Bad CertificateRequest DN length

Question

Hi All,
I have set up SOAP(2.3.1) SSL in tomcat 4.1.27 with JDK1.3.1. The client authentication (2 way) works fine when the [java_home]\jre\lib\security\cacerts has 10 trusted certs. However, when import upto 200 trusted certs in the cacerts keystore, following excepts occurs:
server side:
Thread-10, WRITE: SSL v3.1 Handshake, length = 2849
Thread-10, READ: SSL v3.1 Alert, length = 2
Thread-10, RECV SSLv3 ALERT: fatal, handshake_failure
cliend side:
main, READ: SSL v3.1 Handshake, length = 16384
main, READ: SSL v3.1 Handshake, length = 2849
main, SEND SSL v3.1 ALERT: fatal, description = handshake_failure
main, WRITE: SSL v3.1 Alert, length = 2
Caught SOAPException (SOAP-ENV:Client): Error opening socket: javax.net.ssl.SSLP
rotocolException: Bad CertificateRequest DN length
[SOAPException: faultCode=SOAP-ENV:Client; msg=Error opening socket: javax.net.s
sl.SSLProtocolException: Bad CertificateRequest DN length; targetException=java.
lang.IllegalArgumentException: Error opening socket: javax.net.ssl.SSLProtocolEx
ception: Bad CertificateRequest DN length]
at org.apache.soap.transport.http.SOAPHTTPConnection.send(SOAPHTTPConnec
tion.java:354)
at org.apache.soap.rpc.Call.invoke(Call.java:248)
at TestSoap.start(TestSoap.java:76)
at TestSoap.main(TestSoap.java:114)
I have tried to use JDK1.4.1 and the problem solve. But, our application already work with JDK1.3.1 in production stage so that upgrading is not possible.
It seems the cacerts has limitation about the number of trusted cert. Anyone know how to solve this with JDK1.3.1?
Thanks a lot.
brgds Peter

Answer 1

one idea is to write your own TrustManager in which you
dont have to load up all 200 certs at once. But rather,when
the client cert chain is presented to you, you some how
would match the chain with your list of trusted CAs (however you
choose to manage it). One way to manage it is to index
the PEMs using their distinguished name and look up based on that.
It's probably about 50-70 lines of codes altogether.
But not sure how you would tell Tomcat to use your trustmanager
though. I think you have to also implement a TrustManagerFactory
and then override JSSE with system property sun.SSL.trustmanager.type