Client Code not connecting to WebLogic 8.1 with Mutual Authentication

Question

I am trying to connect to a WebLogic 8.1 web services application. The weblogic instance has mutual authentication enabled, so the client needs to send a certificate when it does an SSL handshake with the server. I am trying to connect with standalone Java JUnit tests. Both the web services and the JUnit tests are using Apache Axis 1.4.0. I've obtained what I believe to be the appropriate certificates from the weblogic administrator that configured the mutual authentication. There is a certificate for the machine I'm trying to connect to, and two other certificates in the chain (three certificates all together, including the root). I've tried several different methods of putting those three certificates in keystores and trust keystores, reading in those keystores in my java code, and connecting to the web services, and I always end up with the same error in the WebLogic server logs. "Certificate chain receved from <ip address> was incomplete."
Here is an example of my code:
I initialize like so:
     Properties tempProperties = // (here is where I obtain my properties from a properties file... code removed for security reasons)
     System.setProperty("javax.net.ssl.trustStore", tempProperties.getProperty("trust.keystore.file"));
     System.setProperty("javax.net.ssl.trustStorePassword", tempProperties.getProperty("trust.keystore.password"));
     System.setProperty("javax.net.ssl.trustStoreType", "jks");
     System.setProperty("javax.net.ssl.keyStore", tempProperties.getProperty("keystore.file"));
     System.setProperty("javax.net.ssl.keyStorePassword", tempProperties.getProperty("keystore.password"));                         System.setProperty("javax.net.ssl.keyStoreType", "jks");
     System.setProperty ( "java.protocol.handler.pkgs", "com.sun.net.ssl.internal.www.protocol" );
     Security.addProvider ( new com.sun.net.ssl.internal.ssl.Provider ( ) );
I bind to the appropriate port and locate the service, etc. using auto-generated methods descendant from Apache Axis. No matter what I try, I get the same results. The client says: main, handling exception: javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure
The server log says: Certificate chain received from <ip address> was incomplete.
I've even tried implementing a custom SSL handler as described here http://alweb.homeip.net/dw0rm/dblog/?p=38, and I can verify by stepping into my code that everything gets initialized and set up correctly, and that all three certificates in the chain that I need are obtained from my keystore, but I still get the same error on the client and the server. I've enabled ssl handshake debugging on my client and I can see the whole certificate chain being output to the debug console.
Any idea what I might be doing wrong?

Answer 1

My guess would be that the server is not able to validate your certificate. Make sure that the CA for your certificate is trusted by WLS.
I always like to debug something like this by add -Djavax.net.debug=ssl to both the client and server. It should give you a complete picture of what is going on.
Edited by: joshbregmanoracle on May 20, 2009 8:49 PM