Certificate chain not sent to server

Question

I use this method to register a client certificate in a server certificate.

/** * Links the user certificate into the server keystore/truststore. * * @param server * The server party. * @return <code>true</code> if the certificate has been bound, * <code>false</code> if the certificate already was bound to the * truststore. * @throws KeyStoreException */ public boolean linkToServerCertificate(Party server) throws KeyStoreException { if (keyAlias.equals(server.keyAlias)) { throw new IllegalArgumentException("The alias of client and server must be different!"); } keystore.setCertificateEntry(server.keyAlias, server.getAliasCert()); Certificate certificate = keystore.getCertificate(keyAlias); server.keystore.setCertificateEntry(keyAlias, certificate); return true; } 

After rebooting AS, I get this message:

Having the environment variable JAVA_OPTS = "- Djavax.net.debug = ssl", I get this informative:

 *** ServerHelloDone https-jsse-nio-8443-exec-7, WRITE: TLSv1.2 Handshake, length = 1522 https-jsse-nio-8443-exec-8, READ: TLSv1.2 Handshake, length = 7 *** Certificate chain <Empty> *** https-jsse-nio-8443-exec-8, fatal error: 42: null cert chain javax.net.ssl.SSLHandshakeException: null cert chain %% Invalidated: [Session-4, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256] https-jsse-nio-8443-exec-8, SEND TLSv1.2 ALERT: fatal, description = bad_certificate 

Thus, the certificate certificate chain is empty

But checking the certificate on the client, indicating that there is a chain of certificates.

I am confused why the certificate chain is not migrated to the server?

Answer 1

You can copy the entire certificate chain as shown below.

 Key key = keystore.getKey(keyAlias, clientKeyStorePassPhrase); Certificate[] chain = keystore.getCertificateChain(keyAlias); server.keystore.setKeyEntry(keyAlias, key, serverKeyStorePassPhrase, chain); 

See http://www.java2s.com/Code/Java/Security/Importakeycertificatepairfromapkcs12fileintoaregularJKSformatkeystore.htm for more information on how you can copy certificates from one keystore to another keystore.

Update -

Java api docs also assumes keystore.getCertificate(keyAlias); returns only the first element of the certificate chain. Ref - https://docs.oracle.com/javase/8/docs/api/index.html?java/security/KeyStore.html

Ref - for more examples of downloading a certificate chain - https://www.pixelstech.net/article/1420427307-Different-types-of-keystore-in-Java----PKCS12