Need Help with solving SSL mutual authentication

Are the client and server using http(s) to communicate with one another?  If not, can you post the client code and the server code? Have you gotten the client and server to work without SSLSockets?

Both Servlet client and server are involved in SSL mutual authentication

Servlet Client code:

import java.io.InputStream;

import java.io.IOException;

import java.io.DataInputStream;

import java.io.FileInputStream;
import java.security.KeyStore;
import javax.net.ssl.SSLContext;
import javax.net.ssl.TrustManagerFactory;
import javax.net.ssl.KeyManagerFactory;
import javax.net.ssl.SSLSocket;
import javax.net.ssl.SSLSession;
import javax.net.ssl.SSLSocketFactory;
import javax.servlet.ServletConfig;
import javax.servlet.ServletException;
import javax.servlet.ServletOutputStream;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

public class SSLSecretNumberServletWithServerAndClientAuth

   extends HttpServlet

{

   private String server;

   private int port;


   public void init(ServletConfig config)

      throws ServletException

   {

      super.init(config);



      try

      {

         port = (new Integer(getInitParameter("port"))).

            intValue();

      }

      catch (NumberFormatException nfe)

      {

         log("port must be a parsable integer");

         throw new ServletException(nfe.getMessage());

      }



      String server = getInitParameter("server");

   }



   /**

    * Opens a secure socket connection with the external

    * server, retrieves the secret number generated from

    * the external server, and communicates it to the

    * client. This method is executed each time a client

    * invokes the servlet.

    *

    * @param request an HttpServletRequest object

    *        containing information about the client's

    *        request.

    * @param response an HttpServletResponse object in

    *        which the servlet stores information to be

    *        sent to the client.

    * @throws ServletException if an exception occurs that

    *         interferes with the servlet's normal

    *         operation.

    * @throws IOException if an I/O exception occurs.

    */

   public void service(HttpServletRequest request,

      HttpServletResponse response)

      throws ServletException, IOException

   {

      log("Requesting connection from " + server +

         " on port " + port + "...");



      // The truststore and keystore passwords are

      // both hardcoded

      char[] passwd = "xyz123".toCharArray();

      char[] passwd2 = "client123".toCharArray();



      SSLSocket s = null;



      try

      {

         // Create an SSLContext instance implementing

         // the TLS protocol.

         SSLContext ctx = SSLContext.getInstance("TLS");

         // Create a TrustManagerFactory implementing the

         // X.509 key management algorithm.

         TrustManagerFactory tmf =

            TrustManagerFactory.getInstance("IbmX509");



         // Create a KeyStore instance implementing the

         // Java KeyStore (JKS) algorithm.

         KeyStore ks = KeyStore.getInstance("JKS");



         // Load the KeyStore file keyStoreFile.

         ks.load(new

            FileInputStream("trustStoreFile"), passwd);



         // Initialize the TrustManagerFactory object with

         // the KeyStore.

         tmf.init(ks);



         // Since the server requires client authentication

         // the client must present its own certificate to

         // the server.



         // Create a KeyManagerFactory implementing the

         // X.509 key management algorithm.

         KeyManagerFactory kmf =

            KeyManagerFactory.getInstance("IbmX509");



         // Create a KeyStore instance implementing the

         // Java KeyStore (JKS) algorithm.

         KeyStore ks2 = KeyStore.getInstance("JKS");



         //  Load the KeyStore file keyClientStore

         ks2.load(new FileInputStream("keyClientStore"),

            passwd2);



         // Initialize the KeyManagerFactory object with

         // the KeyStore.

         kmf.init(ks2, passwd2);



         // Initialize the SSLContext with the

         // KeyManagerFactory and TrustManagerFactory.

         ctx.init(kmf.getKeyManagers(),

            tmf.getTrustManagers(), null);



         // Create an SSLSocketFactory instance from the

         // SSLContext and generate an SSLSocket from it.

         SSLSocketFactory sslFact = ctx.getSocketFactory();

         s = (SSLSocket) sslFact.createSocket

            (server, port);

      }

      catch (Exception e)

      {

         // Catch any Exception and turn it into a

         // ServletException

         throw new ServletException(e.getMessage());

      }



      SSLSession session = s.getSession();

      log("Connected to server " + server + "\nCipher suite:"

         + session.getCipherSuite());



      // Get the secret number from the external server.

      InputStream in = s.getInputStream();

      DataInputStream dis = new DataInputStream(in);

      int secretNumber = dis.readInt();



      // Send the response to the client in HTML format.

      ServletOutputStream out = response.getOutputStream();

      response.setContentType("text/html");

      out.println("<HTML><HEAD><TITLE>" +

         "Secret Number Page</TITLE></HEAD></HTML>");

      out.println("<BODY><H1>Secret Number: " +

         secretNumber + "</H1></BODY>");

      out.println("</HTML>");

      dis.close();

      in.close();

      s.close();

   }

}


Server code:

import java.io.OutputStream;

import java.io.IOException;

import java.io.DataOutputStream;

import java.io.FileInputStream;



import java.util.Random;



import javax.net.ssl.SSLSocket;

import javax.net.ssl.SSLSession;

import javax.net.ssl.SSLServerSocket;

import javax.net.ssl.SSLServerSocketFactory;

import javax.net.ssl.SSLContext;

import javax.net.ssl.KeyManagerFactory;

import javax.net.ssl.TrustManagerFactory;



import java.security.KeyStore;



/**

 * Server class for random number generation. This server

 * runs as a process that external client applications can

 * contact by opening an appropriate socket. Every time a

 * client contacts the server application, a new Thread is

 * generated. The server application produces a new random

 * number, communicates it to the client, and closes the

 * connection with the client. The communication between

 * the server and client is protected by SSL. This server

 * supports server authentication and requires client

 * authentication.

 */

public class SSLServerWithServerAndClientAuth extends Thread

{

   private SSLSocket client;

   private static Random randomGenerator = new Random();



   /**

    * Public constructor. Initializes the server by setting

    * the Socket to communicate with the client.

    *

    * @param client an SSLSocket object representing the

    *       client application this server is

    *       communicating with.

    */

   public SSLServerWithServerAndClientAuth(SSLSocket c)

   {

      this.client = c;

   }



   /**

    * Generates a random number and communicates it to the

    * the client. The communication is protected by SSL.

    */

   public void run()

   {

      int secretNumber = randomGenerator.nextInt();

      System.out.println("Secret Number:" + secretNumber);



      try

      {

         OutputStream out = client.getOutputStream();

         DataOutputStream dos = new DataOutputStream(out);

         dos.writeInt(secretNumber);

         dos.flush();

         dos.close();

         out.close();

         client.close();

      }

      catch (IOException e)

      {

         System.out.println(e);

      }

   }

   /**

    * Launches the server application. This method expects

    * the port number to be passed on the command line.

    *

    * @param args a String[] array whose first element

    *       must represent the port number this server

    *       will be listening on. The port number is

    *       expected to be an integer between 1025 and

    *       65536. Values not in this range will cause the

    *       application to quit.

    */

   public static void main(String args[])

   {

      if (args.length == 0)

      {

         System.out.println("Usage: java Server <port>");

         System.exit(0);

      }



      int port = 0;



      try

      {

         port = (new Integer(args[0])).intValue();

      }

      catch (NumberFormatException nfe)

      {

         System.out.println("Usage: java Server <port>");

         System.out.println

            ("<port> must be a parsable integer");

         System.exit(0);

      }



      if (port <= 1024 || port > 65536)

      {

         System.out.println("Usage: java Server <port>");

         System.out.println

            ("<port> must be an integer in the range " +

            "1025-65536");

         System.exit(0);

      }



      // The keystore and truststore passwords are

      // both hardcoded

      char[] passwd = "abc123".toCharArray();

      char[] passwd2 = "trust123".toCharArray();



      SSLContext ctx = null;



      try

      {

         // Create an SSLContext instance implementing

         // the TLS protocol.

         ctx = SSLContext.getInstance("TLS");



         // Create a KeyManagerFactory implementing the

         // X.509 key management algorithm.

         KeyManagerFactory kmf =

            KeyManagerFactory.getInstance("IbmX509");



         // Open up the KeyStore in order to present the

         // Server's certificates to the client

         KeyStore ks = KeyStore.getInstance("JKS");



         // Load the KeyStore file keyStoreFile

         ks.load (new FileInputStream("keyStoreFile"),

            passwd);



         // Initialize the KeyManagerFactory object with

         // the KeyStore.

         kmf.init(ks, passwd);



         // Create a TrustManagerFactory implementing the

         // X.509 key management algorithm.

         TrustManagerFactory tmf =

            TrustManagerFactory.getInstance("IbmX509");



         // Since client authentication will be requested,

         // the server must be able to trust the client.

         KeyStore ts = KeyStore.getInstance("JKS");

         ts.load (new FileInputStream("trustServerStore"),

            passwd2);



         // Initialize the TrustManagerFactory object with

         // the TrustStore

         tmf.init(ts);

         // Initialize the SSLContext with the

         // KeyManagerFactory and TrustManagerFactory

         ctx.init(kmf.getKeyManagers(),

            tmf.getTrustManagers(), null);



      }

      catch (Exception e)

      {

         System.out.println

            ("Unable to initialize SSLContext " +

            e.getMessage());

         System.exit(0);

      }



      System.out.println("Server starting...");



      // Create an SSLServerSocketFactory instance from the

      // SSLContext and generate an SSLServerSocket from it.



      SSLServerSocketFactory sslSrvFact =

         ctx.getServerSocketFactory();

      SSLServerSocket ss = null;



      // Try to start the server. At this point, problems

      // may arise if another process is already listening

      // on the selected port.

      try

      {

         ss = (SSLServerSocket)

            sslSrvFact.createServerSocket(port);



         // Require client authentication

         ss.setNeedClientAuth(true);

      }

      catch (IOException ioe)

      {

         System.out.println

            ("There is already a server running on port "

            + port + "\n" + ioe);

         System.exit(0);

      }



      System.out.println("Server started on port " + port);

      System.out.println("Waiting for clients...");



      // Start an endless loop in which the server is

      // constantly waiting for clients to connect.

      while (true)

      {

         SSLSocket client = null;



         try

         {

            client = (SSLSocket)ss.accept();

            SSLSession session = client.getSession();

            System.out.println("Connected.  Cipher Suite: " +

               session.getCipherSuite());

         }

         catch (IOException ioe)

         {

            System.out.println("Unable to accept " +

               "connection from client\n" + ioe);

            System.exit(0);

         }



         System.out.println

            ("Request from client received...");

         SSLServerWithServerAndClientAuth server =

            new SSLServerWithServerAndClientAuth(client);

         server.start();

      }

   }

}

Okay first things first, does it work without the SSL?

I didnt get your point. The error says that client (SERVLET) is connecting to server but Handshaking  failed .

thanks,
ravi

Well can you make your program run without using SSL encryption.. just use a regular socket.  Once you get a normal socket working then we can start adding the SSL stuff one at a time.  I just want to make sure that the program runs properly without SSL first.

After you verify the proggie works sans SSL, I would next implement the "standard" SSL protocol (instead of TLS and the IBM/JKS stuff).  You should only need keytool to get this done..

Just out of curiosity, why aren't you using regular https and using a java httpclient as the client and a servlet as the server?

Hi it worked for me.. finally!!! The SSL mutual authentication works as desired.

thanks

What did you change?

Nothing it is the problem with the certificates. The problem that i was getting before is due to client not trusting the CA that signed server cert.

That'll definitely do it.. glad everything is working