How do I load a signed client certificate into a keystore

Hurray!

Finally managed to get it working, and you know what i'm actually going to write here how I did it so it'll be here for future reference.

Basically I found a really good document on the web with the steps outlined which when followed get the whole setup going properly:

http://www.ddj.com/articles/2001/0102/0102a/0102a.htm

Got the SSLSocketClientWithClientAuth.java code requesting a page on a certificate required server and getting the page contents back.

My problem appears to have been that I wasnt signing the client certificates properly for the keystore (I knew that anyway - there were no properly signed certificates and thats why it fell over every time it got to the stage of the negotiation to pass over its client certificate and the ssl error log was saying "no valid client certificates" or whatever it was).

David

vitamin at 2007-6-29 2:28:53 >

To complete this good article to create a keystore with the certificates, 2 notes :

1) You have to use (at least) JDK1.3

because a keystore created by keytool_JDK1.2.2 (for example) doesn't work : you can create the keystore and put the certificates into it but the handshake fails in searching the certificates...

With jdk1.3.1, it works.

2) When creating a public key and have to be certified by the CA, as article of ddj says :

you 1st create a new certificate request with keytool : keytool -keystore testkeys -certreq -alias client -file client.crs

after this, sign this key with a CA :

openssl ca -config /etc/openssl.cnf -in client.crs -out client.crs.pem -keyfile ca.key

convert it into DER format :

openssl x509 -in client.crs.pem -out client.crs.der -outform DER

and import signed client key into keystore :

keytool -keystore testkeys -alias client -import -file client.crs.der

What I want to underline is the first step :

You have to create the CRS file with keytool (and not openssl), otherwise, the signed key imported into keystore is not recognised in the handshake.

I wanted to underline this point because :

if you create the CRS file with openssl, signed the key with the CA certificate, and use the crs.der file as a signed/certified key,

this works with a C client,

but this fails in a Java client.

A last remark :

the direct link to Doctor Dobb's article is :

http://www.ddj.com/documents/s=870/ddj0102a/0102a.htm

yoyoF at 2007-6-29 2:28:53 >

Hi sbahal ,

Why do you make the people frustrated so that not to use Third Party Certificates.

Without Third Party Certificates there is no gaurantee that your data over secure communication is secured, so pl have a look at the documents based on PKI over the internet.

It is ok for testing with self signed certificates, but the real maaza is with the third party certificates ok.

bye,

Srinivas

svelidanda at 2007-6-29 2:28:53 >

a precision/correction about :

"You have to create the CRS file with keytool (and not openssl), otherwise, the signed key imported into keystore is not recognised in the handshake.

...

if you create the CRS file with openssl, signed the key with the CA certificate, and use the crs.der file as a signed/certified key,

...

this fails in a Java client."

If you have a certificate (created by anyone, for example toto.crt created via openssl), you can import it in the keystore with the option -noprompt.

==>keytool -keystore testkeys -alias client -import -noprompt -file toto.crt

And like this, the handshaking is OK :-)

yoyoF at 2007-6-29 2:28:53 >