Smart Client WebStart start issue - certificate check failed

Questions, answers, tips and ideas on Servoy Client

Smart Client WebStart start issue - certificate check failed

Postby LXS » Thu Oct 30, 2014 6:17 pm

Hi there,

i've a SmartClient Webstart issue with two customers (different Servoy Servers).
Both called me today that they can't start their SmartClient after a restart anymore (and both already worked with the SmartClient today).
They get an error message from Java WebStart.
The message says, that the certificate can not be validated (see attachment).

- we use a Java Code Signing Certificate from GlobalSign, valid until 2017, signed the whole Servoy Server with it
- customers are using Mac OS X (10.9.3 and 10.10)
- Java Version: 1.6.0_43 and 1.6.0_65
- Servoy Versions: 5.2.15 and Servoy 3.5.x

Because both customers have this issue, i don't think it's a thing with their Servoy Servers or installed programs / firewalls.

Does anybody else have these problems until today?

Here is the stacktrace:

java.security.cert.CertificateException: java.security.cert.CertPathValidatorException: OCSP response error: INTERNAL_ERROR
at com.sun.deploy.security.TrustDecider.isAllPermissionGranted(TrustDecider.java:715)
at com.sun.javaws.security.AppPolicy.grantUnrestrictedAccess(AppPolicy.java:295)
at com.sun.javaws.LaunchDownload.checkSignedResourcesHelper(LaunchDownload.java:1851)
at com.sun.javaws.LaunchDownload.checkSignedResources(LaunchDownload.java:1527)
at com.sun.javaws.Launcher.prepareResources(Launcher.java:1283)
at com.sun.javaws.Launcher.prepareAllResources(Launcher.java:636)
at com.sun.javaws.Launcher.prepareToLaunch(Launcher.java:338)
at com.sun.javaws.Launcher.prepareToLaunch(Launcher.java:238)
at com.sun.javaws.Launcher.launch(Launcher.java:127)
at com.sun.javaws.Main.launchApp(Main.java:460)
at com.sun.javaws.Main.continueInSecureThread(Main.java:292)
at com.sun.javaws.Main$1.run(Main.java:125)
at java.lang.Thread.run(Thread.java:695)
Caused by: java.security.cert.CertPathValidatorException: OCSP response error: INTERNAL_ERROR
at sun.security.provider.certpath.OCSP.check(OCSP.java:222)
at sun.security.provider.certpath.OCSP.check(OCSP.java:120)
at com.sun.deploy.security.TrustDecider.doOCSPEEValidation(TrustDecider.java:1002)
at com.sun.deploy.security.TrustDecider.isAllPermissionGranted(TrustDecider.java:696)
... 12 more

Thanks a lot!
Alex
Attachments
error.PNG
error.PNG (220.98 KiB) Viewed 6012 times
Alexander Stefan
Dr. Maison & Partner GmbH
www.servoy-plugins.de
www.maison-partner.de
LXS
 
Posts: 151
Joined: Thu Mar 01, 2007 12:00 am

Re: Smart Client WebStart start issue - certificate check fa

Postby LXS » Mon Nov 03, 2014 11:43 am

The issue has to do with the GlobalSign certificate.

When i sign the server new with an old (not GlobalSign) certificate, then everything works again.

Has nobody else problems with it?

Alex
Alexander Stefan
Dr. Maison & Partner GmbH
www.servoy-plugins.de
www.maison-partner.de
LXS
 
Posts: 151
Joined: Thu Mar 01, 2007 12:00 am

Re: Smart Client WebStart start issue - certificate check fa

Postby Harjo » Mon Nov 03, 2014 8:55 pm

Today we had the same issue with one customer. All clients were still using Java 1.6. I updated them to Oracle Java 7 and tried even 8, and everything was working again
Harjo Kompagnie
ServoyCamp
Servoy Certified Developer
Servoy Valued Professional
SAN Developer
Harjo
 
Posts: 4321
Joined: Fri Apr 25, 2003 11:42 pm
Location: DEN HAM OV, The Netherlands

Re: Smart Client WebStart start issue - certificate check fa

Postby LXS » Tue Nov 04, 2014 11:08 am

Yes, with Java 7/8 there's no problem.
Some of our customers still use Servoy 5 and so it's no option to jump to Java 7 because of some issues.

Yesterday i contacted the GlobalSign Support and they gave me the clue to reimport the root certificate.
Don't know if it helps but i'll try today.
I let you know...

Alex
Alexander Stefan
Dr. Maison & Partner GmbH
www.servoy-plugins.de
www.maison-partner.de
LXS
 
Posts: 151
Joined: Thu Mar 01, 2007 12:00 am

Re: Smart Client WebStart start issue - certificate check fa

Postby Harjo » Tue Nov 04, 2014 3:44 pm

yeah, I believe Apple updated the Java 1.6 in the background, that does break somehow the Globalsign certificate. I don't know if there is an option in the Java 1.6 control panel, to work-around this.
Harjo Kompagnie
ServoyCamp
Servoy Certified Developer
Servoy Valued Professional
SAN Developer
Harjo
 
Posts: 4321
Joined: Fri Apr 25, 2003 11:42 pm
Location: DEN HAM OV, The Netherlands

Re: Smart Client WebStart start issue - certificate check fa

Postby rieder » Thu Nov 06, 2014 10:48 am

Hi

We have the same problem. But only in our development environment:
OS X 10.9.5
Servoy 7.3.1
Java 1.6.0_65

Customers use Windows. We had no complaints. So far.

Regards
Birgit
Birgit Rieder
7r AG, Switzerland
SAN Developer
http://www.seven-r.ch
User avatar
rieder
 
Posts: 177
Joined: Thu Jan 26, 2012 5:18 pm

Re: Smart Client WebStart start issue - certificate check fa

Postby LXS » Thu Nov 06, 2014 10:57 am

The strange thing is, since tuesday it works again without any changes on the certificate.
Don't know whats going on here...

@rieder: Appears the problem today on your Mac?

No problems on Windows so far as well.
Alexander Stefan
Dr. Maison & Partner GmbH
www.servoy-plugins.de
www.maison-partner.de
LXS
 
Posts: 151
Joined: Thu Mar 01, 2007 12:00 am


Return to Servoy Client

Who is online

Users browsing this forum: No registered users and 12 guests