SSL client (Java) is not sending a certificate back to the server in two-way SSL handshake

Question

We are trying to access a restful web service resource hosted on IIS server with https protocol.

When we disable TWO WAY SSL Auth (server side validation of client certificate disabled) everything works fine.

When the IIS imposes TWO WAY SSL (server side validation of client certificate enabled) we are getting the below exception:

403 - Forbidden: Access is denied.

You do not have permission to view this directory or page using the credentials that you supplied. We are using java 1.8 update 102, IIS server 7.5 and TLS 1.2 for ssl

For detailed issue please open the below link:

For details SSL Debug log, certificates, client program

It will be great help if someone help us.

Thanks!

Answer 1

See this warning in the SSL log:

no suitable certificate found - continuing without client authentication

Your server is sending a list of accepted CAs to request a client certificate, but your client does not find a suitable one. It seems your keystore has the correct certificate. Ensure that your certificate is correct, for example installing it in the browser and navigating to a protected resource

May be it is a configuration issue of your Java client. Please read HttpClientBuilder documentation carefully

System properties will be taken into account when configuring the default implementations when useSystemProperties() method is called prior to calling build().

You did not call useSystemProperties() .

See also this bug report that might affect you https://issues.apache.org/jira/plugins/servlet/mobile#issue/HTTPCLIENT-1477