EVALUATION
Commit to mantis
###@###.### 2002-07-30
------------------------------------------------------------------
In the SSLHandshake process, after the 'serverhello' that follows with the Certificate Request, client is supposed to send its own certificate to server. But in the SSL trace I see that client is not able to find the certificate that matches the server's certificate request criteria. So it sends a no_certificate alert to server, after which the server closes the connection.
I set the client certificate store by setting the system property '-Djavax.net.ssl.keyStore=<path to client keystore>. This keystore meets the criteria requested by the server. In the JSSE logs, I see that this keystore is loaded by JSSE. But even then after 'serverhello', client does not send its certificate as it is not able to find it.
I ran a simple testcase which creates the SSLContext and SSLSocket and invokes the Handshake. While running this testcase, I set the property -Djavax.net.ssl.keyStore=<path to client keystore> on command line. This handshake passes. This makes me think that plugin somehow overides the keystore path.
###@###.### 2002-09-11
-------------------------------------------------
###@###.### 2003-03-31
The current fix for this bug in Mantis and 1.4.1_02 is using JSSE API, Here are the step:
In Java control panel, Advanced tab -> Java Runtime Parameters, specify:
-Djavax.net.ssl.keyStore=<name and path to client keystore file>
-Djavax.net.ssl.keyStorePassword=<password to access this client keystore file>
If it is a PKCS12 format keystore, specify:
-Djavax.net.ssl.keyStoreType=PKCS12
In our future JRE release 1.5, we will create our own client authentication keystore file for JPI and use that for client authentication, for detail info, please see RFE 4797512.
Dennis
|
PUBLIC COMMENTS
###@###.### 2003-03-31
The current fix for this bug in 1.4.2-beta and 1.4.1_02 is using JSSE API, Here are the step:
In Java control panel, Advanced tab -> Java Runtime Parameters, specify:
-Djavax.net.ssl.keyStore=<name and path to client keystore file>
-Djavax.net.ssl.keyStorePassword = <password to access this client keystore file>
Currently, it only support "JKS" format, another bug 4840325 ask support for 'PKCS12' format. We will implement it in 1.4.2-rc and later update release by specify: -Djavax.net.ssl.keyStoreType = PKCS12
In our future JRE release 1.5, we will create our own client authentication keystore file for JPI and use that for client authentication, for detail info, please see RFE 4797512.
Dennis
|
Java