java https client does not provide client certificate signed by intermediate CA certificate
Issue
The sample client in the knowledge article does not provide the client certificate signed by my intermediate CA certificate.
The keystore.jks has the pair of the key and the client certificate:
$ keytool -V -list -keystore keystore.jks -storepass password
Keystore type: jks
Keystore provider: SUN
Your keystore contains 2 entries
Alias name: client
Creation date: Jul 17, 2018
Entry type: PrivateKeyEntry
Certificate chain length: 1
Certificate[1]:
Owner: CN=client, C=JP
Issuer: CN=subca, C=JP
and the intermediate CA certificate signed by the root CA certificate:
Alias name: subca
Creation date: Jul 17, 2018
Entry type: trustedCertEntry
Owner: CN=subca, C=JP
Issuer: CN=rootca, C=JP
When I run:
java -Djavax.net.debug=ssl,handshake -Djavax.net.ssl.keyStore=keystore.jks -Djavax.net.ssl.keyStorePassword=password -Djavax.net.ssl.trustStore=truststore.jks -Djavax.net.ssl.trustStorePassword=password -jar java_https_client.jar 'https://localhost:8443/' 1
the debug log shows that the server offers the root CA as a cert authority:
*** CertificateRequest
Cert Types: RSA, DSS, ECDSA
Supported Signature Algorithms: SHA512withECDSA, SHA512withRSA, SHA384withECDSA, SHA384withRSA, SHA256withECDSA, SHA256withRSA, SHA256withDSA, SHA224withECDSA, SHA224withRSA, SHA224withDSA, SHA1withECDSA, SHA1withRSA, SHA1withDSA
Cert Authorities:
<CN=ca, C=JP>
But the client does not find certificate chain and does not provide the client certificate and the intermediate CA certificate:
*** ServerHelloDone
Warning: no suitable certificate found - continuing without client authentication
*** Certificate chain
<Empty>
***
Environment
java8
Subscriber exclusive content
A Red Hat subscription provides unlimited access to our knowledgebase of over 48,000 articles and solutions.
Welcome! Check out the Getting Started with Red Hat page for quick tours and guides for common tasks.
