Knowledge

Qlik Sense: Certificate error with java ticketing solution javax.net.ssl.SSLHandshakeException

Article Number: 000078616 | Last Modified: 2019/09/25

Description

When trying to generate a ticket with the Qlik Sense Proxy API and calling the Qlik Sense server by its IP or a DNS name that is not included in the certificate, the error "javax.net.ssl.SSLHandshakeException: java.security.cert.CertificateException: No subject alternative names matching IP address 10.76.200.70 found"

Environments:

Qlik Sense June 2017 and later

Resolution

This is not as per say a Qlik Sense error, but a java error on handling certificate.
Unfortunately, this is not possible to add additional alternate names in the Qlik Sense QlikClient certificate used to call the Qlik Proxy API.

The recommended method to workaround this issue is to create a white list of host names for which certificate errors will be ignored.

Steps:

Create a folder package1

Create a file WhitelistHostnameVerifier.java with the following content:

package package1;

import javax.net.ssl.HostnameVerifier;
import javax.net.ssl.HttpsURLConnection;
import javax.net.ssl.SSLSession;
import java.util.HashSet;
import java.util.Set;

// singleton
enum WhitelistHostnameVerifier implements HostnameVerifier {
    // these hosts get whitelisted
    INSTANCE("localhost", "10.76.200.70");

    private Set<String> whitelist = new HashSet<>();
    private HostnameVerifier defaultHostnameVerifier =
            HttpsURLConnection.getDefaultHostnameVerifier();

    WhitelistHostnameVerifier(String... hostnames) {
        for (String hostname : hostnames) {
            whitelist.add(hostname);
        }
    }

    @Override
    public boolean verify(String host, SSLSession session) {
        if (whitelist.contains(host)) {
            return true;
        }
        // important: use default verifier for all other hosts
        return defaultHostnameVerifier.verify(host, session);
    }
}

In the Ticket.java file (which should also be placed in the package1 folder), add the following lines:

package package1;

import javax.net.ssl.*; 
import java.io.*; 
import java.net.URL; 
import java.security.*; 
import java.security.cert.CertificateException;

.....

/************** BEGIN HTTPS Connection **************/
System.out.println("Browsing to: " + "https://" + host + ":4243/qps/" + vproxy + "/ticket?xrfkey=" + xrfkey); 
URL url = new URL("https://" + host + ":4243/qps/" + vproxy + "/ticket?xrfkey=" + xrfkey); 

HttpsURLConnection.setDefaultHostnameVerifier(WhitelistHostnameVerifier.INSTANCE);
			
HttpsURLConnection connection = (HttpsURLConnection ) url.openConnection(); 
connection.setSSLSocketFactory(sslSocketFactory); 
connection.setRequestProperty("x-qlik-xrfkey", xrfkey); connection.setDoOutput(true);

Compile the 2 files:

"C:\Program Files\Java\jdk1.8.0_221\bin\javac.exe" package1/WhitelistHostnameVerifier.java

"C:\Program Files\Java\jdk1.8.0_221\bin\javac.exe" package1/Ticket.java

Now there should not be any error any more when Ticket.java is executed:

"C:\Program Files\Java\jdk1.8.0_221\bin\java.exe" package1.Ticket administrator MYDOMAIN


Result:
Browsing to: https://10.76.200.70:4243/qps/bip/ticket?xrfkey=7rBHABt65vFflaZ7
Payload: { 'UserId':'administrator','UserDirectory':'MYDOMAIN','Attributes': [],}
The  from the server is: {"UserDirectory":"MYDOMAIN","UserId":"administrator","Attributes":[],"Ticket":"jfDmfNrzK9asYj3e","TargetUri":null}

References:
https://github.com/goldbergjeffrey/QlikSenseTicket.java
https://github.com/StevenJDH/Qlik-Sense-Java-Examples
https://relentlesscoding.com/2017/07/24/how-to-ignore-an-invalid-ssl-certificate-in-java/

Get Answers

Find Answers

Qlik Community

Collaborate with over 60,000 Qlik technologists and members around the world to get answers to your questions, and maximize success.

Join Us

Get Support

Have a Question?

Search Qlik's Support Knowledge database or request assisted support for highly complex issues.

Submit a case

Talk with a Representative

Critical Issues

Experiencing a serious issue, please contact us by phone. For Data Integration related issues please refer to your onboarding documentation for current phone number.

Call Us