Howto: Import Certificates into a Keystore

One night, our Java application, which connects to a webservice, started failing with the following error:

javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
at org.apache.axis.AxisFault.makeFault(AxisFault.java:101)
at org.apache.axis.transport.http.HTTPSender.invoke(HTTPSender.java:154)
at org.apache.axis.strategies.InvocationStrategy.visit(InvocationStrategy.java:32)
at org.apache.axis.SimpleChain.doVisiting(SimpleChain.java:118)
at org.apache.axis.SimpleChain.invoke(SimpleChain.java:83)
at org.apache.axis.client.AxisClient.invoke(AxisClient.java:165)
at org.apache.axis.client.Call.invokeEngine(Call.java:2784)
at org.apache.axis.client.Call.invoke(Call.java:2767)
at org.apache.axis.client.Call.invoke(Call.java:2443)
at org.apache.axis.client.Call.invoke(Call.java:2366)
at org.apache.axis.client.Call.invoke(Call.java:1812)

This error meant that our application did not have a valid certificate, but since our application had been working fine for the past few months, the only plausible explanation was that the webservice that we were trying to connect to, had changed their certificate without telling us!

I then had to go about getting hold of the new certificate and importing it into my truststore, in order to get my application up and running again. This is how:

1) Save the SSL Certificate to a File
In Firefox 3.5 (it's easier):

• Open the webservice url
• Double-click the padlock icon (or right-click on page and select Page Info)
• Click on the Security tab (the padlock icon)
• Press View Certificate
• Click on the Details tab
• Press Export...
• Choose a file to save to - I like to save as type: X.509 Certification (DER)

In Internet Explorer (IE 8):

• Open the webservice url
• Click the padlock icon and then on View Certificates
• Click on Install Certificate, click Next
• Choose Place all certificates in the following store and Browse to Personal
• Click Next and run through the rest of the screens
• Go to Start > Run > certmgr.msc
• Select Personal
• Right click on certificate, go to All Tasks > Export...

Once saved, you can view the certificate using Java Keytool as follows:

keytool -printcert -file mycert.cer

2) Import Certificate to Keystore
Now that we have saved the website certificate to a local file, we can use Java Keytool to import it into our keystore using the following command:

keytool -import -alias myalias -file mycert.cer \
        -keystore mytruststore

You can also display the contents of the keystore using the following command:

keytool -list -v -keystore mytruststore

Enabling Desktop SSO in Firefox

This is how you can configure Firefox to use Desktop Single Sign On (SSO) / Kerberos authentication:

• Go to about:config
• Change your preference network.negotiate-auth.delegation-uris
to the domain you want to authenticate against, for example ".domain.com".
• Change your preference network.negotiate-auth.trusted-uris
to the domain as above.

Now try going to a URL and you should be able to login automatically. This has been tried and tested with Firefox 3.5.

Fibonacci Shell Script

Here is a quick unix shell script which prints out the Fibonacci sequence:

0,1,1,2,3,5,8,13,21,34,55,89,144,...

The first two Fibonacci numbers are 0 and 1, and each remaining number is the sum of the previous two.

#!/bin/sh
prev=0
next=1

echo $prev

while(true)
do
 echo $next

 #add the two numbers
 sum=$(($prev+$next))

 #swap
 prev=$next
 next=$sum
 sleep 1
done

Using XPath in Java

Given the following xml document:

<hosts>
  <host name="starship" port="8080"/>
  <host name="firefly" port="8180"/>
</hosts>

this is how you can use the javax.xml.xpath library to run an XPath query in order to obtain a list of host names:

//create a document
DocumentBuilderFactory domFactory = 
                     DocumentBuilderFactory.newInstance();
domFactory.setNamespaceAware(true);
DocumentBuilder builder = domFactory.newDocumentBuilder();
Document doc = builder.parse("file.xml");

//create the xpath expression
XPathFactory factory = XPathFactory.newInstance();
XPath xpath = factory.newXPath();
XPathExpression expr = xpath.compile("//host/@name");

//run the xpath query
Object result = expr.evaluate(doc, XPathConstants.NODESET);

//read results
NodeList nodes = (NodeList) result;
for (int i = 0; i < nodes.getLength(); i++) {
    System.out.println(nodes.item(i).getNodeValue());
}

find -exec vs xargs

If you want to execute a command on lots of files found by the find command, there are a few different ways this can be achieved (some more efficient than others):

-exec command {} \;
This is the traditional way. The end of the command must be punctuated by an escaped semicolon. The command argument {} is replaced by the current path name found by find. Here is a simple command which echoes file paths.

sharfah@starship:~> find . -type f -exec echo {} \;
.
./1.txt
./2.txt

This is very inefficient, because whenever find finds a file, it forks a process for your command, waits for this child process to complete and then searches for the next file. In this example, you will get the following child processes: echo .; echo ./1.txt; echo ./2.txt. So if there are 1000 files, there are 1000 child processes and find waits.

-exec command {} +
If you use a plus (+) instead of the escaped semicolon, the arguments will be grouped together before being passed to the command. The arguments must be at the end of the command.

sharfah@starship:~> find . -type f -exec echo {} +
. ./1.txt ./2.txt

In this case, only one child process is created: echo . ./1.txt ./2.txt, which is much more efficient, because it avoids a fork/exec for each single argument.

xargs
This is similar to the approach above, in that files found are bundled up (usually in batches of about 20-50 names) and sent to the command as few times as possible. find doesn't wait for your command to finish.

sharfah@starship:~> find . -type f | xargs echo
. ./1.txt ./2.txt

This approach is efficient and works well as long as you do not have funny characters (e.g. spaces) in your filenames as they won't be escaped.

Performance Testing
So which one of the above approaches is fastest? I ran a test across a directory with 10,000 files out of which 5,600 matched my find pattern. I ran the test 10 times, changing the order of the finds each time, but the results were always the same. xargs and + were very close, with \; always finishing last. Here is one result:

time find . -name "*20090430*" -exec touch {} +
real    0m31.98s
user    0m0.06s
sys     0m0.49s

time find . -name "*20090430*" | xargs touch
real    1m8.81s
user    0m0.13s
sys     0m1.07s

time find . -name "*20090430*" -exec touch {} \;
real    1m42.53s
user    0m0.17s
sys     0m2.42s

I'm going to be using the -exec command {} + method, because it is faster and can handle my funny filenames.