Last attempt at SSL/TLS

Question

I have been trying to get openSSL/JSSE from Cpp to Java working for weeks. If I can't find a solution I am just going to disregard the whole idea. No matter what I seem to do I keep getting a "sslv3 alert certificate unknown" error. I have a self signed key that works fine on the server en of things but I get the error when connecting to OpenSSL's s_server utility. I have been looking for a solution for weeks. Help would be appreciated! I have a self-signed crt file and a server.key file. I put the cert in the java keystore but I still get the error

Answer 1

Your self signed certificate is probably what is causing your problem.

This site has basic dirty instructions on creating a CA and this site has similar instructions but is a little more verbose.

Here's the way you need to have this play out:

1. Create your CA
2. Create your certificate for the server
3. Create two keystores,
   • Server keystore containing the server private key, server public certificate (signed by the CA), and the CA certificate.
   • Client keystore containing only the CA certificate.

This site gives you the system properties needed to configure the java engine to use the keystores as well key stores and trust stores. The trust store will be needed on both ends to allow correct verification of the certificates in question.

As far as the s_client utility, you will have to use the -CApath option to point to the directory containing the CA Certificates you trust or -CAfile to point to your self signed CA as trusted.

Just comment back if you need more help. This is frustrating but once you get the basics down you'll be a pro in no time.