Verifying server certificate

[Karmo7]

Describe what you would like to know or do
When connecting the client to a server, I would like to verify that server has the same certificate as in a previously cached connection.

Describe the solution you'd considered
I tried to get the server certificate using getSSLSession().getPeerCertificates(); but the getSSLSession() failed. The error I get is "This websocket uses ws instead of wss. No SSLSession available."

Here is a minimal example:

    public static void main(String[] args) throws URISyntaxException {
        WebSocketClient client = new WebSocketClient(new URI("wss://localhost:7690")) {
            public void onOpen(ServerHandshake serverHandshake) {
                System.out.println("Open");
                getSSLSession();
            }
            public void onMessage(String s) { System.out.println(s); }
            public void onClose(int i, String s, boolean b) { System.out.println("Close"); }
            public void onError(Exception e) { e.printStackTrace(); }
        };
        client.connect();
    }

The full output is:

Open
java.lang.IllegalArgumentException: This websocket uses ws instead of wss. No SSLSession available.
at org.java_websocket.WebSocketImpl.getSSLSession(WebSocketImpl.java:830)
at org.java_websocket.client.WebSocketClient.getSSLSession(WebSocketClient.java:911)
at com.company.Main$1.onOpen(Main.java:18)
at org.java_websocket.client.WebSocketClient.onWebsocketOpen(WebSocketClient.java:605)
at org.java_websocket.WebSocketImpl.open(WebSocketImpl.java:716)
at org.java_websocket.WebSocketImpl.decodeHandshake(WebSocketImpl.java:341)
at org.java_websocket.WebSocketImpl.decode(WebSocketImpl.java:219)
at org.java_websocket.client.WebSocketClient.run(WebSocketClient.java:508)
at java.base/java.lang.Thread.run(Thread.java:832)
Close

So the issue here is that the error suggests I need to use "wss" while I'm clearly already doing that. What should I do here?

[marci4]

Hello @Karmo7,

Yes this was not implemented for the WebSocketClient and its idea was to be used for the WebSocketServer.

The workaround for you should be the following:

((SSLSocket)getSocket()).getSession()

Best regards,
Marcel

[Karmo7]

Thanks, the workaround solved my issue.