Trusted ca keystore

Question

Using WebLogic Portal 7.0 on Solaris 8. I have installed the
Portal Login Framework per the instructions for mutual
authentication. One of the steps says that if using Portal 7.0
to add the trusted ca root certificates to the keystore as
described in http://e-docs.bea.com/wls/docs70/upgrade/upgrade6xto70.html#1041313
under
Creating a Trusted CA Keystore. I followed the instructions
there and added the -Dweblogic.security.SSL.trustedCAKeyStore=/home/bea7/weblogic700/server/lib/cacerts
line to the startup line. However, when I
start the portal it says it is using the JDK keystore to find
trusted CA's. Is there something else I need to configure for
the server to look for trusted CA's someplace other than the
default JDK keystore?
Thanks,
Curt

Answer 1

Hi there,
Actually I'm having the same problem, and I have followed your recommendations, but still no client certificates are sent to the server.
I have recieved a client certificate that works fine in the browser. I have exported this sertificate from Internet Explorer into a X509 (.cer) file and then impoted it into the keystore using keytool. I can even see it by using the following code:
for (Enumeration e = keyStore.aliases() ; e.hasMoreElements() ;) {
String alias = e.nextElement().toString();
System.out.println("CERTIFICATE: " + alias);
System.out.println(ks.getCertificate(alias));
Howerver the server returns 403.7 code (client certificate required). I even tried the following code to see if any client certificates are sent to the server, after establishing the connection using connect() method:
java.security.cert.Certificate[] localCerts = ((HttpsURLConnection)con).getLocalCertificates();
if (localCerts != null)
for (int i=0; i<localCerts.length; i++)
System.out.println("LOCAL CERTIFICATE: " + localCerts.toString());
else
System.out.println("NO LOCAL CERTIFICATES SENT");
And as you guess I always get "no local certificates sent".
By the way, do you have to use -genkey before importing the cerificates into the keystore? It seems that importing generates the keys and there is no need to generate the key explicitly.
Thank you for your help.