Connection to LDAP with TLS : SSLHandshakeException

Question

Hello,
I am trying without success to make a TLS connection to an OpenLdap directory. It works from ldapsearch but not with java code.
Here is what I have done :
-I added the authority certificate (cacert.pem) in our keystore file (keystore.jks)
keytool -import -trustcacerts -keystore keystore.jks -alias cacert -file demoCA/cacert.pem-I added the server certificate (my_server_crt.pem) in our keystore file (keystore.jks)
keytool -import -trustcacerts -keystore keystore.jks -alias my_server -file my_server_crt.pem-I added the client certificate (certificate) in our keystore file (keystore.jks)
keytool -import -keystore keystore.jks -alias my_client -file certificateThen I connect to the LDAP with the following code :
   //(Defining env)
   //Connection
   LdapContext ctx = new InitialLdapContext(env, null);
   StartTlsResponse tls = (StartTlsResponse) ctx.extendedOperation(new StartTlsRequest());
   tls.negotiate();With the following environment variables defined :
-Djavax.net.ssl.trustStore=keystore.jks -Djavax.net.ssl.trustStorePassword=(our password)Here is what I get when running with SSL traces activated :
(�)
main, WRITE: TLSv1 Handshake, length = 32
waiting for close_notify or alert: state 1
main, READ: TLSv1 Alert, length = 2
main, RECV TLSv1 ALERT:  fatal, handshake_failure
main, called closeSocket()
Exception while waiting for close javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure
main, handling exception: javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure
main, called close()
main, called closeInternal(true)
javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure
        at com.sun.net.ssl.internal.ssl.BaseSSLSocketImpl.a(DashoA6275)
        at com.sun.net.ssl.internal.ssl.BaseSSLSocketImpl.b(DashoA6275)
        at com.sun.net.ssl.internal.ssl.SSLSocketImpl.b(DashoA6275)
        at com.sun.net.ssl.internal.ssl.SSLSocketImpl.a(DashoA6275)
       at com.sun.net.ssl.internal.ssl.SSLSocketImpl.a(DashoA6275)
        at com.sun.net.ssl.internal.ssl.HandshakeOutStream.flush(DashoA6275)
        at com.sun.net.ssl.internal.ssl.SunJSSE_ax.a(DashoA6275)
        at com.sun.net.ssl.internal.ssl.SunJSSE_az.j(DashoA6275)
        at com.sun.net.ssl.internal.ssl.SunJSSE_az.a(DashoA6275)
        at com.sun.net.ssl.internal.ssl.SunJSSE_az.a(DashoA6275)
        at com.sun.net.ssl.internal.ssl.SunJSSE_ax.a(DashoA6275)
        at com.sun.net.ssl.internal.ssl.SSLSocketImpl.a(DashoA6275)
        at com.sun.net.ssl.internal.ssl.SSLSocketImpl.j(DashoA6275)
        at com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(DashoA6275)
        at com.sun.jndi.ldap.ext.StartTlsResponseImpl.startHandshake(StartTlsResponseImpl.java:338)
        at com.sun.jndi.ldap.ext.StartTlsResponseImpl.negotiate(StartTlsResponseImpl.java:202)
        at com.sun.jndi.ldap.ext.StartTlsResponseImpl.negotiate(StartTlsResponseImpl.java:155)
        at test2.StartTls.main(StartTls.java:69)Thank you for your help,
Mikael

Answer 1

For information, this problem was finally solved.
We only need to have:
-in the JKS truststore (javax.net.ssl.trustStore) , the authority certificate ;
-in the JKS keystore (javax.net.ssl.keyStore) , the client certificate. This was not provided in our configuration.
Furthermore, we need to give the property javax.net.ssl.keyStorePassword and not trustStorePassword.