2

I am currently having an issue with a .Net application installed as a windows service talking to another application written in Java being ran in Apache Tomcat 7, running on Windows Server 2008.

The .NET app is running as a Windows service and is secured using a TcpListener with a server certificate from the local machine personal store (with the root and intermediate certificate present in the appropriate cert stores for local machine), which it presents to the Java application which is supposed to then provide a client certificate to secure the connection.

All the certificates used in this process are created from our company's CA and the Java application has the certificates added to a keystore and trust store that it is referencing.

When the Java application attempts to open the connection to the .NET service the connection is failing.

We turned tracing on in the .Net application and it reported that it was due to "The remote server did not provide a certificate.". We then turned SSL debugging on for the Apache Tomcat service, it seems to be getting to the stage where the server (in this instance the .Net Windows service) requests a certificate from the client by passing all the root certificates that is in the machines trust store, however the root certificate that has been added by me does not appear in the list of root certificates.

I can see the certificates in the local machines trust store so I am unsure on what to do next. What would stop our own root certificate from being presented in the list of Cert Authorities within the Java application?

user2011162
  • 41
  • 4

1 Answers1

1

One of my colleges found an entry in the windows event log saying that the trusted root certificate list had been truncated due to having to many root certificates available. Once we had removed all the non-required ones it worked.

UPDATE: And message from windows event log looks like this:

When asking for client authentication, this server sends a list of trusted certificate authorities to the client. The client uses this list to choose a client certificate that is trusted by the server. Currently, this server trusts so many certificate authorities that the list has grown too long. This list has thus been truncated. The administrator of this machine should review the certificate authorities trusted for client authentication and remove those that do not really need to be trusted.

See also: http://support.microsoft.com/kb/2801679

CoperNick
  • 2,413
  • 2
  • 21
  • 26
user2011162
  • 41
  • 4