JBoss doesn't send SSL client certificates with CXF in EAP 5
Issue
We're having problems with invoking HTTPS services exposed by an SSL Apache reverse proxy from an application (it's JASIG CAS) running on JBoss 5.0.1.
Apache requires JBoss to authenticate itself with a client certificate and that's the part causing troubles. (Note JBoss is the client here)
Apache logs show "SSL3_GET_CLIENT_CERTIFICATE:peer did not return a certificate No CAs known to server for verification?"
JBoss is trying to connect to it.
JBoss logs show
Caused by: javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure
at com.sun.net.ssl.internal.ssl.Alerts.getSSLException(Alerts.java:174)
at com.sun.net.ssl.internal.ssl.Alerts.getSSLException(Alerts.java:136)
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.recvAlert(SSLSocketImpl.java:1694)
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:939)
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.waitForClose(SSLSocketImpl.java:1467)
at com.sun.net.ssl.internal.ssl.HandshakeOutStream.flush(HandshakeOutStream.java:103)
...
Which makes sense because Apache hadn't seen the client certificate
Environment
- JBoss Enterprise Application Platform (EAP) 5.0.1 (CXF is a Tech preview in this release)
Subscriber exclusive content
A Red Hat subscription provides unlimited access to our knowledgebase of over 48,000 articles and solutions.
Welcome! Check out the Getting Started with Red Hat page for quick tours and guides for common tasks.