0

I have been banging my head on a wall for some time with this and hope somebody can explain me what am I doing wrong. I have a tomcat server on which a application is deployed and is contacting another service. Everything works until the client enables client-auth on his load balancer. Tomcat ->app->lb with client auth -> endpoint Enabling handshake debug on the jvm returns this:

javax.net.ssl|FINE|0F|myScheduler-1| UTC|ServerHelloDone.java:151|Consuming ServerHelloDone handshake message (
<empty>
)
javax.net.ssl|FINE|0F|myScheduler-1| UTC|CertificateMessage.java:299|No X.509 certificate for client authentication, use empty Certificate message instead
javax.net.ssl|FINE|0F|myScheduler-1| UTC|CertificateMessage.java:330|Produced client Certificate handshake message (
"Certificates": <empty list>
)

As far as I have read this means no certificates have been found that would fit the requirements of the client-auth. The application and the SSL port of tomcat have their defined keystore and in it keypairs for both, and while different both should pass as the client auth is only asking for a cert signed with a certain CA (they both are). And within cacerts I have all the required certificates of the CA authorities. I tried putting the certificates themselves into cacerts but the same result. Tomcat port config:

<Connector port="443" protocol="HTTP/1.1" SSLEnabled="true" maxThreads="150" scheme="https" secure="true"
            clientAuth="false" sslProtocol="TLS" sslEnabledProtocols="TLSv1.2"
            keystoreFile="/usr/local/tomcat/config/pkcs_keystore.jks"
            keystorePass="***************"
            keyAlias="server_alias" />

I tried connecting via a browser to the endpoint and sure enough it asked me for a certificate, I supplied it with the "server_alias" certificate and it works flawlessly so I have no idea why it wont work with tomcat.

I am a system engineer so I have no idea if this is perhaps something that has to be done within the application itself? Any help would be welcome.

Adrian Perkovic
  • 3
  • 1
  • Java SSL clients use the keystore specified by the `javax.net.ssl.keyStore` system property to retrieve client certificates (see [Java SSL and cert keystore](https://stackoverflow.com/a/5871352/11748454)). You only configured the keystore to use by Tomcat as a server (it is a similar situation as in [this question](https://stackoverflow.com/q/61072648/11748454)). – Piotr P. Karwasz May 16 '21 at 09:35
  • @PiotrP.Karwasz I have done that (set -Djavax.net.ssl.keyStore and -Djavax.net.ssl.trustStore to the keystore) and I still get the same error. They are pointing to the same keystore that contains the two keypairs and CA certificates. Is it possible that my certificates are in the wrong format? – Adrian Perkovic May 16 '21 at 11:58
  • 1
    If the tomcat-app that makes the service call is yours why don't you load the necessary keystore andperform key selection on code level? See for example https://stackoverflow.com/a/60845060/150978 – Robert May 16 '21 at 13:46
  • @Robert Sadly I cant do that, I only get the finished application in a .war format. :/ – Adrian Perkovic May 16 '21 at 15:26

0 Answers0