error while mailing from Java (SSLHandShake Exception)

Question

I am getting following exception while sending mails from Java.

31/03 14:06:19:571 INFO [ ] IBSUtils sendMailfromsmtp() MessagingException in Sending Mail :javax.mail.MessagingException: Can't send command to SMTP host;
nested exception is:
    javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path validation failed: java.security.cert.CertPathValidatorException: timestamp check failed

It's sending mails in stand alone java programs but while running from JBoss server its throwing this exception. Code has been working from six months but suddenly its starts throwing this exception.

Seems some certificate Expired.

Answer 1

I've ever get this kind of error when my application(IBM Java 1.6) handle connection with webserver(Oracle Java 1.6). There might be Handshake exception while negotiating SSH protocol.

You'd better set your Java protocol manually.

// Using IBM jre there will be a handshake failure as IBM java 1.6 will
// negotiate to server SSLv3 protocol while it SHOULD be TLSv1
    System.setProperty("https.protocols", "TLSv1");

Answer 2

Seems some certificate Expired.

Correct. The server certificate has expired. Get it renewed, or complain to them if you can't get it done yourself.

Or else it hasn't come into its validity period yet.

Answer 3

Answering your request on how to get get information about the probably expired certificate:

• Find out which server your mail is delivered to. Where this is configured depends on you utility class for sending mail, JEE style is to get it from a mail session configured in jboss.

• Assuming you deliver your mail to somehost on port 25 you could use openssl s_client to perform a TLS handshake to get the certificate:

openssl s_client -starttls smtp -crlf -connect somehost:25

This gives you the certificate itself (the base64 encoded part between the "-----BEGIN CERTIFICATE-----" and "-----END CERTIFICATE----- " delimiters and some basic information abobout it. Store the certificate including the delimiting lines in a file, say cert.pem.

You can then decode it using

openssl x509 -text -noout <cert.pem

This gives you all the information in the certificate as readable text.