java - Client authentication with HttpClient -
trying implement client key authentication (with self signed ca).
code looks like:
keystore keystore = keystore.getinstance("pkcs12"); keystore.load(new fileinputstream("client.p12"), "changeit".tochararray()) sslcontext sslcontext = sslcontexts.custom() .loadtrustmaterial(null, new trustselfsignedstrategy()) //dont that, it's simplify example. use real truststore real server certificate imported. dont trust self signed .loadkeymaterial(keystore, "changeit".tochararray()) .build(); socketfactory = new sslconnectionsocketfactory( sslcontext, new string[] {"tlsv1.2", "tlsv1.1"}, null, new noophostnameverifier() ); httpclient httpclient = httpclients.custom() .setsslsocketfactory(socketfactory) .build(); with -djavax.net.debug=all can see correctly chooses certificate, see signatures, see certificate request, , there ecdhclientkeyexchange, etc, looks fine.
but anyway i'm getting following response nginx (with status 400):
<head><title>400 ssl certificate error</title></head> notice, incorrect certificate/key nginx drops session, w/o providing details in plain text response.
this client.p12 works command line, like:
$ curl -ivk --cert client.p12:changeit https://192.168.1.1 * rebuilt url to: https://192.168.1.1/ * trying 192.168.1.1... * connected 192.168.1.1 (192.168.1.1) port 443 (#0) * warning: ssl: certificate type not set, assuming pkcs#12 format. * client certificate: client-es.certs.my * tls 1.2 connection using tls_ecdhe_ecdsa_with_aes_256_gcm_sha384 * server certificate: server.certs.my * server certificate: ca.my > / http/1.1 > host: 192.168.1.1 > user-agent: curl/7.43.0 > accept: */* > < http/1.1 200 ok so key valid. why doesn't work java? there're i've missed in java ssl config?
the problem client key including signing certificates in key chain. not client certificate (which required authentication), whole chain of certificates (without keys of course, certificates)
it was:
> root ca cert -> client ca cert -> client key + cert i guess java uses wrong certificate @ case, maybe ca or intermediate certificate.
fixed adding p12 or keychain client's key , certificate, without intermediates.
it should not have -certfile options (which had before). client key/cert. correct export command is:
openssl pkcs12 -export \ -in client.crt -inkey client.key \ -out client.p12 this client.p12 imported keychain:
keytool -importkeystore \ -deststorepass changeit -destkeystore keystore \ -srckeystore client.p12 -srcstoretype pkcs12 -srcstorepass changeit and worked fine custom authentication.
Comments
Post a Comment