Installing root and intermediate certificates in java keystore

Issue faced:

java software could not validate that the server certificate is correct. This exception is thrown:
javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException:
PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException:
unable to find valid certification path to requested target

Issue in details

Default java validation mechanism:

Certificates with multiple valid hosts

The standard SSL certificate applies only to server in its CN (common name) field.

Client authentication with SSL certificates in Tomcat

Place something like this in server.xml file:

      <Connector port="8443" 
           protocol="HTTP/1.1" 
           SSLEnabled="true"
           maxThreads="150" 
           scheme="https" 
           secure="true"
           sslProtocol="TLS"
           keystorePass="pass"
           keystoreFile="/data/abcd/someserver/server1.jks"
           truststoreFile="/data/abcd/eshop/AbcdRootCa.jks"
           truststorePass="pass"
           keyAlias="www.google.com"
           clientAuth="want"
           SSLVerifyClient="optional"
           SSLCACertificateFile="/data/abcd/someserver/AbcdRootCA.pem"
       />


Attention: clientAuth parameter, in Tomcat 6.0 can get value "want", so it accepts connections with and wothout certificates. The application could decide what to do with the two types of clients internally. Take attention Tomcat 6.0 COULD NOT understand option clientAuth="optional". I suppose it was valid sometime, but now it is not.

Checking certificate validity via CRL with openssl


openssl verify -crl_check -CAfile yoursite-root-ca-c.crt -untrusted signer-ca-c3-chain.crt https-yoursite.com.chain.crt


Getting HTTPS SSL certificates from HttpRequest in Java

Such an easy solution:

java.security.cert.X509Certificate cert[] =
(java.security.cert.X509Certificate[]) httpServletRequest.getAttribute
("javax.servlet.request.X509Certificate");


The result is the whole certificate chain.

The client could or could not send its certificate. A client certificate can be send in SSL version 3 and in TLS. You have to set an option to the web application server to want ant to accept client certificates. In jetty, the option is named wantClientAuth. Later I will extend the article with the name for Tomcat.

Multiple vhosts with apache httpd

There are two major questions about that:
1. May an apache site has multiple https virtual hosts?
2. May an apache site has different certificates for different virtual hosts.

Answers: