1

A provider our system works with has given us a certificate named MM_Base64.cer. Our keystore is mitkeystore. We are using our keystore like this:

<Connector port="8443" protocol="org.apache.coyote.http11.Http11NioProtocol"
              maxThreads="150" SSLEnabled="true" scheme="https" secure="true"
              clientAuth="false" sslProtocol="TLS" keystoreFile="path\mitkeystore" keystorePass="ourpass" />

We imported their key into our JDK and JVM like this:

keytool -import -file "path\MM_Base64.cer" -keystore "C:\Program Files\Java\jre7\lib\security\cacerts"

Still, handshake problem occurs.

I am looking at this question. It looks complicated. Is our issue as complicated as theirs? Is there an easy way to get our system to work with the provider's system?

Community
  • 1
  • 1
Sandah Aung
  • 6,156
  • 15
  • 56
  • 98
  • could you please add your errors to your question ? – Nicolas Filotto Nov 08 '16 at 11:55
  • I thought you should import you provider's cert into truststore, not keystore, and indicate in server.xml that you want to use that truststore. see here for details how the 2 are different: http://www.java67.com/2012/12/difference-between-truststore-vs.html#more – borowis Nov 08 '16 at 11:57
  • added as an answer – borowis Nov 08 '16 at 12:02

2 Answers2

4

I might be wrong on that one, but I think that you have to import provider's certificate into trust store. See here for the description of keystore vs trustore. Then you have to point tomcat to the trust store file in the http connector config block inside your server.xml.

The idea is that when SSL handshake occurs you provider presents its certificate and to know if it could be trusted or not tomcat uses truststore to find information on that certificate or certification authorities.

borowis
  • 1,207
  • 10
  • 17
3

I agree with Borys Zibrov about truststore. https://www.mulesoft.com/tcat/tomcat-ssl is a good link for ssl setup.

Apart from the point about truststore, I noticed that you are importing the certificate into the jdk's keystore but using your custom keystore(mitkeystore) as keystoreFile. Is there a reason why you didnt load it into mitkeystore? (This should actually be a comment but i don't have sufficient reputation so bear with me.)

Curious
  • 453
  • 4
  • 15
  • 1
    yeah, that's a good observation. Looks like they tried everything to make it work. should have been `mitkeystore` indeed – borowis Nov 08 '16 at 14:58