使用.cer而不是.p12对android上的服务器进行身份验证

Question

for my current project we use a certificate authentification on our server. Till now we used PKCS12 to realise that and it was working fine. Because we integrated a PKCS11 security card now i can only get the certificate as a standard .cer. So far so good i can create a keystore and SSLcontext fine but for some reason the server doesn't recognize that im trying to use a certificate if i do it with a .cer. Maybe you guys can find a reason.

Working code:

SSLContext ctx = SSLContext.getInstance("TLS");
KeyStore keystore = KeyStore.getInstance("PKCS12");
keystore.load(new FileInputStream(new File("/data/local/tmp/admin.p12")), certpw.toCharArray());
KeyManagerFactory keyManagerFactory = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
keyManagerFactory.init(keystore, certpw.toCharArray());
ctx.init(keyManagerFactory.getKeyManagers(),
                    new TrustManager[] { new X509TrustManager() {
                        @Override
                        public X509Certificate[] getAcceptedIssuers() {
                            return new X509Certificate[] {};
                        }

                        @Override
                        public void checkClientTrusted(
                                final X509Certificate[] arg0,
                                final String arg1)
                                throws CertificateException {

                        }

                        @Override
                        public void checkServerTrusted(
                                final X509Certificate[] arg0,
                                final String arg1)
                                throws CertificateException {

                        }
                    } }, new SecureRandom());

And here the not working code with a .cer:

SSLContext ctx = SSLContext.getInstance("TLS");
InputStream is = new FileInputStream("/data/local/tmp/admin.cer");
CertificateFactory cf = CertificateFactory.getInstance("X.509");
Certificate caCert = (Certificate)cf.generateCertificate(is);

KeyStore ks = KeyStore.getInstance(KeyStore.getDefaultType());
ks.load(null, certpw.toCharArray());
ks.setCertificateEntry("caCert", caCert);

KeyManagerFactory keyManagerFactory = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
keyManagerFactory.init(ks, certpw.toCharArray());

ctx.init(keyManagerFactory.getKeyManagers(),
                    new TrustManager[] { new X509TrustManager() {

                        @Override
                        public X509Certificate[] getAcceptedIssuers() {
                            return new X509Certificate[] {};
                        }

                        @Override
                        public void checkClientTrusted(
                                final X509Certificate[] arg0,
                                final String arg1)
                                throws CertificateException {

                        }

                        @Override
                        public void checkServerTrusted(
                                final X509Certificate[] arg0,
                                final String arg1)
                                throws CertificateException {

                        }
                    } }, new SecureRandom());

Basicly the only thing, that changed is that i create an empty keystore now and add the certificate manually.

EDIT: I get the .cer via JNI using a .so lib provided by the card manufactor. It contains an implementation of the PKCS#11 API. I could get the private and public key from the card together with the certificate but don't know how i would use those to make a KeysStore.

Answer 1

You need the private key. With .p12 file you had it and it was used to establish SSL connection to the server.

When you moved from .p12 to smartcard you made a big change. I don't know if it will be possible to make KeyStore work with smartcard through a PKCS#11 interface or if a PKCS#11 interface is even available on android (I am not an android developer).

Try to do some research if it could be done. The questions you should be asking yourself (or google):

• Is PKCS#11 interface available on android?
• Does your vendor supply the card with a PKCS#11 library for android?
• Can KeyStore use a PKCS#11 library?