[mule-user] pop3s using tls

[Davide Piazza]

Hi,
I'm trying to connect my pop3 server that is using tls.
I grabbed the server certificate in pem format copy-pasting the result of command
openssl s_client -connect piccione.omnys.com:110 -showcerts
so that now I have piccione.cer file stored at ${app.home}/truststore.

This is my config:
<mule-descriptor name="pop3Poller"
            implementation=" org.mule.components.simple.LogComponent">
            <inbound-router>
                <endpoint
                    address="pop3s://${pop3.username}:${pop3.password}@${pop3.hostname}"
                    transformers="EmailMessageToString">
                    <filter
                        className="org.mule.providers.email.filters.MailSubjectRegExFilter"
                        pattern="\\[mule\\](.*)" />
                    <properties>
                        <property name="trustStore" value="${app.home}/trustore" />
                    </properties>
                </endpoint>
            </inbound-router>
        </mule-descriptor>



and this is the stacktrace:

Exception stack is:
1. unable to find valid certification path to requested target (sun.security.provider.certpath.SunCertPathBuilderException )
  sun.security.provider.certpath.SunCertPathBuilder:174 (null)
2. PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target ( sun.security.validator.ValidatorException)
  sun.security.validator.PKIXValidator:285 (null)
3. sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException : unable to find valid certification path to requested target (javax.net.ssl.SSLHandshakeException)
  com.sun.net.ssl.internal.ssl.Alerts:174 ( http://java.sun.com/j2ee/sdk_1.3/techdocs/api/javax/net/ssl/SSLHandshakeException.html)
4. Connect failed (javax.mail.MessagingException)
  com.sun.mail.pop3.POP3Store:148 ( http://java.sun.com/j2ee/sdk_1.3/techdocs/api/javax/mail/MessagingException.html)
5. Initialisation Failure: Connect failed (org.mule.providers.ConnectException)
  org.mule.providers.AbstractMessageReceiver:432 ( http://mule.mulesource.org/docs/apidocs/org/mule/providers/ConnectException.html)
********************************************************************************
Root Exception stack trace:
sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
    at sun.security.provider.certpath.SunCertPathBuilder.engineBuild (SunCertPathBuilder.java:174)
    at java.security.cert.CertPathBuilder.build(CertPathBuilder.java:238)
    at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:280)
    at sun.security.validator.PKIXValidator.engineValidate (PKIXValidator.java:191)
    at sun.security.validator.Validator.validate(Validator.java:218)
    at com.sun.net.ssl.internal.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:126)
    at com.sun.net.ssl.internal.ssl.X509TrustManagerImpl.checkServerTrusted (X509TrustManagerImpl.java:209)
    at com.sun.net.ssl.internal.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:249)
    at com.sun.net.ssl.internal.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java :954)
    at com.sun.net.ssl.internal.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:123)
    at com.sun.net.ssl.internal.ssl.Handshaker.processLoop(Handshaker.java:516)
    at com.sun.net.ssl.internal.ssl.Handshaker.process_record (Handshaker.java:454)
    at com.sun.net.ssl.internal.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:884)
    at com.sun.net.ssl.internal.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1096)
    at com.sun.net.ssl.internal.ssl.SSLSocketImpl.readDataRecord(SSLSocketImpl.java:744)
    at com.sun.net.ssl.internal.ssl.AppInputStream.read(AppInputStream.java:75)
    at java.io.BufferedInputStream.fill(BufferedInputStream.java :218)
    at java.io.BufferedInputStream.read(BufferedInputStream.java:237)
    at java.io.DataInputStream.readLine(DataInputStream.java:496)
    at com.sun.mail.pop3.Protocol.simpleCommand(Protocol.java:347)
    at com.sun.mail.pop3.Protocol.<init>(Protocol.java:91)
    at com.sun.mail.pop3.POP3Store.getPort(POP3Store.java:201)
    at com.sun.mail.pop3.POP3Store.protocolConnect(POP3Store.java:144)
    at javax.mail.Service.connect (Service.java:275)
    at javax.mail.Service.connect(Service.java:156)
    at javax.mail.Service.connect(Service.java:105)
    at org.mule.providers.email.RetrieveMessageReceiver.doConnect(RetrieveMessageReceiver.java :83)
    at org.mule.providers.AbstractMessageReceiver.connect(AbstractMessageReceiver.java:411)
    at org.mule.providers.SingleAttemptConnectionStrategy.doConnect(SingleAttemptConnectionStrategy.java:25)
    at org.mule.providers.AbstractConnectionStrategy.connect(AbstractConnectionStrategy.java:98)
    at org.mule.providers.AbstractMessageReceiver.connect(AbstractMessageReceiver.java:403)
    at org.mule.impl.model.AbstractComponent.connectListeners (AbstractComponent.java:628)
    at org.mule.impl.model.AbstractComponent.start(AbstractComponent.java:225)
    at org.mule.impl.model.AbstractComponent.start(AbstractComponent.java:204)
    at org.mule.impl.model.AbstractModel.start (AbstractModel.java:323)
    at org.mule.MuleManager.start(MuleManager.java:867)
    at org.mule.config.builders.MuleXmlConfigurationBuilder.configure(MuleXmlConfigurationBuilder.java:280)
    at org.mule.config.builders.MuleXmlConfigurationBuilder.configure (MuleXmlConfigurationBuilder.java:219)
    at org.mule.MuleServer.initialize(MuleServer.java:297)
    at org.mule.MuleServer.run(MuleServer.java:218)
    at org.mule.MuleServer.start(MuleServer.java:206)
    at org.mule.MuleServer.main(MuleServer.java:176)



I tried connecting to gmail account that is using tls too (but w/o certificates) and connection is ok.
What's wrong?

thanks
Davide.

[andrew cooke]

i'm not sure what you're trying to do exactly, but are you sure you're
using the right keystore config? look at client key store etc.

can you explain what you're trying to do - are you trying to identify
yourself (client keystore) or just check the server (trust store)?

andrew

> at javax.mail.Service.connect(Service.java:275)

> at javax.mail.Service.connect(Service.java:156)
> at javax.mail.Service.connect(Service.java:105)
> at org.mule.providers.email.RetrieveMessageReceiver.doConnect(
> RetrieveMessageReceiver.java:83)
> at org.mule.providers.AbstractMessageReceiver.connect(
> AbstractMessageReceiver.java:411)
> at org.mule.providers.SingleAttemptConnectionStrategy.doConnect(
> SingleAttemptConnectionStrategy.java:25)
> at org.mule.providers.AbstractConnectionStrategy.connect(
> AbstractConnectionStrategy.java:98)
> at org.mule.providers.AbstractMessageReceiver.connect(
> AbstractMessageReceiver.java:403)
> at org.mule.impl.model.AbstractComponent.connectListeners(
> AbstractComponent.java:628)
> at org.mule.impl.model.AbstractComponent.start(AbstractComponent.java
> :225)
> at org.mule.impl.model.AbstractComponent.start(AbstractComponent.java
> :204)

> at org.mule.impl.model.AbstractModel.start(AbstractModel.java:323)

> at org.mule.MuleManager.start(MuleManager.java:867)
> at org.mule.config.builders.MuleXmlConfigurationBuilder.configure(
> MuleXmlConfigurationBuilder.java:280)
> at org.mule.config.builders.MuleXmlConfigurationBuilder.configure(
> MuleXmlConfigurationBuilder.java:219)
> at org.mule.MuleServer.initialize(MuleServer.java:297)
> at org.mule.MuleServer.run(MuleServer.java:218)
> at org.mule.MuleServer.start(MuleServer.java:206)
> at org.mule.MuleServer.main(MuleServer.java:176)
>
>
>
> I tried connecting to gmail account that is using tls too (but w/o
> certificates) and connection is ok.
> What's wrong?
>
> thanks
> Davide.
>

---------------------------------------------------------------------
To unsubscribe from this list please visit:

http://xircles.codehaus.org/manage_email

[Davide Piazza]

I'm trying to check teh server that has a certificate. When I configure my pop client (i.e. Thunderbird) I check
TLS option and the the client asks me to accept the certificate and that's it. I would like to check email with mule from this server.
In my first config I tried without the truststore property and the exception was the one below. That's why I thought to get the certificate and put it in the truststore folder.

DEBUG 2007-10-31 17:17:05,306 [main] org.mule.providers.email.Pop3sSocketFactory: creating: true; mule.email.pop3s
DEBUG 2007-10-31 17:17:05,306 [main] org.mule.providers.email.Pop3sSocketFactory: creating factory
INFO  2007-10-31 17:17:05,306 [main] org.mule.umo.security.provider.AutoDiscoverySecurityProviderFactory : Using org.mule.umo.security.provider.SunSecurityProviderInfo
DEBUG 2007-10-31 17:17:05,307 [main] org.mule.umo.security.tls.TlsPropertiesMapper: mule.email.pop3s.ssl.trustStore -> null
DEBUG 2007-10-31 17:17:05,307 [main] org.mule.umo.security.tls.TlsPropertiesMapper: mule.email.pop3s.ssl.trustStoreType -> jks
DEBUG 2007-10-31 17:17:05,307 [main] org.mule.umo.security.tls.TlsPropertiesMapper: mule.email.pop3s.ssl.trustStorePassword -> null
DEBUG 2007-10-31 17:17:05,307 [main] org.mule.umo.security.tls.TlsPropertiesMapper: mule.email.pop3s.ssl.trustManagerAlgorithm -> SunX509
DEBUG 2007-10-31 17:17:05,307 [main] org.mule.umo.security.tls.TlsPropertiesMapper : mule.email.pop3s.ssl.keyStore -> .keystore
DEBUG 2007-10-31 17:17:05,307 [main] org.mule.util.IOUtils: Unable to load resource from the file system: /home/davide/Work/Enerwin/workspace/Integration/.keystore
DEBUG 2007-10-31 17:17:05,309 [main] org.mule.util.IOUtils: Unable to load resource from the classpath
DEBUG 2007-10-31 17:17:05,309 [main] org.mule.umo.security.tls.TlsConfiguration: Normalised keyStore path to: null
DEBUG 2007-10-31 17:17:05,309 [main] org.mule.umo.security.tls.TlsPropertiesMapper: mule.email.pop3s.ssl.keyStoreType -> jks
DEBUG 2007-10-31 17:17:05,309 [main] org.mule.umo.security.tls.TlsPropertiesMapper: mule.email.pop3s.ssl.keyStorePassword -> null
DEBUG 2007-10-31 17:17:05,309 [main] org.mule.umo.security.tls.TlsConfiguration: initialising: anon true
INFO  2007-10-31 17:17:05,309 [main] org.mule.umo.security.tls.TlsPropertiesMapper: Defaulting mule.email.pop3s trust store to client Key Store
DEBUG 2007-10-31 17:17:06,327 [main] org.mule.config.i18n.MessageFactory: Loading resource bundle: META-INF.services.org.mule.i18n.core-messages for locale it_IT
DEBUG 2007-10-31 17:17:06,332 [main] org.mule.config.i18n.MessageFactory: Loading resource bundle: META-INF.services.org.mule.i18n.core-messages for locale it_IT
DEBUG 2007-10-31 17:17:06,334 [main] org.mule.config.i18n.MessageFactory: Loading resource bundle: META-INF.services.org.mule.i18n.core-messages for locale it_IT
DEBUG 2007-10-31 17:17:06,335 [main] org.mule.config.i18n.MessageFactory: Loading resource bundle: META-INF.services.org.mule.i18n.core-messages for locale it_IT
DEBUG 2007-10-31 17:17:06,340 [main] org.mule.config.i18n.MessageFactory: Loading resource bundle: META-INF.services.org.mule.i18n.core-messages for locale it_IT
DEBUG 2007-10-31 17:17:06,344 [main] org.mule.config.i18n.MessageFactory : Loading resource bundle: META-INF.services.org.mule.i18n.core-messages for locale it_IT
ERROR 2007-10-31 17:17:06,345 [main] org.mule.MuleServer:
********************************************************************************
Message               : Initialisation Failure: Connect failed
Type                  : org.mule.providers.ConnectException
Code                  : MULE_ERROR-84
JavaDoc               : http://mule.mulesource.org/docs/apidocs/org/mule/providers/ConnectException.html
Object                : RetrieveMessageReceiver{this=1eec35, receiverKey=xxx, endpoint=pop3s://xxx}
********************************************************************************

Exception stack is:
1. unable to find valid certification path to requested target (sun.security.provider.certpath.SunCertPathBuilderException)
  sun.security.provider.certpath.SunCertPathBuilder:174 (null)
2. PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target (sun.security.validator.ValidatorException)
  sun.security.validator.PKIXValidator:285 (null)

3. sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target (javax.net.ssl.SSLHandshakeException )
  com.sun.net.ssl.internal.ssl.Alerts:174 (http://java.sun.com/j2ee/sdk_1.3/techdocs/api/javax/net/ssl/SSLHandshakeException.html )
4. Connect failed (javax.mail.MessagingException)
  com.sun.mail.pop3.POP3Store:148 (http://java.sun.com/j2ee/sdk_1.3/techdocs/api/javax/mail/MessagingException.html )

5. Initialisation Failure: Connect failed (org.mule.providers.ConnectException)
  org.mule.providers.AbstractMessageReceiver:432 ( http://mule.mulesource.org/docs/apidocs/org/mule/providers/ConnectException.html)

********************************************************************************
Root Exception stack trace:
sun.security.provider.certpath.SunCertPathBuilderException : unable to find valid certification path to requested target

    at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:174)

    at java.security.cert.CertPathBuilder.build(CertPathBuilder.java :238)
    at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:280)
    at sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:191)

    at sun.security.validator.Validator.validate (Validator.java:218)
    at com.sun.net.ssl.internal.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:126)
    at com.sun.net.ssl.internal.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java :209)

    at com.sun.net.ssl.internal.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:249)
    at com.sun.net.ssl.internal.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:954)

    at com.sun.net.ssl.internal.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:123)
    at com.sun.net.ssl.internal.ssl.Handshaker.processLoop(Handshaker.java:516)

    at com.sun.net.ssl.internal.ssl.Handshaker.process_record (Handshaker.java:454)
    at com.sun.net.ssl.internal.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:884)
    at com.sun.net.ssl.internal.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1096)

    at com.sun.net.ssl.internal.ssl.SSLSocketImpl.readDataRecord(SSLSocketImpl.java:744)

    at com.sun.net.ssl.internal.ssl.AppInputStream.read(AppInputStream.java:75)
    at java.io.BufferedInputStream.fill(BufferedInputStream.java :218)
    at java.io.BufferedInputStream.read(BufferedInputStream.java:237)
    at java.io.DataInputStream.readLine(DataInputStream.java:496)
    at com.sun.mail.pop3.Protocol.simpleCommand(Protocol.java:347)
    at com.sun.mail.pop3.Protocol.<init>(Protocol.java:91)
    at com.sun.mail.pop3.POP3Store.getPort(POP3Store.java:201)
    at com.sun.mail.pop3.POP3Store.protocolConnect(POP3Store.java:144)

    at javax.mail.Service.connect (Service.java:275)

    at javax.mail.Service.connect(Service.java:156)
    at javax.mail.Service.connect(Service.java:105)

    at org.mule.providers.email.RetrieveMessageReceiver.doConnect(RetrieveMessageReceiver.java :83)
    at org.mule.providers.AbstractMessageReceiver.connect(AbstractMessageReceiver.java:411)
    at org.mule.providers.SingleAttemptConnectionStrategy.doConnect(SingleAttemptConnectionStrategy.java:25)
    at org.mule.providers.AbstractConnectionStrategy.connect(AbstractConnectionStrategy.java:98)

    at org.mule.providers.AbstractMessageReceiver.connect(AbstractMessageReceiver.java:403)
    at org.mule.impl.model.AbstractComponent.connectListeners (AbstractComponent.java:628)
    at org.mule.impl.model.AbstractComponent.start(AbstractComponent.java:225)
    at org.mule.impl.model.AbstractComponent.start(AbstractComponent.java:204)
    at org.mule.impl.model.AbstractModel.start (AbstractModel.java:323)
    at org.mule.MuleManager.start(MuleManager.java:867)
    at org.mule.config.builders.MuleXmlConfigurationBuilder.configure(MuleXmlConfigurationBuilder.java:280)

    at org.mule.config.builders.MuleXmlConfigurationBuilder.configure (MuleXmlConfigurationBuilder.java:219)
    at org.mule.MuleServer.initialize(MuleServer.java:297)
    at org.mule.MuleServer.run(MuleServer.java:218)
    at org.mule.MuleServer.start(MuleServer.java:206)
    at org.mule.MuleServer.main(MuleServer.java:176)

2007/10/31, andrew cooke <aco...@mulesource.com>:

>     at com.sun.mail.pop3.POP3Store.protocolConnect (POP3Store.java:144)

>     at javax.mail.Service.connect(Service.java:275)
>     at javax.mail.Service.connect(Service.java:156)
>     at javax.mail.Service.connect(Service.java:105)
>     at org.mule.providers.email.RetrieveMessageReceiver.doConnect (
> RetrieveMessageReceiver.java:83)
>     at org.mule.providers.AbstractMessageReceiver.connect(
> AbstractMessageReceiver.java:411)
>     at org.mule.providers.SingleAttemptConnectionStrategy.doConnect (
> SingleAttemptConnectionStrategy.java:25)
>     at org.mule.providers.AbstractConnectionStrategy.connect(
> AbstractConnectionStrategy.java:98)
>     at org.mule.providers.AbstractMessageReceiver.connect (
> AbstractMessageReceiver.java:403)
>     at org.mule.impl.model.AbstractComponent.connectListeners(
> AbstractComponent.java:628)
>     at org.mule.impl.model.AbstractComponent.start(AbstractComponent.java
> :225)
>     at org.mule.impl.model.AbstractComponent.start(AbstractComponent.java
> :204)
>     at org.mule.impl.model.AbstractModel.start(AbstractModel.java:323)

>     at org.mule.MuleManager.start (MuleManager.java:867)

[Andrew Perepelytsya]

It's not the trustStore *folder*, it's the *store* itself. Basically, it's a JKS-formatted file with any root certs not there in JDK's list of trusted certs. That's a declarative way to handle things, instead of hacking a one-off X509TrustStoreManager.

Andrew

[Andrew Perepelytsya]

 of hacking a one-off X509TrustStoreManager.

I meant, X509TrustManager ;)

[Davide Piazza]

Ok, so what could I do to connect to my pop3 server?

2007/10/31, Andrew Perepelytsya <aper...@gmail.com>:

[Andrew Perepelytsya]

Have you imported this cert in the truststore? Remember, it's technically the same keystore, it's only by convention that it has such an importance. I recommend http://portecle.sourceforge.net/ if you are confused. IBM's JDK also had a keystore management utility, which wasn't bad.

Andrew