Connect to Secure web service with certificate from SAP EP

Question

Hi Experts,
Here is the current situation:
1. Our business requirement is to connect 3rd party RESTful web service which requires secure connection with private client certificate attached
2. I've tested in my Java test application and successfully attached private certificate to HttpsURLConection request to the web service and made a connection. No problem at all.
KeyStore keyStore  = KeyStore.getInstance("PKCS12");
InputStream inputStream = new FileInputStream("privateKeyCert.p12");
keyStore.load(inputStream, "myPassword".toCharArray());
KeyManagerFactory keyManagerFactory = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
keyManagerFactory.init(keyStore, "myPassword".toCharArray());
KeyManager[] kms = keyManagerFactory.getKeyManagers();
SSLContext sslContext = SSLContext.getInstance("SSL");
sslContext.init(kms, null, new SecureRandom());
SSLSocketFactory sockFact = sslContext.getSocketFactory();
URL url = new URL("https://www.thirdpartywebservice.com/testroot/");
HttpsURLConnection conn = (HttpsURLConnection) url.openConnection();
conn.setSSLSocketFactory(sockFact);
conn.setRequestMethod("POST");
conn.setDoOutput(true);
conn.setDoInput(true);
conn.setUseCaches(false);
conn.setDefaultUseCaches (false);
conn.setRequestProperty("Content-Type", "text/xml");
3. Next, I tried to apply my Java application to SAP EP NetWeaver, and found that I have to use SecureConnectionFactory:
https://help.sap.com/saphelp_nw70ehp1/helpdata/en/e2/71c83edf72e16be10000000a114084/content.htm
4. So, I modified my Java code for SAP EP:
KeyStore keyStore  = KeyStore.getInstance("PKCS12");
InputStream inputStream = this.getClass().getClassLoader().getResourceAsStream("privateKeyCert.p12");
keyStore.load(inputStream, "myPassword".toCharArray());
SecureConnectionFactory scFactory = new SecureConnectionFactory(keyStore);
HttpURLConnection conn = scFactory.createURLConnection("https://www.thirdpartywebservice.com/testroot/");
conn.setRequestMethod("POST");
conn.setDoOutput(true);
conn.setDoInput(true);
conn.setUseCaches(false);
conn.setDefaultUseCaches (false);
conn.setRequestProperty("Content-Type", "text/xml");
And I'm facing the following error message:
Exception: java.security.UnrecoverableKeyException: ja
va.security.GeneralSecurityException: Unable to decrypt private key: javax.crypto.BadPaddingException: Invalid PKCS#5 padding length: 253
Could you please help me what this error message means?
Do you think do I need to to do some other configuration to make connection to web service with client certificate?
This is our first approach. Please help...
Thank you in advance.

Answer 1

SunJSSE implement SSL server CertificateRequest in a strict mode, if client failed to find a proper certificate corresponding the server request, it does not guess what's the proper certificate and send to the server. In your case, because there is no intermediate certificate in the client context, so there is no way to make the decision which certificate would be acceptable by server, so client does not send any cert to server. That's why you got a handshaking error.
I guess your client key store does not contains a full certificate path from the client end-entity certificate to the root CA. Please import the full certificate path into the key store.
BTW, these approaches should work, but I found no reason why one does not adopt #1:
1. import the full certification path of client certificate into client key store.
2. as a workaround, configure the server to send a list including the intermediate certificates;
3. as a workaround, you will have to customize the client KeyManager if you don't want to or are not able to configure the server to send a list including the intermediate certificates.