1

I have a server and a client app, that communicate with each other using Https connection and their own certificates (.jks file). The server listens on port 443 and the client connects to it using the dedicated IP and the port of the server.

Recently, I wanted to add a website/service on the same machine. I registered a new sub-domain for that website and got an SSL certificate for it. I'm trying to find a way to have both the website and also the Java app get requests that are being sent to the server on port 443. The website would get the requests that are related with the sub-domain assigned to it, and the Java app would get the requests that are not related with the sub-domain and just have the IP of the server.

For testing purposes, first I tried to use a different port for the redirection of the traffic which is related with the Java app.

 server {

  listen           127.0.0.1;
  listen           25005;
  server_name      1xx.2xx.x.x;
  root             /var/www/html;

  location / {
    proxy_pass https://127.0.0.1:25566;
    proxy_set_header Host $http_host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
  }

}

The above is the configuration for that redirect.

server {
    listen 80;
    return 301 https://$host$request_uri;
}

include /etc/nginx/websiterelated-include/upstreams;

server {
    listen 443;
    server_name subdomain.domain.com;

    ssl on;
    ssl_certificate /etc/ssl/certs/websiterelated.combined-chain.crt;
    ssl_certificate_key /etc/ssl/private/websiterelated.key;

    location /user_avatars {
        add_header X-Content-Type-Options nosniff;
        add_header Content-Security-Policy "default-src 'none' img-src 'self'";
        include /etc/nginx/websiterelated-include/uploads.types;
        alias /home/websiterelated/uploads/avatars;
    }

    location /local-static {
        alias /home/websiterelated/local-static;
    }

    include /etc/nginx/websiterelated-include/certbot;
    include /etc/nginx/websiterelated-include/app;
    include /etc/nginx/websiterelated-include/uploads.route;
}

The above is the configuration for the website/service I use.

The website works properly and I'm able to reach it under subdomain.domain.com . With the Java application, I have some issues: If I try to connect with the Java client to

https://1xx.2xx.x.x:25005/

it fails giving me this error:

javax.net.ssl.SSLException: Unrecognized SSL message, plaintext connection?
    at sun.security.ssl.InputRecord.handleUnknownRecord(InputRecord.java:710)
    at sun.security.ssl.InputRecord.read(InputRecord.java:527)
    at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:973)
    at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1375)
    at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1403)
    at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1387)
    at sun.net.www.protocol.https.HttpsClient.afterConnect(HttpsClient.java:559)
    at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(AbstractDelegateHttpsURLConnection.java:185)
    at sun.net.www.protocol.http.HttpURLConnection.getOutputStream0(HttpURLConnection.java:1283)
    at sun.net.www.protocol.http.HttpURLConnection.getOutputStream(HttpURLConnection.java:1258)
    at sun.net.www.protocol.https.HttpsURLConnectionImpl.getOutputStream(HttpsURLConnectionImpl.java:250)
    at com.plugnbyte.httpclient.core.HttpClient.sendRequestSynchronous(HttpClient.kt:105)
    at com.plugnbyte.httpclient.core.HttpClient$sendRequest$requestThread$1.run(HttpClient.kt:53)
    at java.lang.Thread.run(Thread.java:745)

If I try to connect to https://1xx.2xx.x.x:25566/ it connects successfully.

With Postman, if I send a request to https://1xx.2xx.x.x:25005/ it also fails to get a response back. If I send the request to https://1xx.2xx.x.x:25566/ or http://1xx.2xx.x.x:25005/then I receive successfully a response.

From what I understood, the redirection works, but only over http. Is it possible to change it to https but without adding another certificate?

0

I did find a temporary workaround; still looking for a better solution.

The JKS file can be transformed to the required files for nginx by following the below commands

keytool -importkeystore -srckeystore {keystore.jks} -destkeystore {pkcs12.p12} -deststoretype PKCS12

openssl pkcs12 -nokeys -in {pkcs12.p12} -out {certificate-chain.pem}

openssl pkcs12 -nocerts -nodes -in {pkcs12.p12} -out {unencrypted-key.key}

After doing that, changing the config file for the Java apps to the below:

 server {

    ssl on;
    ssl_certificate /root/certs/certificate-chain.pem;
    ssl_certificate_key /root/certs/unecrypted-key.key;

  listen           127.0.0.1;
  #listen           25005;
  listen           443;
  server_name      1xx.2xx.x.x;
  root             /var/www/html;

  location / {
    proxy_pass https://127.0.0.1:25566;
    proxy_set_header Host $http_host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
  }

}

reloading the settings with nginx -s reload and the Java application was able to connect successfully using the https://1xx.2xx.x.x:443/ URL.

The only downside with this approach is that you need the original password of the JKS file and the private key of the certificate stays unencrypted on the server.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.