[urgent]SSL Handshake failure. Certificate mismatch

The SSL handshake is failing at the client with the below error message

main, handling exception: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: No trusted certificate found

I have added the signed certificate to the keystore and all the certificate chain (including signed certificate) in separate keystore for the client.

By seeing the below ssl trace it looks like the server is sending different version of the certificate to the client for authentication. Because validity period and the serial number is different.

Looks like the server is sending the non unsigned certificate.

Below is the trace from the ssl log

*******************Server adding its keystore

adding as trusted cert:

Subject: CN=dex@nbd.com, OU=Information Technology, O=NBD, L=Deira-Dubai, ST=Dubai, C=AE

Issuer: CN=Comtrust Server CA, OU=Comtrust eBusiness Services, O=Etisalat, C=AE

Algorithm: RSA; Serial number: 0y30b

Valid from Thu Oct 05 12:59:06 GST 2006 until Fri Oct 05 03:59:00 GST 2007

*********************server sending the certificate to client for authendication

found key for : mykey

chain [0] = [

[

Version: V1

Subject: CN=dex@nbd.com, OU=Information Technology, O=NBD, L=Deira-Dubai, ST=Dubai, C=AE

Signature Algorithm: MD5withRSA, OID = 1.2.840.113549.1.1.4

Key: Sun RSA public key, 1024 bits

modulus: 153978692288483889154455446439230439204336990565555553500862218196396873759810719253246666693974716031443800000620106926888884009575754311374710926532792537717536326102136297551807947276580799981867997556509567686710099139692883137478613823051068312313408365384817058556288913368674145967884348694388335194289

public exponent: 65537

Validity: [From: Wed Oct 04 12:23:39 GST 2006,

To: Tue Jan 02 12:23:39 GST 2007]

Issuer: CN=dex@nbd.com, OU=Information Technology, O=NBD, L=Deira-Dubai, ST=Dubai, C=AE

SerialNumber: [12346f8b]

]

Can anyone please help me to resolve this issue? We are going live on Monday and I need to fix this issue ASAP.

[2150 byte] By [babuce@gmail.coma] at [2007-10-3 7:13:07]
# 1

> have added the signed certificate to the keystore

> and all the certificate chain (including signed

> certificate) in separate keystore for the client.

The last part of this should refer to the client's truststore, not its keystore. The client doesn't need a keystore unless it is sending certificates to the server.

And this part:

>*******************Server adding its keystore

> adding as trusted cert:

looks more like what would happen at the client side. The server has no need of trusted certs unless, again, the client is sending certificates to it.

So I think you've misinterpreted the output. Anyway make sure the client's *truststore* is set to a place containing the certificate chain. No need for the server's actual certificate to appear there, just its root signer.

ejpa at 2007-7-15 2:09:17 > top of Java-index,Security,Java Secure Socket Extension (JSSE)...