Hi.

While trying to parse a https website, I get the following error message:

javax.net.ssl.SSLHandshakeException: 
sun.security.validator.ValidatorException: Violated path length constraints

Could anybody tell me what this exactly means?
Should I interpet it as "Site has a broken SSL certificate, tell them"?

Greetings,

Thomas Fritz.

On Thu, 10 Mar 2005 12:11:23 +0100, Thomas Fritz wrote:

> Hi.
> 
> While trying to parse a https website, I get the following error message:
> 
> javax.net.ssl.SSLHandshakeException:
> sun.security.validator.ValidatorException: Violated path length
> constraints
> 
> Could anybody tell me what this exactly means? Should I interpet it as
> "Site has a broken SSL certificate, tell them"?
> 
> Greetings,
> 
> Thomas Fritz.

Yes, this error message indicates that the number of critical
extensions in the Set of critical extensions found in the certificate (by
calling java.security.cert.X509Extension.getCriticalExtensionOIDs()) does
not match the number of critical extensions (path length) recorded in the
BasicConstraints critical extension. The path length is returned by the
java.security.cert.X509Certificate.getBasicConstraints method. See the
JavaDocs for these two methods.

Chuck

Hi.

>>While trying to parse a https website, I get the following error message:
>>
>>javax.net.ssl.SSLHandshakeException:
>>sun.security.validator.ValidatorException: Violated path length
>>constraints
>>
>>Could anybody tell me what this exactly means? Should I interpet it as
>>"Site has a broken SSL certificate, tell them"?
> 
> Yes, this error message indicates that the number of critical
> extensions in the Set of critical extensions found in the certificate (by
> calling java.security.cert.X509Extension.getCriticalExtensionOIDs()) does
> not match the number of critical extensions (path length) recorded in the
> BasicConstraints critical extension. The path length is returned by the
> java.security.cert.X509Certificate.getBasicConstraints method. See the
> JavaDocs for these two methods.

Ok. After reading the JavaDocs and looking at the Values (the size of 
the Set returned by 
java.security.cert.X509Extension.getCriticalExtensionOIDs() is 0, and 
the int returned by 
java.security.cert.X509Certificate.getBasicConstraints -1), I'm not 
sure, but could it be that I more or less found a bug?

As far as I understand the JavaDocs, in this case, -1 and 0 should match 
true, as there just are no critical extensions in the certificate. Or is 
in fact the certificate broken, as it has no basic constraints?

Greetings,

Thomas Fritz.