title: CalDAV calendar server SSL not working
body: <p>I'm building a java-ee application which should connect to an iCal CalDAV server using SSL.<br>
  I get this error every time I try to connect to the server.</p>
  
  <pre><code>javax.net.ssl.SSLException: Received fatal alert: bad_record_mac
  </code></pre>
  
  <p>With other tools it worked fine, even with java tools after importing the certificate into the truststore.  </p>
  
  <p>If I try to connect using TLS I get a response that says, the server only supports SSLv3.
  heres how I investigated the SSL handshake with the openssl tool</p>
  
  <pre><code>openssl s_client -host kalender.myserver.com -port 8443
  </code></pre>
  
  <p>this is what i get:  </p>
  
  <pre><code>CONNECTED(00000003)
  depth=2 C = BE, O = GlobalSign nv-sa, OU = Root CA, CN = GlobalSign Root CA
  verify error:num=19:self signed certificate in certificate chain
  verify return:0
  ---
  Certificate chain
   0 s:/OU=Domain Control Validated/CN=*.myserver.com
     i:/C=BE/O=GlobalSign nv-sa/CN=AlphaSSL CA - SHA256 - G2
   1 s:/C=BE/O=GlobalSign nv-sa/CN=AlphaSSL CA - SHA256 - G2
     i:/C=BE/O=GlobalSign nv-sa/OU=Root CA/CN=GlobalSign Root CA
   2 s:/C=BE/O=GlobalSign nv-sa/OU=Root CA/CN=GlobalSign Root CA
     i:/C=BE/O=GlobalSign nv-sa/OU=Root CA/CN=GlobalSign Root CA
  ---
  Server certificate
  [[certificate]]
  subject=/OU=Domain Control Validated/CN=*.myserver.com
  issuer=/C=BE/O=GlobalSign nv-sa/CN=AlphaSSL CA - SHA256 - G2
  ---
  No client certificate CA names sent
  ---
  SSL handshake has read 3422 bytes and written 565 bytes
  ---
  New, TLSv1/SSLv3, Cipher is AES256-SHA
  Server public key is 2048 bit
  Secure Renegotiation IS supported
  Compression: NONE
  Expansion: NONE
  SSL-Session:
      Protocol  : SSLv3
      Cipher    : AES256-SHA
      Session-ID: 99D28660004D122D20657883562319F4F3063B1123AC882AD722B781EB13FF45
      Session-ID-ctx: 
      Master-Key: 6228C28941D81771C68F0FA5546491804081294A95F4A2BE19AC239CF47C24752AC350F54BAEDD3C8E4A7E1044B4B429
      Key-Arg   : None
      PSK identity: None
      PSK identity hint: None
      SRP username: None
      Start Time: 1406820530
      Timeout   : 300 (sec)
      Verify return code: 19 (self signed certificate in certificate chain)
  ---
  </code></pre>
  
  <p>when i try</p>
  
  <pre><code>openssl s_client -tls1 -host kalender.myserver.com -port 8443
  </code></pre>
  
  <p>this appears and the connection fails:</p>
  
  <pre><code>CONNECTED(00000003)
  139883471566496:error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number:s3_pkt.c:337:
  ---
  no peer certificate available
  ---
  No client certificate CA names sent
  ---
  SSL handshake has read 5 bytes and written 7 bytes
  ---
  New, (NONE), Cipher is (NONE)
  Secure Renegotiation IS NOT supported
  Compression: NONE
  Expansion: NONE
  SSL-Session:
      Protocol  : TLSv1
      Cipher    : 0000
      Session-ID: 
      Session-ID-ctx: 
      Master-Key: 
      Key-Arg   : None
      PSK identity: None
      PSK identity hint: None
      SRP username: None
      Start Time: 1407752794
      Timeout   : 7200 (sec)
      Verify return code: 0 (ok)
  ---
  </code></pre>
  
  <p>Here's how I investigated the SSL handshake with a Java tool I found <a href="https://secure.marumoto.us/motowiki/tiki-index.php?page=Test+a+Java+SSL+connection" rel="nofollow">here</a>.<br>
  I modified it so i can use another port.<br>
  to google:<br>
  <code>java HTTPSClient google.com</code> --> does not throw an exception<br>
  to my server on port 8443:<br>
  SSLv3: no error<br>
  TLSv1: <code>javax.net.ssl.SSLHandshakeException: Server chose SSLv3, but that protocol version is not enabled or not supported by the client.</code><br>
  I drew the conclusion that the server only supports SSLv3, so I tried to get my app to do that too, using a HttpClient provided by <a href="http://hc.apache.org/" rel="nofollow">apache</a> but it does not seem to be compatible.
  That means I have to say my app to use SSLv3, too. That would be somewhere in the <code>org.osaf.caldav4j.methods.HttpClient</code> class which inherits from <code>org.apache.commons.httpclient.HttpClient</code>. The problem is, I can't find any way to do so.<br>
  I tried </p>
  
  <pre><code>System.setProperty("https.protocols", "SSLv3");
  </code></pre>
  
  <p>and</p>
  
  <pre><code>httpClient.getParams().setParameter("https.protocols", "SSLv3");
  </code></pre>
  
  <p>but neither of them makes a difference. I also tried to somehow insert a custom <code>SSLSocketFactory</code> into the <code>HTTPClient</code> but found no way to do that. Here is the code to build the <code>HTTPClient</code>:</p>
  
  <pre><code>public HttpClient getHttpClient(String host, int port, String user, String password){        
      System.setProperty("https.protocols", "SSLv3");
      org.apache.commons.httpclient.HttpClient httpClient = new HttpClient();
      String protocol = "https";
      String baseDir = "/calendars/users/" + user + "/calendar/";
      httpClient.getHostConfiguration().setHost(host, port, protocol);
      Credentials httpCredentials = new UsernamePasswordCredentials(user, password);
      httpClient.getState().setCredentials(AuthScope.ANY, httpCredentials);
      httpClient.getParams().setAuthenticationPreemptive(true);
      httpClient.getParams().setParameter("https.protocols", "SSLv3");
      return (HttpClient) httpClient;
  }
  </code></pre>
  
  <p>And this is the stack trace i get when i try to connect (i cut off the java-ee internal stuff):</p>
  
  <pre><code>Caused by: javax.net.ssl.SSLException: Received fatal alert: bad_record_mac
      at sun.security.ssl.Alerts.getSSLException(Alerts.java:208)
      at sun.security.ssl.Alerts.getSSLException(Alerts.java:154)
      at sun.security.ssl.SSLSocketImpl.recvAlert(SSLSocketImpl.java:1959)
      at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1077)
      at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1312)
      at sun.security.ssl.SSLSocketImpl.writeRecord(SSLSocketImpl.java:702)
      at sun.security.ssl.AppOutputStream.write(AppOutputStream.java:122)
      at java.io.BufferedOutputStream.flushBuffer(BufferedOutputStream.java:82)
      at java.io.BufferedOutputStream.flush(BufferedOutputStream.java:140)
      at org.apache.webdav.lib.methods.HttpRequestBodyMethodBase.writeRequestBody(HttpRequestBodyMethodBase.java:235)
      at org.apache.webdav.lib.methods.XMLResponseMethodBase.writeRequestBody(XMLResponseMethodBase.java:303)
      at org.apache.commons.httpclient.HttpMethodBase.writeRequest(HttpMethodBase.java:2114)
      at org.apache.commons.httpclient.HttpMethodBase.execute(HttpMethodBase.java:1096)
      at org.apache.commons.httpclient.HttpMethodDirector.executeWithRetry(HttpMethodDirector.java:398)
      at org.apache.commons.httpclient.HttpMethodDirector.executeMethod(HttpMethodDirector.java:171)
      at org.apache.commons.httpclient.HttpClient.executeMethod(HttpClient.java:397)
      at org.osaf.caldav4j.methods.HttpClient.executeMethod(HttpClient.java:103)
      at org.apache.commons.httpclient.HttpClient.executeMethod(HttpClient.java:346)
      at org.osaf.caldav4j.CalDAVCollection.getCalDAVResources(CalDAVCollection.java:1029)
      ... 86 more
  </code></pre>