server-side authentication with ssl: sending certificate file from client

Question

i've successfully set SSL authentication up with certificates: configured Apache http-client, configured the server (weblogic, CLIENT-CERT login-config if that matters), tested that it works.

however, in the client code i have to hardcode path to trust-store (either manually initializing TrustManagerFactory or through respective JVM properties) and its password also and i don't feel it's right. additionally, the certificates have to be manually registered on the client-side with keytool, which is also not so flexible.

so, is there a way to completely avoid all that? ideally the client will have certificate file bundled with it, sending it to the server when requested to do so. i tried to google it, but never found how to manually stream a certificate file.

UPDATE

as suggested here, i tried to read certificate file into a new keystore with no password and initialize both KeyManagerFactory and TrustManagerFactory with this keystore:

CertificateFactory cf = CertificateFactory.getInstance("X509");
Certificate cer = cf.generateCertificate(new FileInputStream("myFile.cer"));

KeyStore defaultKeyStore = KeyStore.getInstance(KeyStore.getDefaultType());
defaultKeyStore.load(null, "".toCharArray());
defaultKeyStore.setCertificateEntry("alias", cer);

trustManagerFactory.init(defaultKeyStore);
keyManagerFactory.init(defaultKeyStore, "".toCharArray());

SSLContext ctx = SSLContext.getInstance("SSL");
ctx.init(keyManagerFactory.getKeyManagers(), trustManagerFactory.getTrustManagers(), null);

but it didn't work. usual exception "peer not authenticated". i guess it's because i need corresponding private key also, but there's no way to get it...

You can't get the private key of your own certificate? That doesn't make sense. Unclear what you're asking. — user207421
– user207421, Commented Oct 17, 2016 at 3:56

Haderlump · Accepted Answer · 2012-03-14 11:26:56Z

1

If you want to trust for example one specific server certificate, you could add the X.509 certificate to your classpath and use an javax.net.ssl.X509TrustManager (produced from your TrustManagerFactory). No need for a keystore (and keytool) then.

answered Mar 14, 2012 at 11:26

Haderlump

1262 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Yog Sothoth Over a year ago

it's the other way around: the server has to check client's certificate to decide if it trusts this client.

Haderlump Over a year ago

In this case you need a keystore containing the clients key and certificate. you could of course bundle it in the JAR and load it from the classpath (Using a KeyManager the same way as the TrustManager) but this wouldn't make sense, since this should be a secret only known to the client.

Collectives™ on Stack Overflow

server-side authentication with ssl: sending certificate file from client

1 Answer 1

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related