Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Good day. During last two weeks i had been trying to create my xmpp client app which will be connect to the xmpp server via TLS(because server it's using)

My server is:

telnet 5222
Connected to
Escape character is '^]'.

If I do:

openssl s_client -connect -starttls xmpp -showcerts | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > /Users/dmitry/odnoklassniki.pem

/Users/dmitry/odnoklassniki.pem is here

After this how i do can create the chain of certificates and import it to trusted keystore?

If am using Adium messenger it's works fine and in preference's tab i see this:

Adium chain

Please help me.

Exception thrown by my code: root certificate not trusted of [*]
    at org.jivesoftware.smack.XMPPConnection.proceedTLSReceived(
    at org.jivesoftware.smack.PacketReader.parsePackets(
    at org.jivesoftware.smack.PacketReader.access$000(
    at org.jivesoftware.smack.PacketReader$
Caused by: root certificate not trusted of [*]
    at org.jivesoftware.smack.ServerTrustManager.checkServerTrusted(
    ... 11 more


  1. I'd downloaded certificate from
  2. after this C:\>keytool -import -alias Root -keystore o.keystore -trustcacerts -file root.cer i'd got a keystore o.keystore
  3. in code i'd added this options:

    config.setDebuggerEnabled(true); config.setSASLAuthenticationEnabled(true); config.setSecurityMode(ConnectionConfiguration.SecurityMode.enabled); config.setSelfSignedCertificateEnabled(true); config.setExpiredCertificatesCheckEnabled(true); config.setVerifyRootCAEnabled(true); config.setTruststoreType("JKS"); config.setKeystorePath("/Users/dmitry/o.keystore"); config.setTruststorePath("/Users/dmitry/o.keystore"); config.setTruststorePassword("changeit");

But the same error: root certificate not trusted of [*]

Debug info

keyStore is : keyStore type is : jks keyStore provider is : init keystore init keymanager of type SunX509 trustStore is: c:\my.keystore trustStore type is : jks trustStore provider is : init truststore adding as trusted cert:  Subject: CN=Entrust Root Certification Authority, OU="(c) 2006 Entrust, Inc.", is incorporated by reference, O="Entrust, Inc.", C=US  Issuer:  CN=Entrust Root Certification Authority, OU="(c) 2006 Entrust, Inc.", is incorporated by reference, O="Entrust, Inc.", C=US  Algorithm: RSA; Serial number: 0x456b5054  Valid from Mon Nov 27 23:23:42 MSK 2006 until Sat Nov 28 00:53:42 MSK 2026

What I'm doing wrong?

share|improve this question
Hi Dmitry, welcome to Information Security. Please see the FAQ - please do not cross-post between sites. If the Stack Overflowmoderators think it would be better here, they have the option to migrate it. You can also flag the question to request a migration. – AviD Nov 14 '12 at 10:39
SO link deleted. – Zagorulkin Dmitry Nov 14 '12 at 11:09
Dmitry, you may have deleted the link to the original question on SO, but it is still a duplicate question, cross-posted on two sites. – AviD Nov 14 '12 at 15:51
ok. i will request flag my question on SO. thanks. – Zagorulkin Dmitry Nov 14 '12 at 17:55
up vote 2 down vote accepted

You do not put a complete chain in a "trusted store". The trusted store contains the keys that you trust a priori. Normally, you would have the certificate which starts the chain in your trusted store. The SSL server actually sends a complete chain (that's part of the SSL/TLS standard, section 7.4.2). The client then verifies the signature on each certificate in the chain, relatively to the public key found in the previous certificate, and beginning with the root certificate, which is in the trusted store.

In your case, the root CA appears to be " Secure Server Certification Authority", and that's the certificate you need to put in your trusted store. The default Java trusted store does not contain it. See this question for explanations and pointers on how to change that.

share|improve this answer
I'll try it. if i'd understood you right i should download Entrust root CA from, but what info i should provide during registration? (name, company, email, phone) it should my own information or info from the server? after i should create trusted store with this root certificate and it's must work properly. Thank you very much! – Zagorulkin Dmitry Nov 15 '12 at 8:13

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.