glassfish SSLHandshakeException: Received fatal alert: unknown_ca

Question

I have to call a SOAP web service having client authentication over HTTPS.

I have imported the client certificate (got from company hosting the server) into by keyStore file. I also imported server certificate (downloaded from server) into my trustStore. I have set 'javax.net.ssl.keyStore' and 'javax.net.ssl.keyStorePassword' to the appropriate values.

When I call the web-service from a simple java client (including just some additional jars), the call works and I get a result from the server.

When I call the web-service from within glassfish-4 (same java, same keyStore, same trustStore, same 'javax.net.ssl.keyStore' value etc), I get an exception 'com.sun.xml.ws.client.ClientTransportException: HTTP transport error: javax.net.ssl.SSLHandshakeException: Received fatal alert: unknown_ca'.

I use the same java, same keystore, same trustStore in both cases. The first version without glassfish works, so the certificates seems to be ok. The second version with glassfish does not.

Does glassfish-4 do anything specific? Can it be a problem of other (third party) libraries? Are there any additional HTTP/SSL settings that I can try out? What else can it be?

Anybody an idea? Thanks for help.

Answer 1

I have found the problem.

Glassfish needs the additional VM property 'com.sun.enterprise.security.httpsOutboundKeyAlias'. This has to be set to the alias of the client certificate.

For standard this is set in domain.xml in the java-config area. For standard this is set as -Dcom.sun.enterprise.security.httpsOutboundKeyAlias=s1as.

Change the value s1as to the alias of the certificate.