0

I have Spring Boot 1.5 app which is setting up a connection with some Web Services. In all the cases, these are TLS 1.2 connections. I run my app passing this JVM params:

-Djavax.net.ssl.keyStore=${KEYSTORE} \
-Djavax.net.ssl.keyStorePassword=${KEYSTORE_PW} -> password

The javax.net.ssl.keyStore is just a jks file with a single certificate in it.

I need to answer this question: when setting up the TLS connection, how can I know if am I checking the full certificate chain? Or just the root certificate? Is it just depends on the CA I have in each of my certificates contained in my trust store?

I use RestTemplate to make the connections:

ResponseEntity<T> response = restTemplate.exchange(uri, HttpMethod.PUT, requestEntity, T.class);

My RestTemplate instance has nothing fancy, this is how I build it:

RestTemplate restTemplate = new RestTemplate();

Thanks all.

UPDATE Feb 14 2019

I wanted to clarify something. I am 100% sure my code uses TLS 1.2. If I remove my certs from my key store, then all the calls start to fail complaining with SSL Exceptions.

The certificate chain from the Service I'm calling consists on a leaf certificate and an intermediate certificate. They said they will update only the leaf certificate, and they said this:

"If client systems trust VendorX-issued certificates with the complete chain, then the new Leaf Certificate will need to be updated."

The part that confuses me is "the complete chain". What does that mean? Does it mean that you can either validate a part of the chain or the full chain?

Perimosh
  • 2,304
  • 3
  • 20
  • 38

1 Answers1

-1

check Michal Foksa's answer here. it should be a starting point for you: How to enforce TLS1.2 to Rest client using Rest Template

dskfdskjgds
  • 341
  • 3
  • 14
  • I know already my Rest Template checks certificates, because if I remove my certs from my keystore then the calls are rejected. I will clarify that in my question. – Perimosh Feb 14 '19 at 14:44
  • Although links can be helpful, anwers must be self-contained. Please read: [Your answer is in another castle: when is an answer not an answer?](https://meta.stackexchange.com/questions/225370/your-answer-is-in-another-castle-when-is-an-answer-not-an-answer) – Mark Rotteveel Feb 14 '19 at 15:20