java中的Http调用不发送客户端证书

Question

I'm using the Apache HTTP client (version 4.5.13 ) in Java 8 to perform a POST call that requires the client to authenticate using a certificate certificate, that I have stored in a .PFX file.

This is the code I'm using:

public static void performClientRequest() throws Exception {
    //Trust Strategy to accept any server certificate
    TrustStrategy trustStrategy = new TrustStrategy() {
        public boolean isTrusted(X509Certificate[] chain, String authType)
                throws CertificateException {
            return true;
        }
    };
    
    //Load PFX client certificate
    KeyStore clientStore  = KeyStore.getInstance("PKCS12"); 
    InputStream instream = new FileInputStream("C:\\client.pfx");
    try {
        clientStore.load(instream, null);
    } finally {
        instream.close();
    }

    //Create ssl context with key store and trust strategy 
    SSLContext sslContext = SSLContexts.custom()
            .loadKeyMaterial(clientStore, null)
            .loadTrustMaterial(trustStrategy)
            .build();
    
    //Create ssl socket factory from context
    SSLConnectionSocketFactory sslSocketFactory = new SSLConnectionSocketFactory(sslContext, NoopHostnameVerifier.INSTANCE);
    
    //Create HTTP client
    HttpClient httpClient = HttpClients.custom()
            .setSSLSocketFactory(sslSocketFactory)
            .build();
    
    //Perform call
    URI url = new URI("https://mysite.foo"); 
    HttpPost request = new HttpPost(url);
    
    request.setHeader("Content-Type","application/json"); 
    request.setHeader("Accept", "application/json");
    
    String body = "...";
    StringEntity bodyEntity = new StringEntity(body);
    request.setEntity(bodyEntity);
            
    HttpResponse response = httpClient.execute(request);
    HttpEntity entity = response.getEntity();

    System.out.println("----------------------------------------");
    System.out.println(response.getStatusLine());
    EntityUtils.consume(entity);
}

I've used this code in in the past and it worked perfectly back then, but now I'm trying to reuse it and it just doesn't send the certificate, the server replies with:

HTTP/1.1 403 No client certificate supplied

How can I debug this and discover why the certificate is not being sent?

Note : I implemented a similar call both in C# and using Postman , and in both cases it works perfectly, so the client certificate authentication to the server is working, it's just not working in my Java implementation.

Answer 1

So, I don't know if this is a bug or intended behavior (if so, why?), but apparently the PFX file must be password-protected, then it gets sent correctly. I could not make this work with a non-protected PFX file and passing null as the password like I was doing in the code I posted in the question.

So the problem is solved, but I would be curious if anyone could comment on WHY this happens.