunately it's an easy fix to add SSLParamters

Merged. Thanks, Steve!

And System.exit(1); in catch would be fantastic as I use this within CI and rely on the return code.

And System.exit(1); in catch would be fantastic as I use this within CI and rely on the return code.

thanks for your suggestion, done.

@dadez Better late than never, here's an updated version from tthe original code with proxy support :

https://gist.github.com/bric3/4ac8d5184fdc80c869c70444e591d3de

@dadez Better late than never, here's an updated version from tthe original code with proxy support :

https://gist.github.com/bric3/4ac8d5184fdc80c869c70444e591d3de

thanks

I made a version that show the current setting of all known (to me) Java properties, which a relevant for TLS:
https://github.com/klasen/sslpoke