tRest: SSLException: Received fatal alert: internal_error

[Anonymous]

Hello,

I'm trying to use a tRest on a very simple Job.

My URL is:

https://api.status.salesforce.com/v1/incidents/2420

And it works well in my brower.

On Talend, I get this error:

com.sun.jersey.api.client.ClientHandlerException: javax.net.ssl.SSLException: Received fatal alert: internal_error

I replaced the URL with "https://google.com" and some other, it works well...

It looks like it's only with this specific url (https://api.status.salesforce.com).

My version of Talend: 6.4.1

Any ideas?

Thanks!

[fdenis]

can yo manually access this url?

[Anonymous]

If you mean on a browser (same machine), yes, it works.

[fdenis]

did you have any proxy settings.

[Anonymous]

I'm on a company machine, which has a proxy.

If the proxy is activated, nothing works in talend (neither www.google.com, or my initial URL).
If I deactivate it, only google.com works.

[fdenis]

ask your network team to open the url on ssl port for your machine and for the tac server.

[Anonymous]

Ok, thank you. I will ask, but not sure they will accept (such requests were already denied before...).

[fdenis]

if you have access to this file with your account you may download it onces an use it on talend.
Good luck

[Anonymous]

I had a similar problem within a company network. In my network the admins are routing specific domains with their original SSL certificate, while the SSL connection to other systems is bridged by the firewall and therefore a new self-signed certificate is used for the connection between the firewall and my computer.

See if the certificate by the API you're trying to access is replaced by a company-signed certificate - you can click on the lock symbol in your browser and look for the certificate details. If the certificate is replaced, or if the certificate is somehow not trusted, you must enable your Java installation to accept the certificate issued by your company. For doing so, you can ask your administrators to give you the .crt files for the issuing authority ( root-CA-certs / universal CA-certs ). These then need to be included in your Java Keystore (google that to understand what it is doing). For doing so, you must use a command like the following in the /lib/security folder of your JRE / JDK installation - at my machine there was a JDK installed, but i needed to run the command in the JRE folder in the Talend installation (so there was one Java which i installed and an additional Java installed together with Talend, which i needed to patch in order to get things working):

sudo keytool -import -storepass changeit -noprompt -alias YOUR-COMPANY-CA1-v01 -file "YOUR-COMPANY-CA1-v01.crt" -keystore cacerts

My "symptoms" where the same error message, the problem is that Java has its own SSL integration and therefore you need to add support to additional certificates directly in your Java virtual machine (done via the Keystore component) as the trusted certificates of your system (which are used by your browser and other components) are not used by the Java SSL part.

Hope that helps, give Kudos / accept as a solution if you managed to get things working with this

[Anonymous]

Ok, that's interesting...
Here is what I did:
- Activated the proxy: all certificates (google.com, the site of my API), are replaced with one that looks like a company one
- Deactivated the proxy: certificates are different (looks like the original ones)

So, your assumption looks right.

I grabbed 3 of these company certificates (by exporting them with Mozilla Firefox). I couldn't ask my admins, because it's a pain to talk with them. So, I don't know if these certificates are the right ones.

Then, I ran the command you gave me. I did it in the JDK (Talend settings were saying it's the right place to be).
But it looks like I need admin rights (which I don't have), so I'm not sure it fully worked...

So, I still have the same error message. This starts getting tough, because I don't have enough rights on my machine/network...