title: How do I retrieve an untrusted SSL server certificate in order to review and trust it?
body: <p>My problem:</p>
  
  <p>I want to connect to servers (not limited to the HTTPS protocol -- could be LDAP-over-SSL, could be SMTPS, could be IMAPS, etc.) that may be using certificates that Java will not trust by default (because they are self-signed).  </p>
  
  <p>The desired workflow is to attempt the connection, retrieve the certificate info, present that to the user and if he accepts it, add it to to the truststore so it'll be trusted going forward.</p>
  
  <p>I am stuck at retrieving the certificate.  I have code (see at the end of the post) that I've cribbed from here and from sites pointed to by answers to questions about java SSL. The code simply creates an <code>SSLSocket</code>, starts the SSL handshake, and asks the SSL session for the <code>Certificate[]</code>.  The code works fine when I'm connecting to a server using an already-trustable certificate.  But when I connect to a server using a self-signed cert I get the usual:</p>
  
  <pre><code>Exception in thread "main" javax.net.ssl.SSLHandshakeException: 
     sun.security.validator.ValidatorException: PKIX path building failed:
     sun.security.provider.certpath.SunCertPathBuilderException: unable to 
     find valid certification path to requested target
          at sun.security.ssl.Alerts.getSSLException(Unknown Source)
          at sun.security.ssl.SSLSocketImpl.fatal(Unknown Source)
          at sun.security.ssl.Handshaker.fatalSE(Unknown Source)
          at sun.security.ssl.Handshaker.fatalSE(Unknown Source)
          at sun.security.ssl.ClientHandshaker.serverCertificate(Unknown Source)
          [etc]
  </code></pre>
  
  <p>If I run with <code>-Djavax.net.debug=all</code> I see that the JVM does retrieve the self-signed cert but will blow up the connection for using an untrusted cert before getting to the point where it'll return the certificates.</p>
  
  <p>Seems like a chicken-and-egg problem.  It will not let me see the certificates because they are not trusted.  But I need to see the certificates to be able to add them to the truststore so they will be trusted.  How do you break out of this?</p>
  
  <p>For example, if I run the program as:</p>
  
  <pre><code>java SSLTest www.google.com 443
  </code></pre>
  
  <p>I get a printout of the certs Google is using.  But if I run it as</p>
  
  <pre><code>java SSLTest my.imap.server 993
  </code></pre>
  
  <p>I get the exception referenced above.</p>
  
  <p>The code:</p>
  
  <pre><code>import java.io.InputStream;
  import java.io.OutputStream;
  import java.security.cert.*;
  import javax.net.SocketFactory;
  import javax.net.ssl.*;
  
  public class SSLTest
  {
      public static void main(String[] args) throws Exception {
          if (args.length != 2) {
              System.err.println("Usage: SSLTest host port");
              return;
          }
  
          String host = args[0];
          int port = Integer.parseInt(args[1]);
  
          SocketFactory factory = SSLSocketFactory.getDefault();
          SSLSocket socket = (SSLSocket) factory.createSocket(host, port);
  
          socket.startHandshake();
  
          Certificate[] certs = socket.getSession().getPeerCertificates();
  
          System.out.println("Certs retrieved: " + certs.length);
          for (Certificate cert : certs) {
              System.out.println("Certificate is: " + cert);
              if(cert instanceof X509Certificate) {
                  try {
                      ( (X509Certificate) cert).checkValidity();
                      System.out.println("Certificate is active for current date");
                  } catch(CertificateExpiredException cee) {
                      System.out.println("Certificate is expired");
                  }
              }
          }
      }
  }
  </code></pre>