SSLHandshake exception
Hello all,
I am writing a small client application that needs to connect to secure server that is PKI enabled. My code works fine when the server is not PKI enabled. Then I can make an https request over SSL and get the response. But when I try the same code when PKI is enabled, I am getting following exception:
Exception : javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure
Any help is greatly appreciated.
thanks
[474 byte] By [
lumetaa] at [2007-10-1 21:06:41]
On the server side, this is what I am seeing:
Aug 15 15:19:53 stealth11 [STDERR][35574]: [Mon Aug 15 15:19:53 2005] [error] mod_ssl: SSL handshake failed (server xxxxxx, client x.x.x.x) (OpenSSL library error follows)
Aug 15 15:19:53 stealth11 [STDERR][35574]: [Mon Aug 15 15:19:53 2005] [error] OpenSSL: error:140890C7:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:peer did not return a certificate [Hint: No CAs known to server for verification?]
So, how do I return a certificate to the server?
thanks
What do you mean when you say the server is 'PKI enabled'?
If it means what I think it means, it means that the Java client needs a keystore to get its authenticating certificate from, which can most easily be set via the java.net.ssl.keystoreXXX properties, if I have spelt that right.
ejpa at 2007-7-13 3:04:23 >
ejp,
yes, that is exactly right. my server is CGI using Apache. I do have certificate issued by the server. All I need to do is read that certificate and send it to the server, but when I use KeyStore, I am getting an IO Exception when I load the certificate. My server certificate is in PKCS12 format and looks like that could be the problem. Any ideas?
Please, let me know,
thanks,
Namrata
You don't load the certificate directly, you have to import it into the keystore, and cite that keystore in the system properties when executing the client.
ejpa at 2007-7-13 3:04:23 >
Thanks again for your reply. I hope I can get this to work. I understand your point. But, when I try to import the certificate into my keystore I am getting the following error:
Keytool error: java.lang.Exception: Input not an X.509 certificate.
The command I use to import is following:
keytool - import -file D:\Ic-NSA-User-Sign.crt.
This is the certificate that I get from my web server on a CD-rom.
Any ideas?
thanks again,
namrata
