import pfx (public/private keypair) into keystore

I fixed some code error in compiling.

import java.io.*;

import java.util.*;

import java.security.KeyStore;

import java.security.GeneralSecurityException;

import java.security.PrivateKey;

import java.security.cert.Certificate;

import java.security.cert.X509Certificate;

import org.bouncycastle.jce.provider.BouncyCastleProvider;

import org.bouncycastle.jce.*;

public class EsignWithBC {

public static final String KEY_STORE_PASSWORD = "PASSWORD";

public static void main(String[] args){

char[] passwd = KEY_STORE_PASSWORD.toCharArray();

KeyStore keyStore = KeyStore.getInstance("PKCS12", "BC");

try{

FileInputStream fis = new FileInputStream("D:\\jCode\\src\\cert4office.pfx");

keyStore.load(fis, passwd);

fis.close();

}catch(Exception e){

e.printStackTrace();

}

Enumeration aliases = keyStore.aliases();

while(aliases.hasNextElements()) {

System.out.println(aliases.nextElement());

}

}

}

andiespro at 2007-7-2 22:04:17 >

But this code has a Running Exception.

java.security.NoSuchProviderException: no such provider: BC

at java.security.Security.getEngineClassName(Security.java:600)

at java.security.Security.getImpl(Security.java:1043)

at java.security.KeyStore.getInstance(KeyStore.java:199)

at EsignWithBC.main(EsignWithBC.java:21)

Is there anybody can explain about this?

andiespro at 2007-7-2 22:04:17 >

I am trying to do mutual certificate authentication (client/server authentication), and getting following error.

Anybody has any clue?

SSL routines:SSL3_READ_BYTES:sslv3 alert certificate unknown

My code is below.

-

import com.sun.net.ssl.HttpsURLConnection;

import java.security.cert.*;

import javax.net.ssl.*;

import java.security.*;

import java.net.URL;

import java.io.*;

import java.util.Enumeration;

public class ClientCert {

private static SSLSocketFactory getSocketFactory() {

SSLSocketFactory theFactory = null;

try {

// set up key manager to do server authentication

SSLContext theContext;

KeyManagerFactory theKeyManagerFactory;

KeyStore theKeyStore;

char[] thePassword = "goldy123".toCharArray();

theContext = SSLContext.getInstance("TLS");

theKeyManagerFactory = KeyManagerFactory.getInstance("SunX509");

theKeyStore = KeyStore.getInstance("JKS");

theKeyStore.load(new FileInputStream("c:/castore"), thePassword);

//java.security.cert.Certificate certi[] = theKeyStore.getCertificateChain("ca");

// System.out.println("Certificate "+certi.length);

theKeyManagerFactory.init(theKeyStore, thePassword);

KeyManager managers[] = theKeyManagerFactory.getKeyManagers();

theContext.init(managers, null, null);

theFactory = theContext.getSocketFactory();

return theFactory;

} catch (Exception e) {

System.err.println("Failed to create a server socket factory...");

e.printStackTrace();

}

return null;

}

public static void main(String[] args) {

try {

System.setProperty("java.protocol.handler.pkgs","com.sun.net.ssl.internal.www.protocol");

java.security.Security.addProvider(new com.sun.net.ssl.internal.ssl.Provider());

com.sun.net.ssl.HostnameVerifier hv=new com.sun.net.ssl.HostnameVerifier() {

public boolean verify(String urlHostname, String certHostname) {

return true;

}

};

HttpsURLConnection.setDefaultHostnameVerifier(hv);

URL mioUrl = new URL("https://viveksharma:9090/LoginPage.do?userName=root&password=password");

//URL mioUrl = new URL("https://www.verisign.com");

//SSLSocketFactory factory = getFactorySSLFromCert(mioCertFile ,mioCertPswd );

//HttpsURLConnection.setDefaultSSLSocketFactory(factory);

//System.setProperty("javax.net.ssl.keyStore","C:/castore");

//System.setProperty("javax.net.ssl.keyStorePassword","goldy123");

System.setProperty("javax.net.ssl.trustStore","C:/vivekstore");

System.setProperty("javax.net.ssl.trustStorePassword","goldy123");

HttpsURLConnection.setDefaultSSLSocketFactory(getSocketFactory());

HttpsURLConnection urlConn = (HttpsURLConnection)mioUrl.openConnection();

urlConn.connect();

//urlConn.setDoInput(true);

// urlConn.setUseCaches(false);

javax.security.cert.X509Certificate ch[] = urlConn.getServerCertificateChain();

System.out.println(ch[0]);

InputStreamReader streamIn = new InputStreamReader(urlConn.getInputStream());

BufferedReader in = new BufferedReader(streamIn);

String inputLine;

while ((inputLine = in.readLine()) != null)

System.out.println(inputLine);

in.close();

} catch (Exception e) {

e.printStackTrace();

}

}

}

vinay_bansal at 2007-7-2 22:04:17 >

Hi,

Did anybody figure out the problem of pfx importing into the keystore.

I have my pfx file and it shows just one alias.

I am pretty sure it works fine because the p12 file from which it is imported is successfully installed in IE and am able to access the secured site with successful client authentication.

Does anyone have any clue about it.

Regards,

Kushal.

adroit at 2007-7-2 22:04:19 >

I finally solved the problem.

Step 1.

I have a pkcs12(.pfx or .p12) file exported from IE, but it has some attributes cannot be identified by jdk. So I import the pkcs12 file to NetScape and export form NetScape to convert the pkcs12 file . Then I use some code to convert the pkcs12 file to jdk keystore file(.jks).

Here is the code convert .pfx file to .jks.(foreward from someone's program)

import java.security.KeyStore;

import java.security.Key;

import java.security.cert.Certificate;

import java.io.*;

import java.util.*;

public class ConvertPKCS12ToJKS{

public static final String PKCS12 = "PKCS12";

public static final String JKS = "JKS";

public static final String INPUT_KEYSTORE_FILE= "file.p12";

public static final String KEYSTORE_PASSWORD = "111111";

public static final String OUTPUT_KEYSTORE_FILE= "file.jks";

public static void main(String[] args){

try{

KeyStore inputKeyStore = KeyStore.getInstance("PKCS12");

FileInputStream fis = new FileInputStream(INPUT_KEYSTORE_FILE);

char[] nPassword = null;

if ((KEYSTORE_PASSWORD == null) || KEYSTORE_PASSWORD.trim().equals("")){

nPassword = null;

}

else{

nPassword = KEYSTORE_PASSWORD.toCharArray();

}

inputKeyStore.load(fis, nPassword);

fis.close();

KeyStore outputKeyStore = KeyStore.getInstance("JKS");

outputKeyStore.load(null, "123456".toCharArray());

Enumeration enum = inputKeyStore.aliases();

while (enum.hasMoreElements()){ // we are readin just one certificate.

String keyAlias = (String)enum.nextElement();

System.out.println("alias=[" + keyAlias + "]");

if (inputKeyStore.isKeyEntry(keyAlias)){

Key key = inputKeyStore.getKey(keyAlias, nPassword);

Certificate[] certChain = inputKeyStore.getCertificateChain(keyAlias);

outputKeyStore.setKeyEntry("outkey", key, "111111".toCharArray(), certChain);

}

}

FileOutputStream out = new FileOutputStream(OUTPUT_KEYSTORE_FILE);

outputKeyStore.store(out, nPassword);

out.close();

}

catch (Exception e){

e.printStackTrace();

}

}

}

Step 2

I add certificates provided by https server to the keystore(.jks). You can find some codes on Web.

Step 3

Use the following code to complete ssl httpclient(apache) with client authorization.

import org.apache.commons.httpclient.*;

import org.apache.commons.httpclient.methods.*;

import org.apache.commons.httpclient.params.HttpMethodParams;

import java.io.*;

public class HttpClientTutorial {

private static String url = "https://www.test.com";

public static void main(String[] args) {

System.setProperty("javax.net.debug", "all");

System.setProperty("javax.net.ssl.trustStore", "file.jks");

System.setProperty("javax.net.ssl.trustStorePassword", "111111");

System.setProperty("javax.net.ssl.keyStore", "file.jks");

System.setProperty("javax.net.ssl.keyStorePassword", "111111");

HttpClient client = new HttpClient();

// Create a method instance.

GetMethod method = new GetMethod(url);

method.setRequestHeader("User-Agent", "MSIE");

// Provide custom retry handler is necessary

method.getParams().setParameter(HttpMethodParams.RETRY_HANDLER, new DefaultHttpMethodRetryHandler(1, false));

try {

// Execute the method.

int statusCode = client.executeMethod(method);

if (statusCode != HttpStatus.SC_OK) {

System.err.println("Method failed: " + method.getStatusLine());

}

// Read the response body.

byte[] responseBody = method.getResponseBody();

// Deal with the response.

// Use caution: ensure correct character encoding and is not binary data

System.out.println(new String(responseBody));

}

catch (HttpException e) {

System.err.println("Fatal protocol violation: " + e.getMessage());

e.printStackTrace();

}

catch (IOException e) {

System.err.println("Fatal transport error: " + e.getMessage());

e.printStackTrace();

}

finally {

// Release the connection.

method.releaseConnection();

}

}

}

good luck!

richard_xiong at 2007-7-2 22:04:19 >

I am trying to perform mutual authentication between my java app and a website. I have attempted to follow the instructions described in this forum but nothing has worked for me. If any one could offer some assistance it would be greatly appreciated. I have been supplied a .pfx file from the site and I created a .jks store as described above and now i'm trying to connect to the site. I am working with code nearly identical to that shown above involving apache.commons.HttpClient. When i run this code it seems as though certificate exchange is happening correctly but I keep getting the following error:

Fatal transport error: The server auth.pathnet.ca failed to respond

org.apache.commons.httpclient.NoHttpResponseException: The server auth.pathnet.ca failed to respond

at org.apache.commons.httpclient.HttpMethodBase.readStatusLine(HttpMethodBase.java:1835)

at org.apache.commons.httpclient.HttpMethodBase.readResponse(HttpMethodBase.java:1590)

at org.apache.commons.httpclient.HttpMethodBase.execute(HttpMethodBase.java:995)

at org.apache.commons.httpclient.HttpMethodDirector.executeWithRetry(HttpMethodDirector.java:395)

at org.apache.commons.httpclient.HttpMethodDirector.executeMethod(HttpMethodDirector.java:170)

at org.apache.commons.httpclient.HttpClient.executeMethod(HttpClient.java:396)

at org.apache.commons.httpclient.HttpClient.executeMethod(HttpClient.java:324)

at netmedical.nmr.lab.HttpClientTutorial.main(HttpClientTutorial.java:36)

It seems as though the site isn't sending me any data but what confuses me is that if I use the certificate with my browser I receive an html response. Maybe somebody has some idea of what could be the problem, or even the name of a testsite for mutual authentication would be appreciated. Thanks.

dustindoan at 2007-7-2 22:04:19 >

You don't have to import the certificate in the Java keystore. An easy way to configure client-authentication with a .pfx certifacte is to set some system properties:

System.setProperty("javax.net.ssl.keyStore", <path-to-pfx-file>);

System.setProperty("javax.net.ssl.keyStorePassword", <certificate-password>);

System.setProperty("javax.net.ssl.keyStoreType", "pkcs12");

Now if you connect to a SSL-server that requires client-authentication, the configured certificate will be used.

gjkreeft at 2007-7-2 22:04:19 >

I'm having a problem opening pfx files with the java 1.5 implementation. When i try to get the private key from my certificate without any password i get an exception.

Do you guys already had this problem? If yes, how do you solve it?

(Without putting a password on the certificate)

Claudio-TraceSiste at 2007-7-2 22:04:19 >