0

I was looking for some information about Java EE Schemas and found page https://www.oracle.com/webfolder/technetwork/jsc/xml/ns/javaee/index.html. From there I clicked at http://xmlns.jcp.org/xml/ns/javaee/ URL which gives me insecure page warning. Advanced info in FF shows this:

xmlns.jcp.org uses an invalid security certificate.

The certificate is only valid for the following names:
www-legacy.oracle.com, www.textura-aus.com, blogs.java.net, support.palerra.com, resources.maxymiser.com, www.peoplesoft.com, wmscalculator.com, analytics.micros-retail.com, weblogiccommunity.com, bigmachines.com, www.vocado.net, www.markie-awards.com, blog.apiary.io, zenedge.com, opower.com, today.java.net, www.maxymiser.com, www.logfire.com, www.zenedge.com, www.maxymiser.de, fideliocruise.com, www2.gradebeam.com, datalogix.com, support.ravellosystems.com, www.topliners.com, members.micros.com, community.java.net, logfire.com, www.modern-marketing.com, www.bigmachines.com, shop.sun.com, oraclecloud.com, www.bluekai.com, www.solaris.com, customercare.etadirect.com, weblogs.java.net, palerra.com, lightyear.sun.com, fcruise.com, blog.wercker.com, maxymiser.com, fiveuniversaltruths.com, www2.submittalexchange.com, www2.opower.com, www.wercker.com, www.cloudmonkeymobile.com, solaris.com, developer.cloud.oracle.com, www.crosswise.com, www.peoplesoftcustomer.com, www.fcruise.com, blog.opower.com, expresshelp.bigmachines.com, www.textura-europe.com, update.peoplesoft.com, www.datalogix.com, www.markieawards.com, latista.com, texturacorp.com, home.java.net, topliners.com, markieawards.com, info.palerra.com, sparklinedata.com, vocado.net, kb.bluekai.com, maxymiser.fr, modernsupplychainexperience.com, textura-australasia.com, slack.wercker.com, ticket.opower.com, wercker.com, www.oraclecloud.com, forums.java.sun.com, webapps.micros.com, community.acmepacket.com, www.palerra.com, www.wmscalculator.com, www.micros-supply-chain.com, cn.forums.oracle.com, kr.forums.oracle.com, go.logfire.com, gojava.com, www.latista.com, secure.tekelec.com, forums.java.net, beepotential.com, maxymiser.de, support.bigmachines.com, www.texturacorp.com, support.opower.com, go.java.com, www.eloqua.com, powerup.opower.com, www.vocado.com, www.modernsupplychainexperience.com, oas.micros.com, www.textura-australasia.com, www.fideliocruise.com, vocado.com, modern-marketing.com, textura-europe.com, cloudmonkeymobile.com, crosswise.com, www.weblogiccommunity.com, developer.cloud-stage.oracle.com, www.maxymiser.fr, eloqua.com, www.responsys.com, java.sun.com, java-champions.java.net, devcenter.wercker.com, support.toatech.com, www.opower.com, www.sparklinedata.com, markie-awards.com

Error code: SSL_ERROR_BAD_CERT_DOMAIN

Are we looking at some attack or is this just Oracle being sloppy with their sites, redirects and certificates?

  • The URL given (and which you show in your question) is http://xmlns.jcp.org/xml/ns/javaee/ which forwards directly to http://www.oracle.com/webfolder/technetwork/jsc/xml/ns/javaee/index.html - without being any TLS involved at all and thus without any kind of certificate problems. I suggest that you've either explicitly tried https:// instead of the http:// given for the URL or that you have installed some browser extension which does this. Insofar it is no fault of Oracle or of an attacker but of you or your setup. – Steffen Ullrich Dec 18 '18 at 17:41
2

I see the same error if I connect to https://xmlns.jcp.org/, so if it is an attack, it's not targeted at you or your local network.

Interestingly, https://jcp.org/ is serving a different certificate and I don't get any errors on that one. That one has only the following SubjectAlternativeNames:

DNS Name=jcp.org
DNS Name=www.jcp.org
DNS Name=www2.jcp.org

I spot-checked a number of the domains in the list you provide, and they all either redirect to an oracle.com URL, or include the Oracle logo somewhere on the page, so my guess that they use that mega cert for websites of random small companies that Oracle has acquired. I'm guessing they used this cert on https://xmlns.jcp.org but forgot to check that it's actually covered by that cert.

My conclusion: Oracle being sloppy with their sites, redirects and certificates.

  • 1
    Even crazier: (at least for me, resolving to 137.254.60.38) https://jcp.org 302s to http://jcp.org/en/home/index (note no S) -- but also sets HSTS! WITH includeSubdomains (which covers xmlns.jcp.org)! – dave_thompson_085 Dec 19 '18 at 4:26
1

The certificate is fine it is just Oracle and the purpose of the web site. Web site is intended for XML schemas which historically are often accessed via plain HTTP. And this particular web site is not intended for HTTPS access and its name is not included in SAN extension of SSL certificate. This is why you get name mismatch error.

Even redirected web site isn't fully secure, because loads Oracle's logo from plain HTTP and every link points to plain HTTP. Though, the rest of content may be deliviered via HTTPS.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.