How to create trusted chain of certificates if I have the last certificate?

Question

Good day. During last two weeks i had been trying to create my xmpp client app which will be connect to the xmpp server via TLS(because server it's using)

My server is:

telnet xmpp.odnoklassniki.ru 5222
Trying 217.20.145.69...
Connected to xmpp.odnoklassniki.ru.
Escape character is '^]'.

If I do:

openssl s_client -connect xmpp.odnoklassniki.ru:5222 -starttls xmpp -showcerts | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > /Users/dmitry/odnoklassniki.pem

/Users/dmitry/odnoklassniki.pem is here

After this how i do can create the chain of certificates and import it to trusted keystore?

If am using Adium messenger it's works fine and in preference's tab i see this:

Please help me.

Exception thrown by my code:

javax.net.ssl.SSLHandshakeException: java.security.cert.CertificateException: root certificate not trusted of [*.odnoklassniki.ru]
    at com.sun.net.ssl.internal.ssl.Alerts.getSSLException(Alerts.java:174)
    at com.sun.net.ssl.internal.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1764)
    at com.sun.net.ssl.internal.ssl.Handshaker.fatalSE(Handshaker.java:241)
    at com.sun.net.ssl.internal.ssl.Handshaker.fatalSE(Handshaker.java:235)
    at com.sun.net.ssl.internal.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1206)
    at com.sun.net.ssl.internal.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:136)
    at com.sun.net.ssl.internal.ssl.Handshaker.processLoop(Handshaker.java:593)
    at com.sun.net.ssl.internal.ssl.Handshaker.process_record(Handshaker.java:529)
    at com.sun.net.ssl.internal.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:958)
    at com.sun.net.ssl.internal.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1203)
    at com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1230)
    at com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1214)
    at org.jivesoftware.smack.XMPPConnection.proceedTLSReceived(XMPPConnection.java:806)
    at org.jivesoftware.smack.PacketReader.parsePackets(PacketReader.java:267)
    at org.jivesoftware.smack.PacketReader.access$000(PacketReader.java:43)
    at org.jivesoftware.smack.PacketReader$1.run(PacketReader.java:70)
Caused by: java.security.cert.CertificateException: root certificate not trusted of [*.odnoklassniki.ru]
    at org.jivesoftware.smack.ServerTrustManager.checkServerTrusted(ServerTrustManager.java:144)
    at com.sun.net.ssl.internal.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1198)
    ... 11 more

UPDATED

1. I'd downloaded certificate from https://www.entrust.net/downloads
2. after this C:\>keytool -import -alias Root -keystore o.keystore -trustcacerts -file root.cer i'd got a keystore o.keystore

3. in code i'd added this options:

   config.setDebuggerEnabled(true); config.setSASLAuthenticationEnabled(true); config.setSecurityMode(ConnectionConfiguration.SecurityMode.enabled); config.setSelfSignedCertificateEnabled(true); config.setExpiredCertificatesCheckEnabled(true); config.setVerifyRootCAEnabled(true); config.setTruststoreType("JKS"); config.setKeystorePath("/Users/dmitry/o.keystore"); config.setTruststorePath("/Users/dmitry/o.keystore"); config.setTruststorePassword("changeit");

But the same error:

javax.net.ssl.SSLHandshakeException: java.security.cert.CertificateException: root certificate not trusted of [*.odnoklassniki.ru]

Debug info

keyStore is : keyStore type is : jks keyStore provider is : init keystore init keymanager of type SunX509 trustStore is: c:\my.keystore trustStore type is : jks trustStore provider is : init truststore adding as trusted cert:  Subject: CN=Entrust Root Certification Authority, OU="(c) 2006 Entrust, Inc.", OU=www.entrust.net/CPS is incorporated by reference, O="Entrust, Inc.", C=US  Issuer:  CN=Entrust Root Certification Authority, OU="(c) 2006 Entrust, Inc.", OU=www.entrust.net/CPS is incorporated by reference, O="Entrust, Inc.", C=US  Algorithm: RSA; Serial number: 0x456b5054  Valid from Mon Nov 27 23:23:42 MSK 2006 until Sat Nov 28 00:53:42 MSK 2026

What I'm doing wrong?

Answer 1

You do not put a complete chain in a "trusted store". The trusted store contains the keys that you trust a priori. Normally, you would have the certificate which starts the chain in your trusted store. The SSL server actually sends a complete chain (that's part of the SSL/TLS standard, section 7.4.2). The client then verifies the signature on each certificate in the chain, relatively to the public key found in the previous certificate, and beginning with the root certificate, which is in the trusted store.

In your case, the root CA appears to be "Entrust.net Secure Server Certification Authority", and that's the certificate you need to put in your trusted store. The default Java trusted store does not contain it. See this question for explanations and pointers on how to change that.