title: Unstable SSL certificate path validation under OpenJDK
body: <p>I've recently detect unstable SSL certificate path validation under </p>
  
  <p>Ubuntu 12.04 LTS (GNU/Linux 3.2.0-26-generic x86_64)<br>
  OpenJDK Runtime Environment (IcedTea6 1.11.4) (6b24-1.11.4-1ubuntu0.12.04.1)<br>
  OpenJDK 64-Bit Server VM (build 20.0-b12, mixed mode)  </p>
  
  <p>and</p>
  
  <p>Ubuntu 10.04.1 LTS<br>
  OpenJDK Runtime Environment (IcedTea6 1.11.4) (6b24-1.11.4-1ubuntu0.10.04.1)<br>
  OpenJDK Server VM (build 20.0-b12, mixed mode)  </p>
  
  <p>It starts with the following error for an SSL connection to an online banking host:  </p>
  
  <pre><code>sun.security.validator.ValidatorException: PKIX path validation failed:
  java.security.cert.CertPathValidatorException:  
  Path does not chain with any of the trust anchors  
  </code></pre>
  
  <p>I've checked whether or not the root certificate was always included in the keystore ... it was (Baltimore CyberTrust Root). I've double checked the MD5 and SHA1 fingerprints of the sent data with the data shown by the browser certification info dialog... the same ! After that, I've found SSLPoke, a little utility for the SSL communication and use that for subsequent requests:  </p>
  
  <pre><code>java -Djavax.net.debug=ssl SSLPoke hbci-pintan.gad.de 443
  </code></pre>
  
  <p>And this displays the instability: about 8 of 10 requests failed with the error mentioned above, 2 of 10 succeeded. For every failed request, I've sent the same request immediately under Mac OS X 10.7.5 java version "1.6.0_35" with Java(TM) SE Runtime Environment (build 1.6.0_35-b10-428-11M3811), Java HotSpot(TM) 64-Bit Server VM (build 20.10-b01-428, mixed mode). All of these requests were successfully. Therefore, it seems that the validation of such SSL certification paths are unstable under OpenJDK. </p>
  
  <p>Has anybody similar experiences ?</p>
  
  <p>Kind regards<br>
  Dominik </p>