Good day. During last two weeks i had been trying to create my xmpp client app which will be connect to the xmpp server via TLS(because server it's using)

My server is:

telnet xmpp.odnoklassniki.ru 5222
Connected to xmpp.odnoklassniki.ru.
Escape character is '^]'.

If I do:

openssl s_client -connect xmpp.odnoklassniki.ru:5222 -starttls xmpp -showcerts | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > /Users/dmitry/odnoklassniki.pem

/Users/dmitry/odnoklassniki.pem is here

After this how i do can create the chain of certificates and import it to trusted keystore?

If am using Adium messenger it's works fine and in preference's tab i see this:

Adium chain

Please help me.

Exception thrown by my code:

javax.net.ssl.SSLHandshakeException: java.security.cert.CertificateException: root certificate not trusted of [*.odnoklassniki.ru]
    at com.sun.net.ssl.internal.ssl.Alerts.getSSLException(Alerts.java:174)
    at com.sun.net.ssl.internal.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1764)
    at com.sun.net.ssl.internal.ssl.Handshaker.fatalSE(Handshaker.java:241)
    at com.sun.net.ssl.internal.ssl.Handshaker.fatalSE(Handshaker.java:235)
    at com.sun.net.ssl.internal.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1206)
    at com.sun.net.ssl.internal.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:136)
    at com.sun.net.ssl.internal.ssl.Handshaker.processLoop(Handshaker.java:593)
    at com.sun.net.ssl.internal.ssl.Handshaker.process_record(Handshaker.java:529)
    at com.sun.net.ssl.internal.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:958)
    at com.sun.net.ssl.internal.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1203)
    at com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1230)
    at com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1214)
    at org.jivesoftware.smack.XMPPConnection.proceedTLSReceived(XMPPConnection.java:806)
    at org.jivesoftware.smack.PacketReader.parsePackets(PacketReader.java:267)
    at org.jivesoftware.smack.PacketReader.access$000(PacketReader.java:43)
    at org.jivesoftware.smack.PacketReader$1.run(PacketReader.java:70)
Caused by: java.security.cert.CertificateException: root certificate not trusted of [*.odnoklassniki.ru]
    at org.jivesoftware.smack.ServerTrustManager.checkServerTrusted(ServerTrustManager.java:144)
    at com.sun.net.ssl.internal.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1198)
    ... 11 more


  1. I'd downloaded certificate from https://www.entrust.net/downloads
  2. after this C:\>keytool -import -alias Root -keystore o.keystore -trustcacerts -file root.cer i'd got a keystore o.keystore
  3. in code i'd added this options:

    config.setDebuggerEnabled(true); config.setSASLAuthenticationEnabled(true); config.setSecurityMode(ConnectionConfiguration.SecurityMode.enabled); config.setSelfSignedCertificateEnabled(true); config.setExpiredCertificatesCheckEnabled(true); config.setVerifyRootCAEnabled(true); config.setTruststoreType("JKS"); config.setKeystorePath("/Users/dmitry/o.keystore"); config.setTruststorePath("/Users/dmitry/o.keystore"); config.setTruststorePassword("changeit");

But the same error:

javax.net.ssl.SSLHandshakeException: java.security.cert.CertificateException: root certificate not trusted of [*.odnoklassniki.ru]

Debug info

keyStore is : keyStore type is : jks keyStore provider is : init keystore init keymanager of type SunX509 trustStore is: c:\my.keystore trustStore type is : jks trustStore provider is : init truststore adding as trusted cert:  Subject: CN=Entrust Root Certification Authority, OU="(c) 2006 Entrust, Inc.", OU=www.entrust.net/CPS is incorporated by reference, O="Entrust, Inc.", C=US  Issuer:  CN=Entrust Root Certification Authority, OU="(c) 2006 Entrust, Inc.", OU=www.entrust.net/CPS is incorporated by reference, O="Entrust, Inc.", C=US  Algorithm: RSA; Serial number: 0x456b5054  Valid from Mon Nov 27 23:23:42 MSK 2006 until Sat Nov 28 00:53:42 MSK 2026

What I'm doing wrong?

  • Hi Dmitry, welcome to Information Security. Please see the FAQ - please do not cross-post between sites. If the Stack Overflowmoderators think it would be better here, they have the option to migrate it. You can also flag the question to request a migration.
    – AviD
    Nov 14, 2012 at 10:39
  • SO link deleted. Nov 14, 2012 at 11:09
  • Dmitry, you may have deleted the link to the original question on SO, but it is still a duplicate question, cross-posted on two sites.
    – AviD
    Nov 14, 2012 at 15:51
  • ok. i will request flag my question on SO. thanks. Nov 14, 2012 at 17:55

1 Answer 1


You do not put a complete chain in a "trusted store". The trusted store contains the keys that you trust a priori. Normally, you would have the certificate which starts the chain in your trusted store. The SSL server actually sends a complete chain (that's part of the SSL/TLS standard, section 7.4.2). The client then verifies the signature on each certificate in the chain, relatively to the public key found in the previous certificate, and beginning with the root certificate, which is in the trusted store.

In your case, the root CA appears to be "Entrust.net Secure Server Certification Authority", and that's the certificate you need to put in your trusted store. The default Java trusted store does not contain it. See this question for explanations and pointers on how to change that.

  • I'll try it. if i'd understood you right i should download Entrust root CA from Entrust.net, but what info i should provide during registration? (name, company, email, phone) it should my own information or info from the server? after i should create trusted store with this root certificate and it's must work properly. Thank you very much! Nov 15, 2012 at 8:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .