#

# OpenSSL example configuration file.

# This is mostly being used for generation of certificate requests.

#

# This definition stops the following lines choking if HOME isn't

# defined.

HOME = .

RANDFILE = $ENV::HOME/.rnd

# Extra OBJECT IDENTIFIER info:

#oid_file = $ENV::HOME/.oid

oid_section = new_oids

# To use this configuration file with the "-extfile" option of the

# "openssl x509" utility, name here the section containing the

# X.509v3 extensions to use:

# extensions =

# (Alternatively, use a configuration file that has only

# X.509v3 extensions in its main [= default] section.)

[ new_oids ]

# We can add new OIDs in here for use by 'ca' and 'req'.

# Add a simple OID like this:

# testoid1=1.2.3.4

# Or use config file substitution like this:

# testoid2=${testoid1}.5.6

####################################################################

[ ca ]

default_ca = CA_default # The default ca section

####################################################################

[ CA_default ]

dir = ./demoCA # Where everything is kept

certs = $dir/certs # Where the issued certs are kept

crl_dir = $dir/crl # Where the issued crl are kept

database = $dir/index.txt # database index file.

new_certs_dir = $dir/newcerts # default place for new certs.

certificate = $dir/cacert.pem # The CA certificate

serial = $dir/serial # The current serial number

crl = $dir/crl.pem # The current CRL

private_key = $dir/private/cakey.pem# The private key

RANDFILE = $dir/private/.rand # private random number file

x509_extensions = usr_cert # The extentions to add to the cert

# Comment out the following two lines for the "traditional"

# (and highly broken) format.

name_opt = ca_default # Subject Name options

cert_opt = ca_default # Certificate field options

# Extension copying option: use with caution.

# copy_extensions = copy

# Extensions to add to a CRL. Note: Netscape communicator chokes on V2 CRLs

# so this is commented out by default to leave a V1 CRL.

# crl_extensions = crl_ext

default_days = 1825 # how long to certify for

default_crl_days= 30 # how long before next CRL

default_md = md5 # which md to use.

preserve = no # keep passed DN ordering

# A few difference way of specifying how similar the request should look

# For type CA, the listed attributes must be the same, and the optional

# and supplied fields are just that :-)

policy = policy_match

# For the CA policy

[ policy_match ]

countryName = match

stateOrProvinceName = match

organizationName = match

organizationalUnitName = optional

commonName = supplied

emailAddress = optional

# For the 'anything' policy

# At this point in time, you must list all acceptable 'object'

# types.

[ policy_anything ]

countryName = optional

stateOrProvinceName = optional

localityName = optional

organizationName = optional

organizationalUnitName = optional

commonName = supplied

emailAddress = optional

####################################################################

[ req ]

default_bits = 1024

default_keyfile = privkey.pem

distinguished_name = req_distinguished_name

attributes = req_attributes

x509_extensions = v3_ca # The extentions to add to the self signed cert

# Passwords for private keys if not present they will be prompted for

# input_password = secret

# output_password = secret

# This sets a mask for permitted string types. There are several options.

# default: PrintableString, T61String, BMPString.

# pkix : PrintableString, BMPString.

# utf8only: only UTF8Strings.

# nombstr : PrintableString, T61String (no BMPStrings or UTF8Strings).

# MASK:XXXX a literal mask value.

# WARNING: current versions of Netscape crash on BMPStrings or UTF8Strings

# so use this option with caution!

string_mask = nombstr

# req_extensions = v3_req # The extensions to add to a certificate request

[ req_distinguished_name ]

countryName = Country Name (2 letter code)

countryName_default =

countryName_min = 2

countryName_max = 2

stateOrProvinceName = State or Province Name (full name)

stateOrProvinceName_default =

localityName = Locality Name (eg, city)

localityName_default =

0.organizationName = Organization Name (eg, company)

0.organizationName_default =

# we can do this but it is not needed normally :-)

#1.organizationName = Second Organization Name (eg, company)

#1.organizationName_default = World Wide Web Pty Ltd

organizationalUnitName = Organizational Unit Name (eg, section)

organizationalUnitName_default = team

commonName = Common Name (eg, your name or your server\'s hostname)

commonName_default = dev-ssl.google.com

commonName_max = 64

# 만약 하나의 인증서로 다른 서버도 같이 쓸 수 있음. 아래의 예제와 같이 진행하면 됨

#0.commonName = Common Name (eg, your name or your server\'s hostname)

#0.commonName_default = dev-ssl.google.com

#0.commonName_max = 64

#1.commonName = Common Name (eg, your name or your server\'s hostname)

#1.commonName_default = alpha-ssl.google.com

#1.commonName_max = 64

#2.commonName = Common Name (eg, your name or your server\'s hostname)

#2.commonName_default = beta-ssl.google.com

#2.commonName_max = 64

#3.commonName = Common Name (eg, your name or your server\'s hostname)

#3.commonName_default = dev-id.google.com

#3.commonName_max = 64

#4.commonName = Common Name (eg, your name or your server\'s hostname)

#4.commonName_default = dev-member.google.com

#4.commonName_max = 64

emailAddress = Email Address

emailAddress.default = (메일)

emailAddress_max = 64

# SET-ex3 = SET extension number 3

[ req_attributes ]

challengePassword = A challenge password

challengePassword_min = 4

challengePassword_max = 20

unstructuredName = An optional company name

[ usr_cert ]

# These extensions are added when 'ca' signs a request.

# This goes against PKIX guidelines but some CAs do it and some software

# requires this to avoid interpreting an end user certificate as a CA.

basicConstraints=CA:FALSE

# Here are some examples of the usage of nsCertType. If it is omitted

# the certificate can be used for anything *except* object signing.

# This is OK for an SSL server.

# nsCertType = server

# For an object signing certificate this would be used.

# nsCertType = objsign

# For normal client use this is typical

# nsCertType = client, email

# and for everything including object signing:

# nsCertType = client, email, objsign

# This is typical in keyUsage for a client certificate.

# keyUsage = nonRepudiation, digitalSignature, keyEncipherment

# This will be displayed in Netscape's comment listbox.

nsComment = "OpenSSL Generated Certificate"

# PKIX recommendations harmless if included in all certificates.

subjectKeyIdentifier=hash

authorityKeyIdentifier=keyid,issuer:always

# This stuff is for subjectAltName and issuerAltname.

# Import the email address.

# subjectAltName=email:copy

# An alternative to produce certificates that aren't

# deprecated according to PKIX.

# subjectAltName=email:move

# Copy subject details

# issuerAltName=issuer:copy

#nsCaRevocationUrl = http://www.domain.dom/ca-crl.pem

#nsBaseUrl

#nsRevocationUrl

#nsRenewalUrl

#nsCaPolicyUrl

#nsSslServerName

[ v3_req ]

# Extensions to add to a certificate request

basicConstraints = CA:FALSE

keyUsage = nonRepudiation, digitalSignature, keyEncipherment

[ v3_ca ]

# Extensions for a typical CA

# PKIX recommendation.

subjectKeyIdentifier=hash

authorityKeyIdentifier=keyid:always,issuer:always

# This is what PKIX recommends but some broken software chokes on critical

# extensions.

#basicConstraints = critical,CA:true

# So we do this instead.

basicConstraints = CA:true

# Key usage: this is typical for a CA certificate. However since it will

# prevent it being used as an test self-signed certificate it is best

# left out by default.

# keyUsage = cRLSign, keyCertSign

# Some might want this also

# nsCertType = sslCA, emailCA

# Include email address in subject alt name: another PKIX recommendation

# subjectAltName=email:copy

# Copy issuer details

# issuerAltName=issuer:copy

# DER hex encoding of an extension: beware experts only!

# obj=DER:02:03

# Where 'obj' is a standard or added object

# You can even override a supported extension:

# basicConstraints= critical, DER:30:03:01:01:FF

[ crl_ext ]

# CRL extensions.

# Only issuerAltName and authorityKeyIdentifier make any sense in a CRL.

# issuerAltName=issuer:copy

authorityKeyIdentifier=keyid:always,issuer:always

REQ="openssl req $SSLEAY_CONFIG"

->

REQ="openssl req $SSLEAY_CONFIG -nodes"

]# mkdir certs

]# cd certs

]# /usr/share/ssl/misc/CA –newca

CA certificate filename (or enter to create) (엔터)

Making CA certificate ...

Generating a 1024 bit RSA private key

.....................++++++

.........................++++++

writing new private key to './demoCA/private/./cakey.pem'

Enter PEM pass phrase:

Verifying - Enter PEM pass phrase:

-----

You are about to be asked to enter information that will be incorporated

into your certificate request.

What you are about to enter is what is called a Distinguished Name or a DN.

There are quite a few fields but you can leave some blank

For some fields there will be a default value,

If you enter '.', the field will be left blank.

-----

Country Name (2 letter code) [GB]:(입력)

State or Province Name (full name) [Berkshire]:(입력)

Locality Name (eg, city) [Newbury]:(입력)

Organization Name (eg, company) [My Company Ltd]:(입력)

Organizational Unit Name (eg, section) []:(입력)

Common Name (eg, your name or your server's hostname) [dev-ssl.google.com]: (입력)

Email Address []:(입력)

]# cd demoCA/

]# openssl x509 -in cacert.pem -days 3650 -out cacert.pem -signkey ./private/cakey.pem

Getting Private key

Enter pass phrase for ./private/cakey.pem:

]# /usr/share/ssl/misc/CA -newreq

Generating a 1024 bit RSA private key

......++++++

..........................++++++

writing new private key to 'newreq.pem'

Enter PEM pass phrase:

Verifying - Enter PEM pass phrase:

-----

You are about to be asked to enter information that will be incorporated

into your certificate request.

What you are about to enter is what is called a Distinguished Name or a DN.

There are quite a few fields but you can leave some blank

For some fields there will be a default value,

If you enter '.', the field will be left blank.

-----

Country Name (2 letter code) [GB]:(엔터)

State or Province Name (full name) [Berkshire]:(엔터)

Locality Name (eg, city) [Newbury]:(엔터)

Organization Name (eg, company) [My Company Ltd]:(엔터)

Organizational Unit Name (eg, section) []:(엔터)

Common Name (eg, your name or your server's hostname) [dev-ssl.google.com]:(dev-ssl.google.com 엔터)

Email Address []:(입력)

Please enter the following 'extra' attributes

to be sent with your certificate request

A challenge password []: (엔터)

An optional company name []: (엔터)

Request (and private key) is in newreq.pem

]# cp newreq.pem ..

]# cd ..

]# ls -al

drwxr-xr-x 3 root root 4096 11 15:09 .

drwxr-xr-x 8 root root 4096 11 15:06 ..

drwxr-xr-x 6 root root 4096 11 15:07 demoCA

-rw-r--r-- 1 root root 1667 11 15:09 newreq.pem

]# /usr/share/ssl/misc/CA -sign

Using configuration from /usr/share/ssl/openssl.cnf

Enter pass phrase for ./demoCA/private/cakey.pem:

Check that the request matches the signature

Signature ok

Certificate Details:

Serial Number: 1 (0x1)

Validity

Not Before: Mar 11 06:10:07 2011 GMT

Not After : Mar 10 06:10:07 2012 GMT

Subject:

countryName =

stateOrProvinceName =

localityName =

organizationName =

organizationalUnitName =

commonName = dev-ssl.google.com

emailAddress = 메일

X509v3 extensions:

X509v3 Basic Constraints:

CA:FALSE

Netscape Comment:

OpenSSL Generated Certificate

X509v3 Subject Key Identifier:

77:BC:33:80:3E:07:F3:10:40:71:D0:EE:49:F6:53:93:66:DB:6A:20

X509v3 Authority Key Identifier:

keyid:B4:8A:40:59:12:D6:3A:44:FC:27:31:A9:3E:D6:D8:B7:CD:40:08:EB

DirName:/C=/ST=/L=/O=/OU=test/CN=dev-ssl.google.com/emailAddress=

serial:00

Certificate is to be certified until Mar 10 06:10:07 2012 GMT (365 days)

Sign the certificate? [y/n]:(y엔터)

1 out of 1 certificate requests certified, commit? [y/n](y엔터)

Write out database with 1 new entries

Data Base Updated

Certificate:

Data:

Version: 3 (0x2)

Serial Number: 1 (0x1)

Signature Algorithm: md5WithRSAEncryption

Issuer: C=, ST=, L=, O=, OU=, CN=dev-ssl.google.com/emailAddress=메일

Validity

Not Before: Mar 11 06:10:07 2011 GMT

Not After : Mar 10 06:10:07 2012 GMT

Subject: C=, ST=, L=, O=, OU=, CN=dev-ssl.google.com/emailAddress=메일

Subject Public Key Info:

Public Key Algorithm: rsaEncryption

RSA Public Key: (1024 bit)

Modulus (1024 bit):

00:ce:0d:60:77:08:7b:8b:35:6e:97:dd:58:d3:0e:

81:ed:1b:d7:55:f6:c1:49:dc:e2:07:93:08:ca:1d:

27:8e:cd:19:30:fc:98:b7:c3:89:0a:98:43:aa:cf:

7e:8c:24:53:1a:87:1c:c1:13:10:0e:db:a5:09:e4:

c3:79:0f:9b:1a:48:4b:51:50:63:bb:9a:23:c9:8f:

e4:b0:a3:5b:74:3c:a7:fe:98:06:3c:fc:47:0e:ed:

d8:e5:b1:3e:e1:8c:c1:e9:11:6e:ec:d4:84:0a:51:

67:7c:2b:86:ac:7d:16:b6:65:90:77:95:88:d2:29:

e4:60:4d:73:59:2e:82:70:c5

Exponent: 65537 (0x10001)

X509v3 extensions:

X509v3 Basic Constraints:

CA:FALSE

Netscape Comment:

OpenSSL Generated Certificate

X509v3 Subject Key Identifier:

77:BC:33:80:3E:07:F3:10:40:71:D0:EE:49:F6:53:93:66:DB:6A:20

X509v3 Authority Key Identifier:

keyid:B4:8A:40:59:12:D6:3A:44:FC:27:31:A9:3E:D6:D8:B7:CD:40:08:EB

DirName:/C=/ST=/L=/O=/OU=/CN=dev-ssl.google.com/emailAddress=메일

serial:00

Signature Algorithm: md5WithRSAEncryption

3c:d4:9b:79:9c:e3:eb:45:52:26:6d:12:61:27:a0:e6:4e:dc:

c3:3a:59:6d:6a:d0:a5:62:e3:88:f5:c9:26:e2:35:15:01:8d:

65:2f:1d:b6:2e:be:62:83:db:cf:80:0b:c6:cc:3c:00:b3:7f:

9a:ce:b0:35:fd:a5:c1:b7:aa:fb:5d:40:2c:4f:39:64:ba:f1:

c3:f8:10:aa:26:d0:5c:30:a1:3b:81:00:a6:77:6e:c5:33:ef:

25:c8:be:c1:c5:2b:40:e2:83:32:a1:a4:e2:99:91:95:d2:da:

83:3e:64:66:45:d3:86:25:db:aa:67:98:d4:fb:2f:cd:31:24:

0a:d7

-----BEGIN CERTIFICATE-----

MIIDqzCCAxSgAwIBAgIBATANBgkqhkiG9w0BAQQFADCBizELMAkGA1UEBhMCS1Ix

EDAOBgNVBAgTB0t5dW5nZ2kxEDAOBgNVBAcTB0J1bmRhbmcxDDAKBgNVBAoTA05I

TjENMAsGA1UECxMEdGVzdDEcMBoGA1UEAxMTZGV2LXNzbC5uaG5jb3JwLmNvbTEd

MBsGCSqGSIb3DQEJARYOa25pZ2h0QG5obi5jb20wHhcNMTEwMzExMDYxMDA3WhcN

MTIwMzEwMDYxMDA3WjCBjzELMAkGA1UEBhMCS1IxEDAOBgNVBAgTB0t5dW5nZ2kx

EDAOBgNVBAcTB0J1bmRhbmcxDDAKBgNVBAoTA05ITjENMAsGA1UECxMEdGVhbTEc

MBoGA1UEAxMTZGV2LXNzbC5uaG5jb3JwLmNvbTEhMB8GCSqGSIb3DQEJARYSa25p

Z2h0QG5obmNvcnAuY29tMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDODWB3

CHuLNW6X3VjTDoHtG9dV9sFJ3OIHkwjKHSeOzRkw/Ji3w4kKmEOqz36MJFMahxzB

ExAO26UJ5MN5D5saSEtRUGO7miPJj+Swo1t0PKf+mAY8/EcO7djlsT7hjMHpEW7s

1IQKUWd8K4asfRa2ZZB3lYjSKeRgTXNZLoJwxQIDAQABo4IBFzCCARMwCQYDVR0T

BAIwADAsBglghkgBhvhCAQ0EHxYdT3BlblNTTCBHZW5lcmF0ZWQgQ2VydGlmaWNh

dGUwHQYDVR0OBBYEFHe8M4A+B/MQQHHQ7kn2U5Nm22ogMIG4BgNVHSMEgbAwga2A

FLSKQFkS1jpE/CcxqT7W2LfNQAjroYGRpIGOMIGLMQswCQYDVQQGEwJLUjEQMA4G

A1UECBMHS3l1bmdnaTEQMA4GA1UEBxMHQnVuZGFuZzEMMAoGA1UEChMDTkhOMQ0w

CwYDVQQLEwR0ZXN0MRwwGgYDVQQDExNkZXYtc3NsLm5obmNvcnAuY29tMR0wGwYJ

KoZIhvcNAQkBFg5rbmlnaHRAbmhuLmNvbYIBADANBgkqhkiG9w0BAQQFAAOBgQA8

1Jt5nOPrRVImbRJhJ6DmTtzDOlltatClYuOI9ckm4jUVAY1lLx22Lr5ig9vPgAvG

zDwAs3+azrA1/aXBt6r7XUAsTzlkuvHD+BCqJtBcMKE7gQCmd27FM+8lyL7BxStA

4oMyoaTimZGV0tqDPmRmRdOGJduqZ5jU+y/NMSQK1w==

-----END CERTIFICATE-----

Signed certificate is in newcert.pem

]# ls -al

drwxr-xr-x 3 root root 4096 11 15:09 .

drwxr-xr-x 8 root root 4096 11 15:06 ..

drwxr-xr-x 6 root root 4096 11 15:10 demoCA

-rw-r--r-- 1 root root 3616 11 15:10 newcert.pem

-rw-r--r-- 1 root root 1667 11 15:09 newreq.pem

]# mv newreq.pem dev-ssl.node.key

]# mv newcert.pem dev-ssl.node.crt

Validity

Not Before: Mar 11 06:10:07 2011 GMT

Not After : Mar 10 06:10:07 2012 GMT

DAYS=”-days 365”

->

DAYS="-days 1280"

$CA -policy policy_anything -out newcert.pem -infiles newreq.pem

->

$CA -policy policy_anything -out newcert.pem -in newreq.pem $DAYS

Validity

Not Before: Mar 11 10:46:21 2011 GMT

Not After : Mar 8 10:46:21 2021 GMT

<IfModule mod_ssl.c>

SSLRandomSeed startup builtin

SSLRandomSeed connect builtin

Listen 443

AddType application/x-x509-ca-cert .crt

AddType application/x-pkcs7-crl .crl

SSLPassPhraseDialog builtin

SSLSessionCache dbm:/home/www/httpd/logs/ssl_scache

SSLSessionCacheTimeout 300

SSLMutex file: /home/www/httpd/logs/ssl_mutex

</IfModule>

..

<VirtualHost *:443>

DocumentRoot /home/www/deploy

ServerName dev-ssl.google.com

<Directory "/home/www/deploy/service">

Options -Indexes FollowSymLinks MultiViews

AllowOverride None

Order allow,deny

Allow from all

FileETag None

</Directory>

<IfModule mod_ssl.c>

SSLEngine on

SSLCipherSuite ALL:!ADH:!EXPORT56:RC4+RSA:+HIGH:+MEDIUM:+LOW:!SSLv2:+EXP:+eNULL

SSLCertificateFile /home/www/httpd/conf/dev-ssl.node.crt

SSLCertificateKeyFile /home/www/httpd/conf/dev-ssl.node.key

SetEnvIf User-Agent ".*MSIE.*" \

nokeepalive ssl-unclean-shutdown \

downgrade-1.0 force-response-1.0

</IfModule>

]# wget https://dev-ssl.google.com/

[root@e61127 certs2]# wget https://dev-ssl.google.com/

--14:51:58-- https://dev-ssl.google.com/

=> `index.html'

Resolving dev-ssl.google.com... 1.1.1.1

Connecting to dev-ssl.google.com|1.1.1.1|:443... connected.

ERROR: Certificate verification error for dev-ssl.google.com: unable to get local issuer certificate

To connect to dev-ssl.google.com insecurely, use `--no-check-certificate'.

Unable to establish SSL connection.

]# wget --no-check-certificate https://dev-ssl.google.com/

--14:55:21-- https://dev-ssl.google.com/

=> `index.html.1'

Resolving dev-ssl.google.com... 10.25.149.50

Connecting to dev-ssl.google.com|10.25.149.50|:443... connected.

WARNING: Certificate verification error for dev-ssl.google.com: unable to get local issuer certificate

HTTP request sent, awaiting response... 200 OK

Length: 11 [text/html]

100%[===============================>] 11 --.--K/s

14:55:21 (565.38 KB/s) - `index.html' saved [11/11]

import org.apache.commons.httpclient.HttpClient;

import org.apache.commons.httpclient.HttpStatus;

import org.apache.commons.httpclient.methods.GetMethod;

public class Test {

public static void main(String[] args) throws Exception {

byte[] responseBody = null;

HttpClient client = new HttpClient();

GetMethod method = new GetMethod("https://dev-ssl.google.com");

int responseCode = client.executeMethod(method);

if (responseCode != HttpStatus.SC_OK) {

System.out.println("Method failed: " + method.getStatusLine());

} else {

responseBody = method.getResponseBody();

System.out.println(new String(responseBody));

}

}

}

Exception in thread "main" javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

at com.sun.net.ssl.internal.ssl.Alerts.getSSLException(Alerts.java:174)

at com.sun.net.ssl.internal.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1649)

at com.sun.net.ssl.internal.ssl.Handshaker.fatalSE(Handshaker.java:241)

at com.sun.net.ssl.internal.ssl.Handshaker.fatalSE(Handshaker.java:235)

at com.sun.net.ssl.internal.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1206)

at com.sun.net.ssl.internal.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:136)

at com.sun.net.ssl.internal.ssl.Handshaker.processLoop(Handshaker.java:593)

at com.sun.net.ssl.internal.ssl.Handshaker.process_record(Handshaker.java:529)

at com.sun.net.ssl.internal.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:893)

at com.sun.net.ssl.internal.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1138)

at com.sun.net.ssl.internal.ssl.SSLSocketImpl.writeRecord(SSLSocketImpl.java:632)

at com.sun.net.ssl.internal.ssl.AppOutputStream.write(AppOutputStream.java:59)

at java.io.BufferedOutputStream.flushBuffer(BufferedOutputStream.java:65)

at java.io.BufferedOutputStream.flush(BufferedOutputStream.java:123)

at org.apache.commons.httpclient.HttpConnection.flushRequestOutputStream(HttpConnection.java:827)

at org.apache.commons.httpclient.HttpMethodBase.writeRequest(HttpMethodBase.java:1975)

at org.apache.commons.httpclient.HttpMethodBase.execute(HttpMethodBase.java:993)

at org.apache.commons.httpclient.HttpMethodDirector.executeWithRetry(HttpMethodDirector.java:397)

at org.apache.commons.httpclient.HttpMethodDirector.executeMethod(HttpMethodDirector.java:170)

at org.apache.commons.httpclient.HttpClient.executeMethod(HttpClient.java:396)

at org.apache.commons.httpclient.HttpClient.executeMethod(HttpClient.java:324)

at org.Test.main(Test.java:13)

Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:323)

at sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:217)

at sun.security.validator.Validator.validate(Validator.java:218)

at com.sun.net.ssl.internal.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:126)

at com.sun.net.ssl.internal.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:209)

at com.sun.net.ssl.internal.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:249)

at com.sun.net.ssl.internal.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1185)

... 17 more

Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:174)

at java.security.cert.CertPathBuilder.build(CertPathBuilder.java:238)

at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:318)

... 23 more

]# javac InstallCert.java

]# java InstallCert dev-ssl.google.com:443

Loading KeyStore C:\Program Files\Java\jre6\lib\security\cacerts...

Opening connection to dev-ssl.google.com:443...

Starting SSL handshake...

javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException:

PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderExce

ption: unable to find valid certification path to requested target

at com.sun.net.ssl.internal.ssl.Alerts.getSSLException(Unknown Source)

at com.sun.net.ssl.internal.ssl.SSLSocketImpl.fatal(Unknown Source)

at com.sun.net.ssl.internal.ssl.Handshaker.fatalSE(Unknown Source)

at com.sun.net.ssl.internal.ssl.Handshaker.fatalSE(Unknown Source)

at com.sun.net.ssl.internal.ssl.ClientHandshaker.serverCertificate(Unkno

wn Source)

at com.sun.net.ssl.internal.ssl.ClientHandshaker.processMessage(Unknown

Source)

at com.sun.net.ssl.internal.ssl.Handshaker.processLoop(Unknown Source)

at com.sun.net.ssl.internal.ssl.Handshaker.process_record(Unknown Source

)

at com.sun.net.ssl.internal.ssl.SSLSocketImpl.readRecord(Unknown Source)

at com.sun.net.ssl.internal.ssl.SSLSocketImpl.performInitialHandshake(Un

known Source)

at com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(Unknown Sou

rce)

at com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(Unknown Sou

rce)

at org.InstallCert.main(InstallCert.java:88)

Caused by: sun.security.validator.ValidatorException: PKIX path building failed:

sun.security.provider.certpath.SunCertPathBuilderException: unable to find vali

d certification path to requested target

at sun.security.validator.PKIXValidator.doBuild(Unknown Source)

at sun.security.validator.PKIXValidator.engineValidate(Unknown Source)

at sun.security.validator.Validator.validate(Unknown Source)

at com.sun.net.ssl.internal.ssl.X509TrustManagerImpl.validate(Unknown So

urce)

at com.sun.net.ssl.internal.ssl.X509TrustManagerImpl.checkServerTrusted(

Unknown Source)

at org.InstallCert$SavingTrustManager.checkServerTrusted(InstallCert.jav

a:183)

... 9 more

Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to

find valid certification path to requested target

at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(Unknown

Source)

at java.security.cert.CertPathBuilder.build(Unknown Source)

... 15 more

Server sent 1 certificate(s):

1 Subject CN=dev-ssl.google.com, O=My Company Ltd, L=Newbury, ST=Berkshire, C=

GB

Issuer CN=dev-ssl.google.com, O=My Company Ltd, L=Newbury, ST=Berkshire, C=

GB

sha1 e6 69 34 03 ec f2 b8 2e eb 57 ad 96 9f 25 a9 69 16 87 fc 90

md5 f0 a8 d1 63 65 8f 5c c6 a0 9b ea 4f 48 58 85 3d

Enter certificate to add to trusted keystore or 'q' to quit: [1]

1

[

[

Version: V3

Subject: CN=dev-ssl.google.com, O=My Company Ltd, L=Newbury, ST=Berkshire, C=

GB

Signature Algorithm: MD5withRSA, OID = 1.2.840.113549.1.1.4

Key: Sun RSA public key, 1024 bits

modulus: 164347762420350693911866588325014644788520374516295193084948890924394

29081792855076590616988805837259808518029679131404902167803255295786539153611119

63396590676780565399712003063159189376410163690837891366179294614852352512484317

28761333574986219672551265326558528460114938587517180908714459949305597793224899

public exponent: 65537

Validity: [From: Sat Mar 12 14:05:07 KST 2011,

To: Tue Mar 09 14:05:07 KST 2021]

Issuer: CN=dev-ssl.google.com, O=, L=, ST=, C=

SerialNumber: [ 01]

Certificate Extensions: 4

[1]: ObjectId: 2.16.840.1.113730.1.13 Criticality=false

Extension unknown: DER encoded OCTET string =

0000: 04 1F 16 1D 4F 70 65 6E 53 53 4C 20 47 65 6E 65 ....OpenSSL Gene

0010: 72 61 74 65 64 20 43 65 72 74 69 66 69 63 61 74 rated Certificat

0020: 65 e

[2]: ObjectId: 2.5.29.14 Criticality=false

SubjectKeyIdentifier [

KeyIdentifier [

0000: 9E 6F 1F 00 01 A4 3F 8E 8D 03 B8 6C 0B B5 57 27 .o....?....l..W'

0010: 3A 11 0C 70 :..p

]

]

[3]: ObjectId: 2.5.29.35 Criticality=false

AuthorityKeyIdentifier [

KeyIdentifier [

0000: F4 8D D1 BC BA 8F B4 17 3E 98 93 E9 04 59 5A 32 ........>....YZ2

0010: 41 3D DF 36 A=.6

]

[CN=dev-ssl.google.com, O=, L=, ST=, C=]

SerialNumber: [ 00]

]

[4]: ObjectId: 2.5.29.19 Criticality=false

BasicConstraints:[

CA:false

PathLen: undefined

]

]

Algorithm: [MD5withRSA]

Signature:

0000: 2A E4 E5 14 91 58 17 84 39 DE BA 8F 41 61 92 F3 *....X..9...Aa..

0010: FA 9C 01 70 D9 F9 44 DD B1 02 E4 D9 1D 7C 58 2A ...p..D.......X*

0020: 5A D9 39 E2 24 F7 DD 09 DC 3C 62 C7 09 3D 87 43 Z.9.$....<b..=.C

0030: 44 DC 68 FE 12 89 8E 54 62 94 3D B7 F5 2E 4E 30 D.h....Tb.=...N0

0040: 99 B8 CB 8A 6D 8D 3A 47 0A E3 5C 81 5F AE 4B CF ....m.:G..\._.K.

0050: 8E 3D 70 64 EA E2 72 C5 E7 21 27 74 19 80 91 95 .=pd..r..!'t....

0060: E8 D7 07 E1 9E 53 06 66 D0 4C 79 92 DC D7 4E 30 .....S.f.Ly...N0

0070: 8F 21 37 15 38 01 9F F1 E9 C1 E9 E5 99 03 FB F8 .!7.8...........

]

Added certificate to keystore 'jssecacerts' using alias 'dev-ssl.google.com-1'

]# keytool -list –keystore 실제위치/jssecacerts -storepass changeit | grep dev-ssl

dev-ssl.google.com-1, 2011. 3. 14, trustedCertEntry,

]# keytool -delete -alias dev-ssl.google.com-1 -keystore 실제위치/jssecacerts -storepass changeit

]# keytool -list -keystore 실제위치/jssecacerts -storepass changeit | grep dev

(결과 없음)

]# keytool.exe -list -keystore 실제위치/jssecacerts -storepass changeit | findstr dev-ssl

dev-ssl.google.com-1, 2011. 3. 14, trustedCertEntry,

]# keytool -delete -alias dev-ssl.google.com-1 -keystore 실제위치/jssecacerts -storepass changeit

]# keytool.exe -list -keystore 실제위치/jssecacerts -storepass changeit | findstr dev-ssl

(결과 없음)

[SECURITY] Apache Tomcat and the hashtable collision DoS vulnerability

11-12-29 (목) 07:28

보낸사람

: "Mark Thomas"<markt@apache.org> 주소록에 추가

받는사람

: "Tomcat Users List"<users@tomcat.apache.org>

참조    

: <announce@tomcat.apache.org>, <announce@apache.org>, "Tomcat Developers List"<dev@tomcat.apache.org>

You may have read about a recently announced vulnerability rooted in the
Java hashtable implementation [1]. Since Apache Tomcat uses a hashtable
for storing HTTP request parameters, it is affected by this issue.
As per [1], it appears that Oracle will not be providing a fix for this
vulnerability with in the JRE.
Tomcat has implemented a work-around for this issue by providing a new
option (maxParameterCount) to limit the number of parameters processed
for a single request. This default limit is 10000: high enough to be
unlikely to affect any application; low enough to mitigate the effects
of the DoS.
The work-around is available in:
trunk
7.0.23 onwards
6.0.35 onwards
The work-around will also be available in 5.5.35 once released.
If using an earlier version of Apache Tomcat that does not have the
maxParameterCount attribute available, limiting the maxPostSize to a few
10's of kB should also mitigate the issue although it may cause issues
for some applications.
While this is not viewed as a vulnerability in Apache Tomcat, the Apache
Tomcat security team is making this announcement due to the high
likelihood that applications will be affected by this issue and to make
users aware of the available work-arounds.
The Apache Tomcat security team
[1] http://www.nruns.com/_downloads/advisory28122011.pdf

tomcat/trunk/java/org/apache/catalina/connector/Connector.java

     /**
+     * The maximum number of parameters (GET plus POST) which will be
+     * automatically parsed by the container. 10000 by default. A value of less
+     * than 0 means no limit.
+     */
+    protected int maxParameterCount = 10000;

-    private final Hashtable<String,String[]> paramHashStringArray =
-        new Hashtable<String,String[]>();

==>

+    private final Hashtable<String,ArrayList<String>> paramHashValues =
+        new Hashtable<String,ArrayList<String>>();

-        String values[];
-        if (paramHashStringArray.containsKey(key)) {
-            String oldValues[] = paramHashStringArray.get(key);
-            values = new String[oldValues.length + newValues.length];
-            for (int i = 0; i < oldValues.length; i++) {
-                values[i] = oldValues[i];
-            }
-            for (int i = 0; i < newValues.length; i++) {
-                values[i+ oldValues.length] = newValues[i];
-            }
-         } else {
-            values = newValues;
          }
-        paramHashStringArray.put(key, values);
     }

==>

+        ArrayList<String> values;
+        if (paramHashValues.containsKey(key)) {
+             values = paramHashValues.get(key);
         } else {
+            values = new ArrayList<String>(1);
+            paramHashValues.put(key, values);
+        }
+        values.ensureCapacity(values.size() + newValues.length);
+        for (String newValue : newValues) {
+            values.add(newValue);
         }

public final class String
    implements java.io.Serializable, Comparable<String>, CharSequence
{

/** Cache the hash code for the string */
private int hash; // Default to 0

/**
     * Returns a hash code for this string. The hash code for a
     * <code>String</code> object is computed as
     * <blockquote><pre>
     * s[0]*31^(n-1) + s[1]*31^(n-2) + ... + s[n-1]
     * </pre></blockquote>
     * using <code>int</code> arithmetic, where <code>s[i]</code> is the
     * <i>i</i>th character of the string, <code>n</code> is the length of
     * the string, and <code>^</code> indicates exponentiation.
     * (The hash value of the empty string is zero.)
     *
     * @return  a hash code value for this object.
     */
    public int hashCode() {
    int h = hash;
        int len = count;
    if (h == 0 && len > 0) {
        int off = offset;
        char val[] = value;

            for (int i = 0; i < len; i++) {
                h = 31*h + val[off++];
            }
            hash = h;
        }
        return h;
    }

}

public class a1 {
    public static void main(String[] args) {
        System.out.println(new String("FB").hashCode());
        System.out.println(new String("Ea").hashCode());
    }
}

#결과
2236
2236

http://wiki.eclipse.org/M2E_plugin_execution_not_covered

https://issues.sonatype.org/browse/MNGECLIPSE-823에 내용에 있는 것처럼 리소스들과 컴파일이 안되는 문제가 발생되기도 했다. 0.12 버전 이하에서는 이클립스 빌드시 maven을 사용해서 컴파일을 했었다. 사실 이클립스 플러그인 개발입장에서는 그저 maven에 위임하는데, 어떤 “ Plug excution”이 동작하여 예상치 못하게 파일(리소스)가 날아가(missing) 버리거나 JVM, OS 리소스 부족으로 문제를 일으키는 경우가 있었다.

이 문제를 해결해가 위해서 1.0 부터는 빌드 lifecycle에 명확한 방법(explicit instructions)을 제공하였다. 이것을 “project build lifecycle mapping” (lifecycle mapping)이라고  한다. pom.xml 설정에 maven 빌드와 별도로플러그 실행(execution)에 대한 정보를 넣을 수 있게 하였다.

예를 들어 project build lifecycle mapping 정보가 없는 경우에 대해서는 다음과 같이 m2 이클립스 플러그인에서 에러로 처리한다고 한다.

Plugin execution not covered by lifecycle configuration:
org.apache.maven.plugins:maven-antrun-plugin:1.3:run
    (execution: generate-sources-input, phase: generate-sources)

이 문제를 해결하기 위해서 ignore 또는 execute goal을 넣어야 한다. 

Multiple annotations found at this line:
    - Plugin execution not covered by lifecycle configuration: org.codehaus.mojo:xml-maven-plugin:1.0:transform
     (execution: default, phase: process-resources)
    - Plugin execution not covered by lifecycle configuration: org.apache.maven.plugins:maven-antrun-plugin:1.3:run
     (execution: process-resources, phase: process-resources)
    - maven-dependency-plugin (goals "copy-dependencies", "unpack") is not supported by m2e.
    - Plugin execution not covered by lifecycle configuration: org.apache.maven.plugins:maven-antrun-plugin:1.3:run
     (execution: copy-base-resource, phase: generate-sources)

<?xml version="1.0" encoding="UTF-8"?>
<projectDescription>
    <name>xxx-parent</name>
    <comment></comment>
    <projects>
    </projects>
    <buildSpec>
        <buildCommand>
            <name>org.eclipse.jdt.core.javabuilder</name>
            <arguments>
            </arguments>
        </buildCommand>
        <buildCommand>
           <name>org.maven.ide.eclipse.maven2Builder</name>
            <name>org.eclipse.m2e.core.maven2Builder</name>
            <arguments>
            </arguments>
        </buildCommand>
    </buildSpec>
    <natures>
        <nature>org.maven.ide.eclipse.maven2Nature</nature>
        <nature>org.eclipse.jdt.core.javanature</nature>
       <nature>org.eclipse.m2e.core.maven2Nature</nature>
        
    </natures>
</projectDescription>

http://ko.wikipedia.org/wiki/CyanogenMod

CyanogenMod(시아노젠모드)는 안드로이드를 구동하는 일부 스마트폰에 설치 및 구동할 수 있는 비공식 안드로이드 펌웨어이다. 현재 60개 이상의 안드로이드 스마트폰에서 펌웨어 업데이트가 가능하며, FLAC, 멀티터치, microSD 카드에서의 프로그램 설치 및 실행, 캐시 압축(compcache), 거대 APN 리스트, 재부팅 메뉴, 와이파이, 블루투스, USB 테더링 등 대다수 공식 안드로이드 펌웨어에서 지원하지 않는 기능들을 다수 탑재하고 있다. 모바일 운영 체제 중에서는 최초로 BFS를 작업 스케줄러로 사용하는 운영 체제이기도 하며(이는 현재 안드로이드 공식 소스 트리에도 시범 반영되었다.^[1]) 경우에 따라서는 공식 안드로이드 펌웨어보다 높은 성능을 발휘하기도 한다. 2011년 4분기 현재 정식 배포 중인 CyanogenMod는 CM6과 CM7이고, 베타 테스트 중인 CyanogenMod는 CM8과 CM9이다.

CM9 - 안드로이드 4.0 아이스크림 샌드위치를 기반으로 한 CyanogenMod - 개발, 베타 테스트중