title: Burp Suite Proxy with java application
body: <p>I have java application that receive proxy settings.</p>
  
  <ol>
  <li><p>I exported der certificate from Burp Suite</p></li>
  <li><p>Imported this certificate to the java keystore with keytool:</p>
  
  <pre><code>keytool -import -trustcacerts -file ~/cacert_7.der -alias BURPSUITE -keystore /home/dmitriy/Test/java/lib/security/cacerts -storepass
  </code></pre></li>
  <li><p>Then check adding:</p>
  
  <pre><code>keytool -keystore /home/dmitriy/Test/java/lib/security/cacerts -list -storepass 
  
  burp, 03.05.2018, trustedCertEntry, 
  Certificate fingerprint (SHA1): 0A:3E:E0:C0:73:E6:0E:D9:5C:8F:0A:CC:31:E1:33:37:55:2A:85:BF
  </code></pre></li>
  <li><p>Run my application</p>
  
  <pre><code>java -jar Chameleon.jar -Djavax.net.ssl.trustStore=/home/dmitriy/Test/java/lib/security/cacerts -Djavax.net.ssl.trustStorePassword=***
  </code></pre></li>
  </ol>
  
  <p>But I still receive an error:</p>
  
  <pre><code>sun.security.validator.ValidatorException: No trusted certificate found
  </code></pre>
  
  <p>I import this certificate to the browser and it works fine, but I have problem with java file.</p>
  
  <blockquote>
    <p>java -version java version "1.8.0_131" Java(TM) SE Runtime Environment
    (build 1.8.0_131-b11) Java HotSpot(TM) 64-Bit Server VM (build
    25.131-b11, mixed mode)</p>
  </blockquote>
  
  <p>Trying with Fiddler and receive next error:</p>
  
  <blockquote>
    <p>The server (host.com) presented a certificate that did not validate, due to RemoteCertificateChainErrors.</p>
    
    <p>0 - PartialChain</p>
    
    <p>ISSUER: CN=RapidSSL SHA256 CA, O=GeoTrust Inc., C=US</p>
  </blockquote>
  
  <p><strong>Update:</strong></p>
  
  <p>When run with parametr: -Djavax.net.debug=all</p>
  
  <pre><code>adding as trusted cert:
    Subject: CN=Go Daddy Root Certificate Authority - G2, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US
    Issuer:  OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc.", C=US
    Algorithm: RSA; Serial number: 0x1be715
    Valid from Wed Jan 01 09:00:00 EET 2014 until Fri May 30 10:00:00 EEST 2031
  
  adding as trusted cert:
    Subject: CN=RapidSSL CA, O="GeoTrust, Inc.", C=US
    Issuer:  CN=GeoTrust Global CA, O=GeoTrust Inc., C=US
    Algorithm: RSA; Serial number: 0x236d1
    Valid from Sat Feb 20 00:45:05 EET 2010 until Wed Feb 19 00:45:05 EET 2020
  
  Ignoring unsupported cipher suite: TLS_DHE_DSS_WITH_AES_256_GCM_SHA384
  Ignoring unsupported cipher suite: TLS_DHE_DSS_WITH_AES_128_CBC_SHA256
  Ignoring unsupported cipher suite: TLS_DHE_RSA_WITH_AES_128_CBC_SHA256
  Ignoring unsupported cipher suite: TLS_DHE_DSS_WITH_AES_128_GCM_SHA256
  Ignoring unsupported cipher suite: TLS_DHE_RSA_WITH_AES_256_GCM_SHA384
  Ignoring unsupported cipher suite: TLS_DHE_RSA_WITH_AES_128_GCM_SHA256
  Ignoring unsupported cipher suite: TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
  Ignoring unsupported cipher suite: TLS_RSA_WITH_AES_256_CBC_SHA256
  Ignoring unsupported cipher suite: TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
  Ignoring unsupported cipher suite: TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256
  Ignoring unsupported cipher suite: TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384
  Ignoring unsupported cipher suite: TLS_RSA_WITH_AES_128_CBC_SHA256
  Ignoring unsupported cipher suite: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384
  Ignoring unsupported cipher suite: TLS_RSA_WITH_AES_128_GCM_SHA256
  Ignoring unsupported cipher suite: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256
  Ignoring unsupported cipher suite: TLS_RSA_WITH_AES_256_GCM_SHA384
  Ignoring unsupported cipher suite: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384
  Ignoring unsupported cipher suite: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256
  Ignoring unsupported cipher suite: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
  Ignoring unsupported cipher suite: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
  Ignoring unsupported cipher suite: TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384
  Ignoring unsupported cipher suite: TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256
  Ignoring unsupported cipher suite: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384
  Ignoring unsupported cipher suite: TLS_DHE_RSA_WITH_AES_256_CBC_SHA256
  Ignoring unsupported cipher suite: TLS_DHE_DSS_WITH_AES_256_CBC_SHA256
  Ignoring unsupported cipher suite: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
  Ignoring unsupported cipher suite: TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
  Ignoring unsupported cipher suite: TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
  </code></pre>
  
  <p>Trying to regenerate certificate with option “Use custom protocols and ciphers” but certificate still not trusted:</p>
  
  <pre><code>Owner: CN=PortSwigger CA, OU=PortSwigger CA, O=PortSwigger, L=PortSwigger, ST=PortSwigger, C=PortSwigger
  Issuer: CN=PortSwigger CA, OU=PortSwigger CA, O=PortSwigger, L=PortSwigger, ST=PortSwigger, C=PortSwigger
  Serial number: 536e02a9
  Valid from: Sat May 10 13:42:49 EEST 2014 until: Mon May 10 13:42:49 EEST 2038
  Certificate fingerprints:
       MD5:  FC:8B:C8:A1:9E:92:08:33:F2:0B:34:F1:48:85:D0:BB
       SHA1: 21:C3:01:1C:9E:7C:06:92:2E:A9:B7:38:12:3B:3D:8E:FA:39:72:17
       SHA256: 36:EE:79:A9:7A:5E:4E:E5:4C:8B:5E:AD:6B:9C:2F:A8:EA:63:A6:65:44:9E:4B:20:5E:DE:EA:37:32:FB:C5:96
  Signature algorithm name: SHA256withRSA
  Subject Public Key Algorithm: 2048-bit RSA key
  Version: 3
  
  Extensions: 
  
  #1: ObjectId: 2.5.29.19 Criticality=true
  BasicConstraints:[
    CA:true
    PathLen:0
  ]
  
  #2: ObjectId: 2.5.29.14 Criticality=false
  SubjectKeyIdentifier [
  KeyIdentifier [
  0000: D1 92 05 BB 78 6B 76 71   64 92 E2 F9 9A C8 81 CA  ....xkvqd.......
  0010: E1 71 BF 81                                        .q..
  ]
  ]
  </code></pre>
  
  <p><strong>Update 2:</strong></p>
  
  <p>Problem was with trustcacerts, this file was inside jar archive. So I get this file from jar import my cert and then move it back and application start.</p>