Verifying QuickFIX / J CA Certificate

Question

I have an application written using QuickFIX / J to connect to a Bloomberg server. Bloomberg recently added CA certificate verification to its servers and provided an additional CA certificate file to establish a connection.

My application is using SSL and when disabling CA certificate verification by Bloomberg, the application successfully connects to the server and receives messages. Failed to perform a connection check when enabling CA verification.

Below are the steps I tried.

• I used to use a ImportKeyJava class to add a certificate and key. I modified it to add some certificates. If necessary, I can publish the Java Class.
• When I connect to the server using openssl s_client, it successfully connects to the server.

Is there something that needs to be changed at the application level? Configuration? Or is there something to be done at the Java keystore level?

An error message appears when a connection is added below:

20160823-06: 04:15, FIX.4.4: XXXX-> XXXX, error> (Disconnect: socket exception (/XXXX.XXXX.XXX.XX:20237): javax.net.ssl.SSLHandshakeException: SSL handshake failed .) Successfully terminated sessionId: FIX.4.4: XXXX-> XXXX

Any help is appreciated!

---

Configuration:

[default]
# Settings which apply to all the Sessions.

ConnectionType=initiator
LogonTimeout=86400
ResetOnLogon=Y
UseDataDictionary=Y
MaxLatency=240

#StartTime=00:00:00
#EndTime=00:00:00

#StartTime=02:30:00
#EndTime=12:30:00

StartTime=02:21:00
EndTime=12:21:00

HeartBtInt=30
ReconnectInterval=5

[session]
# Settings specifically for one session
BeginString=FIX.4.4
SocketConnectHost=xxx.xxx.xxx.xxx
SocketUseSSL=Y
SocketKeyStorePassword=importkey
CheckLatency=N

#SendResetSeqNumFlag=Y

# new setups

FileLogHeartbeats=Y
##----- CAPS Configuration ---------##

FileStorePath=/etc/bloomburg-live/msgs
FileLogPath=/etc/bloomburg-live/logs
DataDictionary=/etc/bloomburg-live/conf/FIX44.xml
SocketKeyStore=/root/.keystore
TargetCompID=BLPSTP
SocketConnectPort=xxxxx
SenderCompID=CAPSTP

# log configuration

FileIncludeMilliseconds=Y
FileIncludeTimeStampForMessages=Y
ScreenLogShowHeartBeats=Y       
#Filter heartbeats from output (both incoming and outgoing)

PS - Work with applications without checking the CA certificate. An error occurred while enabling CA certificate verification.

Answer 1

, ssl. - . Quickfix/j ssl- , java. , openssl java keytool . , .

• pkcs12, , ca   .

$ openssl pkcs12 -export -chain -in certificate.pem -inkey encodedKey.pem -out keystore.p12 -name importkey -CAfile CAcertificate.pem

" : " - : importkey

2. keytool, PKCS12 , quickfix/j, /root/.keystore. , .

keytool -importkeystore -destkeystore /root/.keystore -srckeystore keystore.p12 -alias importkey
Enter destination keystore password: importkey
Re-enter new password: importkey
Enter source keystore password: importkey

3. .

SocketKeyStore=keystore.ImportKey
cp /root/.keystore keystore.ImportKey /your/classpath

. : ssl java quickfix/j, quickfix/j . , .

- https://blogs.oracle.com/jtc/entry/installing_trusted_certificates_into_a