Java client using client-auth works in code but not with vm-arguments

Question

I have created a keypair with keytool for client authentication. From this file I exported the public key as certificate for the server to authenticate the client.

Client setup:
Loaded the server certificate into a truststore file and used the keystore file as keystore. The client works when I load truststore and keystore via code with SSLContext and using Apache HttpClient:

KeyStore keyStore = KeyStore.getInstance("JKS");
              keyStore.load(new FileInputStream("keystore"), keyPassphrase.toCharArray());
              SSLContext sslcontext = SSLContexts.custom()
                .loadTrustMaterial(new File("truststore"), trustPassphrase.toCharArray(),
                        new TrustSelfSignedStrategy())
                .loadKeyMaterial(keyStore,keyPassphrase.toCharArray())
                .build();
SSLConnectionSocketFactory sslsf = new SSLConnectionSocketFactory(
                sslcontext,
                new String[] {"TLSv1"},   
                null,
                SSLConnectionSocketFactory.getDefaultHostnameVerifier());
              CloseableHttpClient httpclient = HttpClients.custom()
                .setSSLSocketFactory(sslsf)
                .build();

The ssl output shows that the client presents the certificate chain. Setting the keystore with SoapUI also works fine.

My Problem: Providing the same truststore and keystore via vm-arguments (not using SSLContext) I see that the client doesn't present the certificate chain in the ssl output.
VM args:

    -Djavax.net.debug=ssl 
    -Djavax.net.ssl.keyStoreType=JKS 
    -Djavax.net.ssl.keyStore=keystore 
    -Djavax.net.ssl.keyStorePassword=keystorepw
    -Djavax.net.ssl.trustStoreType=jks 
    -Djavax.net.ssl.trustStore=truststore 
    -Djavax.net.ssl.trustStorePassword=truststorepw

Dave Mulligan · Accepted Answer · 2016-02-24 21:16:23Z

0

You seem to have a typo in your VM argument: you have trustore as the arg value, whereas your code used truststore. I hope it really is this simple.

answered Feb 24, 2016 at 21:16

Dave Mulligan

1,6833 gold badges20 silver badges31 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

G.R Over a year ago

Thanks for pointing out the typo - but this isn't the reason. And I am more worried about the keystore... as this doesn't seem to present the certificate to the server.

Collectives™ on Stack Overflow

Java client using client-auth works in code but not with vm-arguments

1 Answer 1

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related