SSL HandShake exception

Question

I use SSL connection to connect web client to server. It works without any problem for a long time. But from yesterday it gives following error can anyone tell me the reason.

javax.net.ssl.SSLException: Connection has been shutdown: javax.net.ssl.SSLHandshakeException: Received fatal alert: certificate_unknown
        at com.sun.net.ssl.internal.ssl.SSLSocketImpl.checkEOF(SSLSocketImpl.java:1172)
        at com.sun.net.ssl.internal.ssl.AppInputStream.read(AppInputStream.java:65)
        at net.schubart.fixme.internal.MessageInput.readExactly(MessageInput.java:166)
        at net.schubart.fixme.internal.MessageInput.readMessage(MessageInput.java:78)
        at cc.aot.itsWeb.ClientWriterThread.run(ClientWriterThread.java:241)
        at java.lang.Thread.run(Thread.java:619)
clientWriter.ready
Caused by: javax.net.ssl.SSLHandshakeException: Received fatal alert: certificate_unknown
        at com.sun.net.ssl.internal.ssl.Alerts.getSSLException(Alerts.java:174)
        at com.sun.net.ssl.internal.ssl.Alerts.getSSLException(Alerts.java:136)
        at com.sun.net.ssl.internal.ssl.SSLSocketImpl.recvAlert(SSLSocketImpl.java:1586)
        at com.sun.net.ssl.internal.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:865)
        at com.sun.net.ssl.internal.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1029)
        at com.sun.net.ssl.internal.ssl.SSLSocketImpl.writeRecord(SSLSocketImpl.java:621)
        at com.sun.net.ssl.internal.ssl.AppOutputStream.write(AppOutputStream.java:59)
        at java.io.OutputStream.write(OutputStream.java:58)
        at net.schubart.fixme.internal.Message.write(Message.java:267)
        at net.schubart.fixme.internal.MessageOutput.writeMessage(MessageOutput.java:53)

Answer 1

I would first check to see if the cert in question has expired. Have run into this many times when working with vendors. They can update their certs without letting us know.

Answer 2

I think you have to add keystore in jre1.6 cacert. Then deploy again your server .By the way you can use to add keystore PORTECLE program . it is very useful.

Answer 3

When I received this error, the problem was that the server certificate was using signature algorithm SHA1withRSA and Android 8.0 client. Switching to server certificate based on SHA256withRSA fixed the issue.

Answer 4

You can check the certificate via the browser.

In Internet Explorer

Right Click >> Properties >> Certificates

Once in the Certificates Window you can view the entire certificate tree as well.

If you have an invalid certificate you may want to look into a solution using the keytool command.

Keytool Commands