title: Apache HttpClient able to communicate over HTTPS when DIRECT but not via PROXY error: javax.net.ssl.SSLPeerUnverifiedException: peer not authenticated
body: <p>I have read though many different examples but I am currently having difficulties trying to communicate via a proxy using HTTPS.  I have a wrapper to create a Apache HttpClient as seen in the code below.</p>
  
  <p>Currently if I make my call without setting up a proxy it will use my truststore from the SSLSocketFactory and correctly allow the communication via SSL.  The only certificate required is a verisign server certificate which does not require authentication.</p>
  
  <p>When I setup a proxy I get an error saying: </p>
  
  <p>javax.net.ssl.SSLPeerUnverifiedException: peer not authenticated</p>
  
  <p>I feel that I must be missing some type of proxy setup which makes the proxy connection use the same SSLSocketFactory?</p>
  
  <p>I tested with -Djavax.net.debug=ssl and I can see a lot more SSL activity when going direct.  When I use direct I can see all the keys loaded and sent with the request, when I use the proxy I only see:</p>
  
  <pre><code>httpConnector.receiver.3, setSoTimeout(30000) called
  %% No cached client session
  *** ClientHello, TLSv1
  RandomCookie:  GMT: 1307565311 bytes = { 184, 216, 5, 151, 154, 212, 232, 96, 69, 73, 240, 54, 236, 26, 8, 45, 109, 9, 192,
  227, 193, 58, 129, 212, 57, 249, 205, 56 }
  Session ID:  {}
  Cipher Suites: [SSL_RSA_WITH_RC4_128_MD5, SSL_RSA_WITH_RC4_128_SHA, TLS_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_RSA_WITH_AES_128_C
  BC_SHA, TLS_DHE_DSS_WITH_AES_128_CBC_SHA, SSL_RSA_WITH_3DES_EDE_CBC_SHA, SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA, SSL_DHE_DSS_WITH
  _3DES_EDE_CBC_SHA, SSL_RSA_WITH_DES_CBC_SHA, SSL_DHE_RSA_WITH_DES_CBC_SHA, SSL_DHE_DSS_WITH_DES_CBC_SHA, SSL_RSA_EXPORT_WITH
  _RC4_40_MD5, SSL_RSA_EXPORT_WITH_DES40_CBC_SHA, SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA, SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA
  ]
  Compression Methods:  { 0 }
  ***
  httpConnector.receiver.3, WRITE: TLSv1 Handshake, length = 73
  httpConnector.receiver.3, WRITE: SSLv2 client hello message, length = 98
  httpConnector.receiver.3, handling exception: javax.net.ssl.SSLException: Unrecognized SSL message, plaintext connection?
  httpConnector.receiver.3, SEND TLSv1 ALERT:  fatal, description = unexpected_message
  httpConnector.receiver.3, WRITE: TLSv1 Alert, length = 2
  httpConnector.receiver.3, called closeSocket()
  httpConnector.receiver.3, IOException in getSession():  javax.net.ssl.SSLException: Unrecognized SSL message, plaintext conn
  ection?
  httpConnector.receiver.3, called close()
  httpConnector.receiver.3, called closeInternal(true)
  httpConnector.receiver.3, called close()
  httpConnector.receiver.3, called closeInternal(true)
  2011-12-20 11:11:59,401 [httpConnector.receiver.3] INFO - The JavaScript method AddEvent threw an exception of type class co
  m.alarmpoint.integrationagent.soap.exception.SOAPRequestException with message "javax.net.ssl.SSLPeerUnverifiedException: pe
  er not authenticated".  The exception will be propogated up the call stack.
  </code></pre>
  
  <p>Can anyone help out please.  Here is my code for setting up the proxy and SSLSocketFactory.</p>
  
  <pre><code>var client = httpClientWrapper.getHttpClient();
  var proxy = new HttpHost(PROXY_HOST, PROXY_PORT, "https"); 
  client.getParams().setParameter(ConnRoutePNames.DEFAULT_PROXY, proxy); 
  
  var authpref = new ArrayList();
  authpref.add(AuthPolicy.BASIC);
  
  client.getParams().setParameter(AuthPNames.PROXY_AUTH_PREF, authpref);
  
  ServiceAPI.getLogger().debug("KeyStore.getDefaultType() " + KeyStore.getDefaultType());
  
  
  var trustStore  = KeyStore.getInstance(KeyStore.getDefaultType());        
  var instream = new FileInputStream(new File("conf/my.truststore")); 
  try {
  ServiceAPI.getLogger().debug("getting trustore");
  trustStore.load(instream, "changeit".split(''));
  } finally {
  instream.close();
  }
  
  
  var socketFactory = new SSLSocketFactory(trustStore);
  var sch = new Scheme("https", socketFactory, 443);
  
  client.getConnectionManager().getSchemeRegistry().register(sch);
  </code></pre>
  
  <p>Stack trace:</p>
  
  <pre><code>Caused by: javax.net.ssl.SSLPeerUnverifiedException: peer not authenticated
  at com.sun.net.ssl.internal.ssl.SSLSessionImpl.getPeerCertificates(Unknown Source)
  at org.apache.http.conn.ssl.AbstractVerifier.verify(AbstractVerifier.java:128)
  at org.apache.http.conn.ssl.SSLSocketFactory.connectSocket(SSLSocketFactory.java:390)
  at org.apache.http.conn.ssl.SSLSocketFactory.connectSocket(SSLSocketFactory.java:488)
  at org.apache.http.conn.scheme.SchemeSocketFactoryAdaptor.connectSocket(SchemeSocketFactoryAdaptor.java:62)
  at org.apache.http.impl.conn.DefaultClientConnectionOperator.openConnection(DefaultClientConnectionOperator.java:148)
  at org.apache.http.impl.conn.AbstractPoolEntry.open(AbstractPoolEntry.java:149)
  at org.apache.http.impl.conn.AbstractPooledConnAdapter.open(AbstractPooledConnAdapter.java:121)
  at org.apache.http.impl.client.DefaultRequestDirector.tryConnect(DefaultRequestDirector.java:561)
  at org.apache.http.impl.client.DefaultRequestDirector.execute(DefaultRequestDirector.java:415)
  at org.apache.http.impl.client.AbstractHttpClient.execute(AbstractHttpClient.java:820)
  at org.apache.http.impl.client.AbstractHttpClient.execute(AbstractHttpClient.java:754)
  at org.apache.http.impl.client.AbstractHttpClient.execute(AbstractHttpClient.java:732)
  </code></pre>