Problem connecting to lab.open-roberta.org because of unknown certificate / protocol mismatch

[burgr033]

Hi,

we encountered following problem, somewhat after october we could not connect to lab.open-roberta.org via the connector.

After a debug session, we found out, that the problem (we actually encountered ourselves previously with different software) was that the Java cacerts file does not know the Harica CA which is used for certificates @ lab.open-roberta.org.

As mentioned in #28, this can be solved by injecting the CA Certificates from Harica into the Java-Keystore manually.

I just wanted to inform you about this issue, that is related to the certificate used over at lab.open-roberta.org. I don't think this is your problem to solve, but I would suggest improving the error handling in openURLConnection().

The error we saw first, was a 400 http bad request error. The URL which it tried to connect to was http://lab.open-roberta.org:443/rest/pushcmd. Which should fail because of the protocol mismatch. This happens because after catching the real error (certificate unknown) it tries to connect anyway using http, which fails. The underlying error is caught, but never presented anywhere and get's shadowed by the protocol mismatch.

[Bodo73]

Hi,
how should I solve this on a Windows System? The example in 28 is on MacOS.

[burgr033]

it's basically the same. You need to find the keytool.exe from your java installation (the one that runs the connector) and the file "cacerts"

from https://www.ibm.com/docs/en/tnpm/1.4.2?topic=security-import-certificate-jre-keystore

Procedure

Locate the keystore location in the JRE.

Typically this keystore is at JAVA_HOME\jre\lib\security\cacerts.

The keytool that is used to access the keystore is typically installed with the JRE and ready to use.
Run the standard keytool to import the certificate, from JAVA_HOME\jre\lib\security.

keytool.exe -import -trustcacerts -alias mdecert -file C:\temp\mdeCert.cer -keystore cacerts

When prompted Trust this certificate? [no]:, enter "yes".

This imports the certificate into the keystore and display the message: "Certificate was added to keystore".