How to whitelist certificate extension in java

Question

While ssl handshake, I get the following error:

Certificate contains unsupported critical extensions.

This exception is thrown by sun.security.validator.EndEntityChecker class

    private void checkRemainingExtensions(Set<String> exts)
            throws CertificateException {
        // basic constraints irrelevant in EE certs
        exts.remove(SimpleValidator.OID_BASIC_CONSTRAINTS);

        // If the subject field contains an empty sequence, the subjectAltName
        // extension MUST be marked critical.
        // We do not check the validity of the critical extension, just mark
        // it recognizable here.
        exts.remove(OID_SUBJECT_ALT_NAME);

        if (!exts.isEmpty()) {
            throw new CertificateException("Certificate contains unsupported "
                + "critical extensions: " + exts);
        }
    }

It turns out that extension, which causes the error is the only one not removed during the validation process. Removing this extension from CA is not an option. How can I whitelist this extension?

Answer 1

You can write a PKIXCertPathChecker that processes and removes this extension, and then add that as a checker using the PKIXParameters.addCertPathChecker method, and then set those parameters using the TrustManagerFactory.init method.