Non-Deterministic Exception When Connecting With Wrong Client Certificate

Question

I am working on an internal application and need to determine the correct client-side SSL certificate to use when connecting to a server (the user can supply multiple client-side certificates). I had expected that if I connected to a server using the wrong client certificate the java client would throw a SSLHandshakeException and I could then try the next certificate. This seems to work some of the time, however the java client will sometimes throw a “SocketException: Software caused connection abort: recv failed”, in which case it is not possible to know that the wrong certificate caused the problem.
Below is the code I have been using to test as well as the intermittent SocketException stack trace. Does anyone have an idea as to how to fix this problem? Thanks in advance.
Note: the TrustAllX509TrustManager is a trust manager that trusts all servers.
protected void connectSsl() throws Exception {
      final String host = "x.x.x.x";
      final int portNumber = 443;
      final int socketTimeout = 10*1000;
      // Note: Wrong certificate (expect SSLHandshakeException).
      final String certFilename = "C:\\xxx\\clientSSL.P12";
      final String certPassword = "certPassword";
      final BufferedInputStream bis = new BufferedInputStream(new FileInputStream(new File(certFilename)));
      final char[] certificatePasswordArray = certPassword.toCharArray();
      final KeyManagerFactory keyManagerFactory = KeyManagerFactory.getInstance("SunX509");
      final KeyStore keyStore = KeyStore.getInstance("PKCS12");
      keyStore.load(bis, certificatePasswordArray);
      keyManagerFactory.init(keyStore, certificatePasswordArray);
      final KeyManager[] keyManagers = keyManagerFactory.getKeyManagers();
      final SSLContext context = SSLContext.getInstance("SSL");
      context.init(keyManagers, new TrustManager[]{new TrustAllX509TrustManager()}, new SecureRandom());
      final SocketFactory secureFactory = context.getSocketFactory();
      final Socket socket = secureFactory.createSocket();
      final InetAddress ip = InetAddress.getByName(host);
      socket.connect(new InetSocketAddress(ip, portNumber), socketTimeout);
      socket.setSoTimeout(socketTimeout);
      // Write the request.
      final OutputStream out = new BufferedOutputStream(socket.getOutputStream());
      out.write("GET / HTTP/1.1\r\n".getBytes());
      out.write("\r\n".getBytes());
      out.flush();
      InputStream inputStream = socket.getInputStream();
      ByteArrayOutputStream outputStream = new ByteArrayOutputStream();
      byte[] byteArray = new byte[1024];
      int bytesRead = 0;
      while ((bytesRead = inputStream.read(byteArray)) != -1) {
         outputStream.write(byteArray, 0, bytesRead);
      socket.close();
      System.out.println("Response:\r\n" + outputStream.toString("UTF-8"));
   }Unexpected SocketException:
main: java.net.SocketException: Software caused connection abort: recv failed
     at java.net.SocketInputStream.socketRead0(Native Method)
     at java.net.SocketInputStream.read(SocketInputStream.java:129)
     at com.sun.net.ssl.internal.ssl.InputRecord.readFully(InputRecord.java:293)
     at com.sun.net.ssl.internal.ssl.InputRecord.read(InputRecord.java:331)
     at com.sun.net.ssl.internal.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:789)
     at com.sun.net.ssl.internal.ssl.SSLSocketImpl.waitForClose(SSLSocketImpl.java:1435)
     at com.sun.net.ssl.internal.ssl.HandshakeOutStream.flush(HandshakeOutStream.java:103)
     at com.sun.net.ssl.internal.ssl.Handshaker.sendChangeCipherSpec(Handshaker.java:612)
     at com.sun.net.ssl.internal.ssl.ClientHandshaker.sendChangeCipherAndFinish(ClientHandshaker.java:808)
     at com.sun.net.ssl.internal.ssl.ClientHandshaker.serverHelloDone(ClientHandshaker.java:734)
     at com.sun.net.ssl.internal.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:197)
     at com.sun.net.ssl.internal.ssl.Handshaker.processLoop(Handshaker.java:516)
     at com.sun.net.ssl.internal.ssl.Handshaker.process_record(Handshaker.java:454)
     at com.sun.net.ssl.internal.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:884)
     at com.sun.net.ssl.internal.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1096)
     at com.sun.net.ssl.internal.ssl.SSLSocketImpl.writeRecord(SSLSocketImpl.java:623)
     at com.sun.net.ssl.internal.ssl.AppOutputStream.write(AppOutputStream.java:59)
     at java.io.BufferedOutputStream.flushBuffer(BufferedOutputStream.java:65)
     at java.io.BufferedOutputStream.flush(BufferedOutputStream.java:123)

Answer 1

Thanks for the quick response. Here are answers to the questions:
1) No, this issue is not associated with one particular certificate. I have tried several certificates and see the same issue.
2) I agree it would be simpler to only send the required certificate, but unfortunately the project requires that the user be able to specify multiple certificates and, if a client-side certificate is required, the application try each one in turn until the correct certificate is found.
3) Yes, I realize the TrustAllX509TrustManager is insecure, but I am using this for testing purposes while trying to diagnose the client certificate problem.
In terms of testing, I am just wrapping the above code in a try/catch block and executing it in a loop. It is quite odd that the same exact code will sometimes generate a SSLHandshakeException and other times a SocketException.
One additional piece of information: if I force the client code to use "SSLv3" using the Socket.setEnabledProtocols(...) method, the problem goes away (I consistently get a SSLHandshakeException). However, I don't think this solves my problem as forcing the application to use SSLv3 would mean it could not handle TLS connections.
The code to specify the SSLv3 protocol is:
SSLSocket sslSocket = (SSLSocket) socket;
sslSocket.setEnabledProtocols(new String[] {"SSLv3"});
One other strange issue: if instead of specifying the SSLv3 protocol using setEnabledProtocols(...) I instead specify the protocol when creating the SSLContext, the SocketException problem comes back. So if I replace:
final SSLContext context = SSLContext.getInstance("SSL");
with:
final SSLContext context = SSLContext.getInstance("SSLv3");
and remove the "sslSocket.setEnabledProtocols(new String[] {"SSLv3"})" line, I see the intermittent SocketException problem.
All very weird. Any thoughts?