I try to make server and client apps on Java with secure SSL (TLS) connection and 2-way SSL authentication. 1-way SSL (without client authentication) works well. With enabled client authentication client can't make handshake with exception:
sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
Server don't have any exceptions. I use Netty in server and client. I use self-signed certificates for server and client. Server and client - it's one physical host now. I'm already added server's certificate in truststore with this tool:
https://java-use-examples.googlecode.com/svn/trunk/src/com/aw/ad/util/InstallCert.java
Client code. Main.
public class SClientApp {
public static final String HOST = "127.0.0.1";
public static final int PORT = 8888;
public static void main(String[] args) throws Exception {
System.setProperty("javax.net.ssl.trustStore", "/etc/ssl/certs/java/cacerts");
System.setProperty("javax.net.ssl.trustStorePassword", "changeit");
// Configure SSL (TLS)
File tls_cert = new File("tls/client1.pem");
SslContext sslCtx = null;
try {
sslCtx = SslContext.newClientContext(tls_cert);
} catch (SSLException e) {
e.printStackTrace();
}
EventLoopGroup group = new NioEventLoopGroup();
try {
Bootstrap b = new Bootstrap();
b.group(group)
.channel(NioSocketChannel.class)
.handler(new SClientInitializer(sslCtx));
// Start the connection attempt.
Channel ch = b.connect(HOST, PORT).sync().channel();
...
} finally {
// The connection is closed automatically on shutdown.
group.shutdownGracefully();
}
}
}
Client code. SClientInitializer.
public class SClientInitializer extends ChannelInitializer<SocketChannel> {
private final SslContext sslCtx;
public SClientInitializer(SslContext sslCtx) {
this.sslCtx = sslCtx;
}
@Override
protected void initChannel(SocketChannel ch) throws Exception {
ChannelPipeline pipeline = ch.pipeline();
SSLEngine ssl_engine = sslCtx.newEngine(ch.alloc(), SClientApp.HOST, SClientApp.PORT);
ssl_engine.setUseClientMode(true);
pipeline.addLast(new SslHandler(ssl_engine));
// On top of the SSL handler, add the text line codec.
pipeline.addLast(new DelimiterBasedFrameDecoder(8192, Delimiters.lineDelimiter()));
pipeline.addLast(new StringDecoder());
pipeline.addLast(new StringEncoder());
// and then business logic.
pipeline.addLast(new SClientHandler());
}
}
Server code. Main.
public class ServerApp {
static final int PORT = Integer.valueOf(Params.get(Const.SERVER_PORT));
public static void main(String[] args) {
System.setProperty("javax.net.ssl.trustStore", "/etc/ssl/certs/java/cacerts");
System.setProperty("javax.net.ssl.trustStorePassword", "changeit");
// Configure SSL (TLS)
File tls_cert = new File("tls/server.pem"); // SSL-cert
File tls_key = new File("tls/server.key.pkcs8"); // Private key
SslContext sslCtx = null;
try {
sslCtx = SslContext.newServerContext(tls_cert, tls_key);
} catch (SSLException e) {
e.printStackTrace();
}
EventLoopGroup bossGroup = new NioEventLoopGroup(1);
EventLoopGroup workerGroup = new NioEventLoopGroup(2);
try {
ServerBootstrap b = new ServerBootstrap();
b.group(bossGroup, workerGroup)
.channel(NioServerSocketChannel.class)
.childHandler(new ServerNetInitializer(sslCtx));
ChannelFuture f = null;
try {
f = b.bind(PORT).sync();
f.channel().closeFuture().sync();
} catch (InterruptedException e) {
e.printStackTrace();
}
} finally {
bossGroup.shutdownGracefully();
workerGroup.shutdownGracefully();
}
}
}
Server code. Initializer.
public class ServerNetInitializer extends ChannelInitializer<SocketChannel> {
private final SslContext sslCtx;
public ServerNetInitializer(SslContext sslCtx) {
this.sslCtx = sslCtx;
}
@Override
protected void initChannel(SocketChannel ch) {
ChannelPipeline pipeline = ch.pipeline();
SSLEngine ssl_engine = sslCtx.newEngine(ch.alloc());
ssl_engine.setUseClientMode(false);
ssl_engine.setNeedClientAuth(true);
pipeline.addLast(new SslHandler(ssl_engine));
// On top of the SSL handler, add the text line codec.
pipeline.addLast(new DelimiterBasedFrameDecoder(8192, Delimiters.lineDelimiter()));
pipeline.addLast(new StringDecoder());
pipeline.addLast(new StringEncoder());
// and then business logic.
pipeline.addLast(new ServerNetHandler());
}
}
Update 1.
Classes JdkSslClientContext and JdkSslServerContext helps me.
On server side:
sslCtx = new JdkSslServerContext(client_tls_cert, null,
server_tls_cert, server_tls_key, "", null,
null, IdentityCipherSuiteFilter.INSTANCE, (ApplicationProtocolConfig) null, 0, 0);
On client side:
sslCtx = new JdkSslClientContext(server_tls_cert,null,client_tls_cert,client_tls_key,"", null, null,IdentityCipherSuiteFilter.INSTANCE,(ApplicationProtocolConfig) null,0,0);
Example of code here: https://github.com/netty/netty/blob/master/handler/src/test/java/io/netty/handler/ssl/JdkSslEngineTest.java
Update 2
On server side better use TrustManagerFactory instead of File object of client certificate, because you may have many clients:
KeyStore ts = null;
ts = KeyStore.getInstance("JKS");
ts.load(new FileInputStream(System.getProperty("javax.net.ssl.trustStore")),
System.getProperty("javax.net.ssl.trustStorePassword").toCharArray());
// set up trust manager factory to use our trust store
TrustManagerFactory tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
tmf.init(ts);
SslContext sslCtx = null;
try {
sslCtx = new JdkSslServerContext(null, tmf,
server_tls_cert, server_tls_key, "", null,
null, IdentityCipherSuiteFilter.INSTANCE, (ApplicationProtocolConfig) null, 0, 0);
} catch (SSLException e) {
log.error("Making ssl context for server - Exception: " + e.toString());
e.printStackTrace();
}
