title: Which permission to set, to avoid error with Security-Manager with https-URLS?
body: <p>In a software for a customer we have to read given URLs to parse their content. Also the customer needs to activate Tomcat-Security-Manager to let Java-Policies control what the program does.</p>
  
  <p>Now, with reading URLs the exception "javax.net.ssl.SSLKeyException: RSA premaster secret error" happens, but only under certain conditions:</p>
  
  <ul>
  <li>if the URL is HTTPS but not for HTTP</li>
  <li>if the Security-Manager is activated, not when it is deactivated or
  if in a global grant-Block the AllPermission is set</li>
  <li>only with Java 6, not with Java 7 (the customer needs Java 6 currently)</li>
  <li>only with Tomcat6, not with Tomcat 7 (the customer needs Tomcat 6 currently)</li>
  </ul>
  
  <p>The Security-violation happens somewhere in Java-Code, an AllPermission restricted to our codebase doesn't prevent the error.</p>
  
  <p>So, does someone has an idea, which permission to set for Java 6, so that it can process HTTPS?</p>
  
  <p>Other information: It's running inside a tomcat, on a Debian-Linux with OpenJDK.</p>
  
  <p>EDIT: I added the Java-Param "-Djava.security.debug=access,failure" to Tomcats /etc/default/tomcat6 in the variable JAVA_OPTS. But in the Logs I have no additional messages. Might it be possible the code asks the permissions before triggering them?</p>
  
  <p>EDIT2: I found the correct place and got the full stacktrace (removed specific customer parts):</p>
  
  <pre><code>javax.net.ssl.SSLKeyException: RSA premaster secret error
  
              at [...]
              at javax.security.auth.Subject.doAsPrivileged(Subject.java:537)
              at javax.security.auth.Subject.doAsPrivileged(Subject.java:537)
              at javax.security.auth.Subject.doAsPrivileged(Subject.java:537)
              at javax.security.auth.Subject.doAsPrivileged(Subject.java:537)
              at javax.security.auth.Subject.doAsPrivileged(Subject.java:537)
              at javax.security.auth.Subject.doAsPrivileged(Subject.java:537)
              at javax.security.auth.Subject.doAsPrivileged(Subject.java:537)
              at javax.security.auth.Subject.doAsPrivileged(Subject.java:537)
              at javax.security.auth.Subject.doAsPrivileged(Subject.java:537)
              at javax.security.auth.Subject.doAsPrivileged(Subject.java:537)
              at java.lang.Thread.run(Thread.java:701)
      Caused by: java.security.NoSuchAlgorithmException: SunTlsRsaPremasterSecret KeyGenerator not available
              at javax.crypto.KeyGenerator.&lt;init&gt;(KeyGenerator.java:141)
              at javax.crypto.KeyGenerator.getInstance(KeyGenerator.java:191)
              ... 14 more
  </code></pre>
  
  <p>EDIT3: So far I was under the assumption that the Java-class URL was used to access the contents of the resource. But that is untrue. It is using from Grails-Code the Groovy-URL-object with the getText()-method:</p>
  
  <pre><code>new URL(params.url).text
  </code></pre>
  
  <p>The error is happening on this line. It's Grails-version 2.2.4.</p>