Talking over SSL from Java

For the first time in this blog, I'm pleased to present to you a
guest post from my good friend, Jeff Scanlon:

---

Talking over SSL from Java
--------------------------

When using SSLFactory to talk SSL with a server, or using
the URL class to open an https connection, an error you
might encounter is:

sun.security.validator.ValidatorException: PKIX path building failed:
sun.security.provider.certpath.SunCertPathBuilderException:
unable to find valid certification path to requested target

One solution that worked for me is to add the server certificate
to the cacerts file in the appropriate Java runtime.

Steps:

1. You must have the server certificate. If you don't have this
   handy, navigate to the secure website, click on the lock icon
   (in Internet Explorer). Click on "Details" tab and then click
   the "Copy to File..." button. Export the certificate to a DER
   encoded binary X.509 (.CER) file. Let's say you chose the
   filename example.cer
   
   
2. Copy example.cer to the jre/lib/security directory in the Java
   runtime you are using. If you're on Windows and the JDK/JRE
   is in C:\jdk1.5.0_04, then the full path is:
   C:\jdk1.5.0_04\jre\lib\security
   
   
3. Import the certificate into the cacerts file by using the
   following command [editor's note: this is all one command, broken
   into multiple lines for blogging]:
   
   keytool -import -storepass changeit -file
     example.cer -keystore cacerts
     -alias example
   
   'changeit' is the default password to the cacerts keystore
   'example.cer' is the filename you used in step #1
   'example' is an arbitrary alias you choose for the certificate
   
   
4. Now try your code and see if it can establish the SSL
   connection. If you get an error like 'HTTPS hostname
   wrong: should be ____', then add this code:
   
   import javax.net.ssl.HostnameVerifier;
   import javax.net.ssl.HttpsURLConnection;
   import javax.net.ssl.SSLSession;
   
   // -------------------------------------------------
   
   HostnameVerifier hv = new HostnameVerifier() {
       public boolean verify(String hostName,
                             SSLSession session)
       {
           System.out.println(
             "hostName is [" + hostName +
             "] and session peer host is [" +
             session.getPeerHost() + "]");
           return(true);
       }
   };
   
   HttpsURLConnection.setDefaultHostnameVerifier(hv);
   
   The above code provides a hostname verifier replacement that
   will cause hostname verification to succeed (by always
   returning true). Be aware that using this code does have
   security implications. However, this simplistic verify
   replacement should solve SSL communication problems and
   provide a starting point for implementing a custom verify
   that maintains security.

---

Jeff has been a good friend of mine for about 16 years, now.
He has been published several times (such as here,
here, and here), and is usually the first person I turn
to for ideas/advice on any programming/computer-related topic. He will definitely be contributing to this blog again in the future.

html form tag without the top/bottom padding

This seems like such a simple thing, but I'm really happy to be able to add it to my collection of useful code snippets:

The important part (HTML code snippet):
<form style="display: inline; margin: 0px;">

Explanation/history/context:
For years, now, I've just accepted (but been annoyed by) the fact that the HTML FORM tag causes some whitespace to display above and below the form contents:

html	screenshot
Form outside table: Text above table <form> <table border="1">   <tr>     <td>table cell</td>   </tr> </table> </form> Text below table

One common way of avoiding that whitespace padding is to stick the FORM tag inside a TABLE tag, floating freely without being inside any particular row/cell, like this:

html	screenshot
Form inside table: Text above table <table border="1"> <form>   <tr>     <td>table cell</td>   </tr> </form> </table> Text below table

I've never bothered to find a better way, until recently, when I decided that I didn't like HTML validators complaining about that. So I searched and found a method of avoiding that whitespace that's simple, seems to work fine in multiple browsers, and passes HTML validation:

html
Form outside table with style: Text above table <form style="display: inline; margin: 0px;"> <table border="1">   <tr>     <td>table cell</td>   </tr> </table> </form> Text below table
screenshot

Removing empty macros from Excel, to avoid popup security dialog

Anyone that's ever dealt with Excel has probably seen this security warning dialog about macros:


It's one thing if the spreadsheet actually has macros in it, especially if it actually *uses* the macros in it. But even if you create a macro, and subsequently delete it, you still get this warning.

I found an Excel FAQ today that included instructions for fixing this. Worked for me!