Edit Question - KnowledgeHub

Title Body

In a Java 1.7 app running on Windows 7, I'm trying to do 2-way SSL with a server (a smartcard token is providing my client certs via openSC). The server's certificate is getting verified by the client just fine, but the client doesn't respond to the server's certificate request. I believe it's because the client isn't able to make a chain from my certificate to one of the ones requested by the server (even though such a chain exists). Here's the SSL debug of the server's Certificate Request and the clients empty response: *** CertificateRequest Cert Types: RSA, DSS, ECDSA Cert Authorities: <CN=c4isuite-SDNI-DC02-CA, DC=c4isuite, DC=local> <CN=DoD Root CA 2, OU=PKI, OU=DoD, O=U.S. Government, C=US> ... *** ServerHelloDone *** Certificate chain *** My client cert is as follows: found key for : Certificate for PIV Authentication chain [0] = [ [ Version: V3 Subject: CN=<...>, OU=CONTRACTOR, OU=PKI, OU=DoD, O=U.S. Government, C=US Signature Algorithm: SHA1withRSA, OID = 1.2.840.113549.1.1.5 Key: Sun RSA public key, 2048 bits Issuer: CN=DOD CA-30, OU=PKI, OU=DoD, O=U.S. Government, C=US SerialNumber: [ 05bf13] Via key-tool, I also installed in the truststore (java cacerts file), what should be the link between my cert's issuer, DOD CA-30, and what the server is requesting, DoD Root CA 2. From SSL debug: adding as trusted cert: Subject: CN=DOD CA-30, OU=PKI, OU=DoD, O=U.S. Government, C=US Issuer: CN=DoD Root CA 2, OU=PKI, OU=DoD, O=U.S. Government, C=US Algorithm: RSA; Serial number: 0x1b5 Valid from Thu Sep 08 10:59:24 CDT 2011 until Fri Sep 08 10:59:24 CDT 2017 adding as trusted cert: Subject: CN=DoD Root CA 2, OU=PKI, OU=DoD, O=U.S. Government, C=US Issuer: CN=DoD Root CA 2, OU=PKI, OU=DoD, O=U.S. Government, C=US Algorithm: RSA; Serial number: 0x5 Valid from Mon Dec 13 09:00:10 CST 2004 until Wed Dec 05 09:00:10 CS

Tags (comma-separated) Cancel