4

I'm using HttpClient 4.2.3 on Java 1.7 to connect to a remote server hosted by nginx. My organization uses PKI extensively, and both the remote and the client have certificates issued by a common CA.

The server has a signing chain like the following:

CN=Server 123, OU=Servers, OU=My Division, O=My Org, C=US
CN=My Division CA, OU=My Division, O=My Org, C=US
CN=My Org CA, O=My Org, C=US

And the client has a signing chain like the following:

CN=Client 456, OU=Servers, OU=My Division, O=My Org, C=US
CN=My Division CA, OU=My Division, O=My Org, C=US
CN=My Org CA, O=My Org, C=US

For some reason, the client does not present its certificate to the server. The server is configured properly (curl with --cert, --key, and --cacert works, for example). The client has its cert, private key, and signing chain in the key store, and the "My Division CA" and "My Org CA" certs (among others) in its trust store. With SSL debugging on, I can see the key store and trust store load successfully. The client can connect to other servers that request certificates correctly. However, when trying to connect to "Server 123", I see something like the following:

*** ServerHello, TLSv1
...
** TLS_RSA_WITH_AES_256_CBC_SHA
...
*** Certificate chain
...
***
Found trusted certificate:
...
*** CertificateRequest
Cert Types: RSA, DSS
Cert Authorities:
<CN=My Division CA, OU=My Division, O=My Org, C=US>
<CN=My Org CA, O=My Org, C=US>
<CN=Some Other CA, OU=Some Division, O=My Org, C=US>
...
*** ServerHelloDone
...
*** Certificate chain
***
*** ClientKeyExchange, RSA PreMasterSecret, TLSv1
...
HTTP/1.1 400 Bad Request
...
No required SSL certificate was sent
...

The most confusing part is that other clients with the same software present their certificate and can connect just fine.

I have configured all of the infrastructure correctly (to my knowledge), and this should work. I really do not want to write and maintain custom SSL code to fix this.

kbolino
  • 1,441
  • 2
  • 18
  • 24
  • Note that the client is sending an *empty* CertificateChain. This means it couldn't find a certificate that matches the constraints expressed in the CertificateRequest. Does the client have an RSA or DSS certificate? – user207421 Dec 25 '13 at 00:06
  • All the certs in question are RSA – kbolino Dec 27 '13 at 17:33
  • Can you confirm that the SSL based server is configured to either want or require client certificate? (I think the CertificateRequest logging indicates that) – Dave G Jan 08 '14 at 12:03
  • The server is definitely configured to require (RSA) certificates, and non-Java clients can only connect when they send (valid, trusted) certificates. – kbolino Feb 10 '14 at 22:03
  • 1
    @DaveG The fact that the server sent a CertificateRequest already confirms it. – user207421 Jun 30 '16 at 10:09
  • this question lacks the client configuration, making the question not possible to debug. client needs to have ssl context properly. – eis Aug 06 '17 at 17:56

0 Answers0