Urgent Help Please : Peer not authenticated

Question

Hello Everyone,
I am using JBoss with Tomcat. I have imported my CER file into the JRE/lib/cacerts file as a trusted certificate. I have a simple client and a simple servlet.
Here is the code.
Client
import java.io.*;
import java.io.FileInputStream;
import java.security.KeyStore;
import java.security.KeyStoreException;
import java.security.NoSuchAlgorithmException;
import javax.net.ssl.*;
public class TestSecureClient
private SSLContext ctx;
private TrustManagerFactory tmf;
private KeyStore ks;
private char[] passphrase = "localhost".toCharArray();
public TestSecureClient()
// System.setProperty("javax.net.ssl.trustStore","C:\\j2sdk1.4.0_01\\jre\\lib\\security\\cacerts");
System.setProperty("javax.net.debug", "ssl");
try
loadKeystore();
catch (Exception e)
e.printStackTrace();
private void loadKeystore()
throws Exception
System.out.println("set up context, keystore and trustManagerFactory");
ctx = SSLContext.getInstance("SSL");
tmf = TrustManagerFactory.getInstance("SunX509");
ks = KeyStore.getInstance("JKS");
System.out.println(
"set context to ssl, tmf to X509 and keystore to JKS");
ks.load(new FileInputStream("C:\\keys\\.keystore"), passphrase);
System.out.println("loading testkeys using passphrase");
tmf.init(ks);
System.out.println("initialise keystore using passphrase");
ctx.init(null, tmf.getTrustManagers(), null);
System.out.println("initialise the key manager");
connect();
private void connect()
throws Exception
SSLSocketFactory factory = ctx.getSocketFactory();
System.out.println("got socket factory, now trying to create socket");
SSLSocket socket = (SSLSocket)factory.createSocket("localhost", 8443);
System.out.println("starting handshake");
socket.addHandshakeCompletedListener(new HandshakeCompletedListener() {
public void handshakeCompleted(HandshakeCompletedEvent event)
System.out.println("Handshake finished!");
System.out.println("\t CipherSuite:" + event.getCipherSuite());
System.out.println("\t SessionId " + event.getSession());
System.out.println(
"\t PeerHost " + event.getSession().getPeerHost());
socket.startHandshake();
System.out.println("SSL Socket Connected");
postToServlet(socket);
private void postToServlet(SSLSocket pSocket)
try
PrintWriter out = new PrintWriter(new BufferedWriter(new OutputStreamWriter(pSocket.getOutputStream())));
out.println(
"GET https://localhost/httpstest/SimpleServlet HTTP/1.1");
out.println();
out.flush();
* Make sure there were no surprises
if (out.checkError())
System.out.println(
"SSLSocketClient: java.io.PrintWriter error");
/* read response */
BufferedReader in = new BufferedReader(new InputStreamReader(pSocket.getInputStream()));
String inputLine;
while ((inputLine = in.readLine()) != null)
System.out.println(inputLine);
in.close();
out.close();
pSocket.close();
catch (Exception e)
System.out.println(e);
public static void main(String[] args)
new TestSecureClient();
Here is my SimpleServlet
import java.io.*;
import java.io.IOException;
import java.io.ObjectInputStream;
import java.io.ObjectOutputStream;
import java.io.PrintWriter;
import java.io.Serializable;
import java.security.*;
import javax.net.ssl.*;
import javax.servlet.ServletException;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;
public class SimpleServlet
          extends HttpServlet
     * Handle the HTTP GET method by building a simple web page.
     *@param request
     *@param response
     *@exception ServletException
     *@exception IOException
     public void doGet( HttpServletRequest request, HttpServletResponse response )
          throws ServletException, IOException
          System.setProperty( "javax.net.ssl.trustStore", "C:\\j2sdk1.4.2_03\\jre\\lib\\security\\cacerts" );
          PrintWriter out;
          String title = "Simple Servlet Output";
          System.setProperty( "javax.net.debug", "ssl" );
          // set content type and other response header fields first
          response.setContentType( "text/html" );
          // then write the data of the response
          out = response.getWriter();
          out.println( "<HTML><HEAD><TITLE>" );
          out.println( title );
          out.println( "</TITLE></HEAD><BODY>" );
          out.println( "<H1>" + title + "</H1>" );
          out.println( "<P>This is output from SimpleServlet." );
          out.println( "</BODY></HTML>" );
          out.close();
When I run my client I get the following output
Working directory is C:\httpstest
java -classpath C:\httpstest TestSecureClientset up context, keystore and trustManagerFactory
set context to ssl, tmf to X509 and keystore to JKS
loading testkeys using passphrase
adding as trusted cert:
Subject: CN=Joyce Stack, OU=Digisoft, O=Digisoft, L=Cork, ST=Cork, C=IE
Issuer: CN=Joyce Stack, OU=Digisoft, O=Digisoft, L=Cork, ST=Cork, C=IE
Algorithm: DSA; Serial number: 0x4020d3da
Valid from Wed Feb 04 11:13:30 GMT 2004 until Tue May 04 11:13:30 GMT 2004
initialise keystore using passphrase
trigger seeding of SecureRandom
done seeding SecureRandom
initialise the key manager
got socket factory, now trying to create socket
starting handshake
%% No cached client session
*** ClientHello, TLSv1
RandomCookie: GMT: 1078739209 bytes = { 61, 63, 239, 146, 243, 227, 70, 130, 242, 150, 202, 206, 5, 23, 7, 105, 12, 35, 16, 133, 45, 22, 144, 68, 228, 239, 35, 15 }
Session ID: {}
Cipher Suites: [SSL_RSA_WITH_RC4_128_MD5, SSL_RSA_WITH_RC4_128_SHA, TLS_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_DSS_WITH_AES_128_CBC_SHA, SSL_RSA_WITH_3DES_EDE_CBC_SHA, SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA, SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA, SSL_RSA_WITH_DES_CBC_SHA, SSL_DHE_RSA_WITH_DES_CBC_SHA, SSL_DHE_DSS_WITH_DES_CBC_SHA, SSL_RSA_EXPORT_WITH_RC4_40_MD5, SSL_RSA_EXPORT_WITH_DES40_CBC_SHA, SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA, SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA]
Compression Methods: { 0 }
main, WRITE: TLSv1 Handshake, length = 73
main, WRITE: SSLv2 client hello message, length = 98
main, READ: TLSv1 Handshake, length = 1180
*** ServerHello, TLSv1
RandomCookie: GMT: 1078739209 bytes = { 145, 80, 195, 109, 127, 182, 76, 181, 210, 119, 119, 44, 187, 165, 173, 75, 3, 93, 72, 45, 14, 90, 168, 94, 147, 39, 208, 212 }
Session ID: {64, 76, 65, 9, 142, 208, 247, 95, 51, 150, 99, 147, 143, 113, 220, 153, 78, 69, 189, 136, 130, 100, 6, 252, 61, 169, 146, 195, 155, 252, 19, 57}
Cipher Suite: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
Compression Method: 0
%% Created: [Session-1, TLS_DHE_DSS_WITH_AES_128_CBC_SHA]
** TLS_DHE_DSS_WITH_AES_128_CBC_SHA
*** Certificate chain
chain [0] = [
Version: V1
Subject: CN=Joyce Stack, OU=Digisoft, O=Digisoft, L=Cork, ST=Cork, C=IE
Signature Algorithm: SHA1withDSA, OID = 1.2.840.10040.4.3
Key: Sun DSA Public Key
Parameters:DSA
     p: fd7f5381 1d751229 52df4a9c 2eece4e7 f611b752 3cef4400 c31e3f80 b6512669
455d4022 51fb593d 8d58fabf c5f5ba30 f6cb9b55 6cd7813b 801d346f f26660b7
6b9950a5 a49f9fe8 047b1022 c24fbba9 d7feb7c6 1bf83b57 e7c6a8a6 150f04fb
83f6d3c5 1ec30235 54135a16 9132f675 f3ae2b61 d72aeff2 2203199d d14801c7
     q: 9760508f 15230bcc b292b982 a2eb840b f0581cf5
     g: f7e1a085 d69b3dde cbbcab5c 36b857b9 7994afbb fa3aea82 f9574c0b 3d078267
5159578e bad4594f e6710710 8180b449 167123e8 4c281613 b7cf0932 8cc8a6e1
3c167a8b 547c8d28 e0a3ae1e 2bb3a675 916ea37f 0bfa2135 62f1fb62 7a01243b
cca4f1be a8519089 a883dfe1 5ae59f06 928b665e 807b5525 64014c3b fecf492a
y:
8195bc0c 910d19d2 56cfa64c 1f3fbcd0 9d4298fd 2edf919f 230e035e 4a11b3f1
6a0a5ca2 ca14752f dec12729 39657256 b074eff3 87e97309 e3cb5ab5 3e975434
113119cd 1c0314d5 a33b893f 80dce9c6 a81dab21 9b3fd4e2 066e3834 f302c091
a04d0701 66e8201c f3d013cf 6011bd54 85c4104c ba3a9514 ccb6d662 f774ca02
Validity: [From: Wed Feb 04 11:13:30 GMT 2004,
               To: Tue May 04 11:13:30 GMT 2004]
Issuer: CN=Joyce Stack, OU=Digisoft, O=Digisoft, L=Cork, ST=Cork, C=IE
SerialNumber: [    4020d3da]
Algorithm: [SHA1withDSA]
Signature:
0000: 30 2E 02 15 00 92 12 A2 F2 12 5A A2 EE 3A 11 8D 0.........Z..:..
0010: 09 7A 68 1A 04 49 AE 73 DE 02 15 00 8A D4 5E 9A .zh..I.s......^.
0020: C6 25 B5 23 BB A4 CB 46 78 8B F3 D8 9C 11 0B D0 .%.#...Fx.......
Found trusted certificate:
Version: V1
Subject: CN=Joyce Stack, OU=Digisoft, O=Digisoft, L=Cork, ST=Cork, C=IE
Signature Algorithm: SHA1withDSA, OID = 1.2.840.10040.4.3
Key: Sun DSA Public Key
Parameters:DSA
     p: fd7f5381 1d751229 52df4a9c 2eece4e7 f611b752 3cef4400 c31e3f80 b6512669
455d4022 51fb593d 8d58fabf c5f5ba30 f6cb9b55 6cd7813b 801d346f f26660b7
6b9950a5 a49f9fe8 047b1022 c24fbba9 d7feb7c6 1bf83b57 e7c6a8a6 150f04fb
83f6d3c5 1ec30235 54135a16 9132f675 f3ae2b61 d72aeff2 2203199d d14801c7
     q: 9760508f 15230bcc b292b982 a2eb840b f0581cf5
     g: f7e1a085 d69b3dde cbbcab5c 36b857b9 7994afbb fa3aea82 f9574c0b 3d078267
5159578e bad4594f e6710710 8180b449 167123e8 4c281613 b7cf0932 8cc8a6e1
3c167a8b 547c8d28 e0a3ae1e 2bb3a675 916ea37f 0bfa2135 62f1fb62 7a01243b
cca4f1be a8519089 a883dfe1 5ae59f06 928b665e 807b5525 64014c3b fecf492a
y:
8195bc0c 910d19d2 56cfa64c 1f3fbcd0 9d4298fd 2edf919f 230e035e 4a11b3f1
6a0a5ca2 ca14752f dec12729 39657256 b074eff3 87e97309 e3cb5ab5 3e975434
113119cd 1c0314d5 a33b893f 80dce9c6 a81dab21 9b3fd4e2 066e3834 f302c091
a04d0701 66e8201c f3d013cf 6011bd54 85c4104c ba3a9514 ccb6d662 f774ca02
Validity: [From: Wed Feb 04 11:13:30 GMT 2004,
               To: Tue May 04 11:13:30 GMT 2004]
Issuer: CN=Joyce Stack, OU=Digisoft, O=Digisoft, L=Cork, ST=Cork, C=IE
SerialNumber: [    4020d3da]
Algorithm: [SHA1withDSA]
Signature:
0000: 30 2E 02 15 00 92 12 A2 F2 12 5A A2 EE 3A 11 8D 0.........Z..:..
0010: 09 7A 68 1A 04 49 AE 73 DE 02 15 00 8A D4 5E 9A .zh..I.s......^.
0020: C6 25 B5 23 BB A4 CB 46 78 8B F3 D8 9C 11 0B D0 .%.#...Fx.......
*** Diffie-Hellman ServerKeyExchange
DH Modulus: { 244, 136, 253, 88, 78, 73, 219, 205, 32, 180, 157, 228, 145, 7, 54, 107, 51, 108, 56, 13, 69, 29, 15, 124, 136, 179, 28, 124, 91, 45, 142, 246, 243, 201, 35, 192, 67, 240, 165, 91, 24, 141, 142, 187, 85, 140, 184, 93, 56, 211, 52, 253, 124, 23, 87, 67, 163, 29, 24, 108, 222, 51, 33, 44, 181, 42, 255, 60, 225, 177, 41, 64, 24, 17, 141, 124, 132, 167, 10, 114, 214, 134, 196, 3, 25, 200, 7, 41, 122, 202, 149, 12, 217, 150, 159, 171, 208, 10, 80, 155, 2, 70, 211, 8, 61, 102, 164, 93, 65, 159, 156, 124, 189, 137, 75, 34, 25, 38, 186, 171, 162, 94, 195, 85, 233, 47, 120, 199 }
DH Base: { 2 }
Server DH Public Key: { 141, 230, 60, 171, 152, 244, 227, 94, 165, 6, 166, 49, 28, 143, 106, 97, 130, 220, 0, 77, 153, 189, 151, 141, 253, 7, 162, 141, 32, 251, 80, 129, 8, 193, 79, 130, 240, 22, 21, 68, 185, 27, 253, 69, 190, 136, 9, 117, 147, 143, 193, 134, 226, 95, 62, 17, 17, 80, 34, 227, 229, 218, 173, 34, 3, 75, 29, 202, 89, 88, 220, 221, 96, 226, 160, 29, 79, 139, 242, 204, 223, 25, 255, 47, 196, 173, 40, 133, 234, 49, 161, 68, 208, 29, 67, 143, 7, 138, 124, 43, 60, 52, 12, 207, 247, 218, 36, 195, 237, 10, 251, 39, 87, 205, 42, 60, 175, 202, 168, 127, 142, 8, 218, 30, 241, 190, 62, 126 }
Anonymous
*** ServerHelloDone
*** ClientDiffieHellmanPublic
DH Public key: { 243, 101, 241, 11, 194, 68, 62, 212, 66, 86, 168, 117, 239, 154, 190, 75, 93, 94, 222, 53, 150, 202, 232, 200, 64, 174, 162, 89, 24, 144, 88, 235, 151, 92, 255, 22, 110, 49, 124, 214, 130, 196, 165, 129, 245, 100, 235, 61, 227, 50, 154, 78, 159, 83, 53, 227, 111, 228, 146, 72, 82, 180, 222, 181, 142, 156, 4, 90, 117, 193, 107, 144, 28, 201, 138, 10, 253, 232, 93, 197, 58, 181, 242, 65, 214, 131, 167, 143, 87, 162, 194, 26, 169, 116, 228, 142, 19, 217, 58, 38, 24, 225, 78, 139, 32, 6, 218, 128, 182, 242, 162, 237, 241, 231, 198, 87, 204, 253, 190, 153, 63, 198, 102, 18, 62, 190, 60, 133 }
main, WRITE: TLSv1 Handshake, length = 134
SESSION KEYGEN:
PreMaster Secret:
0000: 1B 0D FB 74 3D E0 23 74 BB 83 02 BD BF 14 E4 43 ...t=.#t.......C
0010: 8D F7 1D 44 10 46 31 C4 BD BB 46 65 FD 97 BD 71 ...D.F1...Fe...q
0020: 64 79 05 0D 44 B3 37 91 A6 11 77 B5 5E 02 79 A9 dy..D.7...w.^.y.
0030: 7A 35 1D 4A E6 BF 9F 99 BD D9 2F B1 B0 B8 CB FC z5.J....../.....
0040: 26 82 AA 93 EC 9A F7 B7 9A 67 A6 8F C7 60 68 96 &........g...`h.
0050: 0B 5A C9 A4 B0 6B 95 50 56 82 54 CC C9 04 C4 03 .Z...k.PV.T.....
0060: B3 E0 93 BB 60 B6 84 36 0F 3A 5E 27 23 B3 53 63 ....`..6.:^'#.Sc
0070: E8 EC 41 5F 18 83 FD E6 BD 73 51 22 16 D5 93 6B ..A_.....sQ"...k
CONNECTION KEYGEN:
Client Nonce:
0000: 40 4C 41 09 3D 3F EF 92 F3 E3 46 82 F2 96 CA CE @LA.=?....F.....
0010: 05 17 07 69 0C 23 10 85 2D 16 90 44 E4 EF 23 0F ...i.#..-..D..#.
Server Nonce:
0000: 40 4C 41 09 91 50 C3 6D 7F B6 4C B5 D2 77 77 2C @LA..P.m..L..ww,
0010: BB A5 AD 4B 03 5D 48 2D 0E 5A A8 5E 93 27 D0 D4 ...K.]H-.Z.^.'..
Master Secret:
0000: 7D A1 14 9A 48 7C ED 98 CF 3F D8 92 3C EE E5 05 ....H....?..<...
0010: 05 BF 1A 8D 10 68 DC E2 A4 88 CF A4 AC FF 1D E2 .....h..........
0020: E0 D4 FC F8 CB BA B8 7C B0 38 B2 BE 31 82 24 BC .........8..1.$.
Client MAC write Secret:
0000: CB 03 D5 D7 1C C2 85 4C 5A 26 0D 24 82 B9 4D 81 .......LZ&.$..M.
0010: D9 3B E6 86 .;..
Server MAC write Secret:
0000: 42 9B 99 CB 1E B9 6C 1C 24 EC C1 15 9B 9A 44 5B B.....l.$.....D[
0010: DD 69 D9 7D .i..
Client write key:
0000: 98 43 93 ED 3D 19 30 BA CF 49 07 60 44 6C EA 53 .C..=.0..I.`Dl.S
Server write key:
0000: C3 29 D5 46 BF 83 D9 C6 DD 87 8F A1 CB 0C 63 EA .).F..........c.
Client write IV:
0000: B5 8F 11 7C 52 44 A1 BD 6C 52 30 6F B2 E4 44 98 ....RD..lR0o..D.
Server write IV:
0000: A8 9D A4 EB 18 F1 72 3A A0 F7 ED DB 0B 24 1A 3D ......r:.....$.=
main, WRITE: TLSv1 Change Cipher Spec, length = 1
JsseJce: Using cipher AES/CBC/NoPadding from provider SunJCE
*** Finished
verify_data: { 214, 56, 105, 255, 211, 177, 74, 194, 123, 99, 106, 59 }
main, WRITE: TLSv1 Handshake, length = 48
main, READ: TLSv1 Change Cipher Spec, length = 1
JsseJce: Using cipher AES/CBC/NoPadding from provider SunJCE
main, READ: TLSv1 Handshake, length = 48
*** Finished
verify_data: { 118, 147, 184, 159, 16, 28, 169, 25, 218, 82, 145, 10 }
%% Cached client session: [Session-1, TLS_DHE_DSS_WITH_AES_128_CBC_SHA]
SSL Socket Connected
main, WRITE: TLSv1 Application Data, length = 80
Handshake finished!
     CipherSuite:TLS_DHE_DSS_WITH_AES_128_CBC_SHA
     SessionId [Session-1, TLS_DHE_DSS_WITH_AES_128_CBC_SHA]
     PeerHost localhost
main, READ: TLSv1 Application Data, length = 160
HTTP/1.1 200 OK
Content-Type: text/html
Content-Length: 154
Date: Mon, 08 Mar 2004 09:46:51 GMT
Server: Apache Coyote/1.0
main, READ: TLSv1 Application Data, length = 176
<HTML><HEAD><TITLE>
Simple Servlet Output
</TITLE></HEAD><BODY>
<H1>Simple Servlet Output</H1>
<P>This is output from SimpleServlet.
</BODY></HTML>
main, READ: TLSv1 Alert, length = 32
main, RECV TLSv1 ALERT: warning, close_notify
main, called closeInternal(false)
main, SEND TLSv1 ALERT: warning, description = close_notify
main, WRITE: TLSv1 Alert, length = 32
main, called close()
main, called closeInternal(true)
main, called close()
main, called closeInternal(true)
main, called close()
main, called closeInternal(true)
Process java exited with code 0
Working directory is C:\httpstest
My JBoss has the following error
09:46:51,171 DEBUG [JSSE14Support] Error getting client certs
javax.net.ssl.SSLPeerUnverifiedException: peer not authenticated
at com.sun.net.ssl.internal.ssl.SSLSessionImpl.getPeerCertificates(DashoA6275)
at org.apache.tomcat.util.net.jsse.JSSE14Support.getX509Certificates(JSSE14Support.java:151)
at org.apache.tomcat.util.net.jsse.JSSESupport.getPeerCertificateChain(JSSESupport.java:161)
at org.apache.coyote.http11.Http11Processor.action(Http11Processor.java:748)
at org.apache.coyote.Response.action(Response.java:222)
at org.apache.coyote.tomcat4.CoyoteAdapter.postParseRequest(CoyoteAdapter.java:321)
at org.apache.coyote.tomcat4.CoyoteAdapter.service(CoyoteAdapter.java:221)
at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java:601)
at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.processConnection(Http11Protocol.java:392)
at org.apache.tomcat.util.net.TcpWorkerThread.runIt(PoolTcpEndpoint.java:565)
at org.apache.tomcat.util.threads.ThreadPool$ControlRunnable.run(ThreadPool.java:619)
at java.lang.Thread.run(Thread.java:534)
Can someone please help me. What do I do now ? What am I suppose to be doing...???
Cheers,
Joyce

Answer 1

Just in case someone else needs this. I was using JBoss 3.2.2 and I upgraded to JBoss 3.2.3. I think this was a bug in the Tomcat bundle.