Home/ Questions/Q 7790355
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-06-01T21:33:31+00:00

I am trying to write a simple application to understand the basics of configuring

  • 0

I am trying to write a simple application to understand the basics of configuring authentication based on client and server certificates.

I have done everything as it is explained in jave ee 5, java ee 6 tutorials
http://docs.oracle.com/javaee/6/tutorial/doc/glien.html

  1. Opened example from javaee tutorials hello basicauthorization (just simple servlet which can be accessed only after authentication) and then reconfigured it for client certificates instead of basic authorizations
  2. Configured web.xml
  3. Configured glassfish-web.xml
  4. Generated client certificate
  5. Imported client certificate so that the server would trust it.

The problem:

When I deploy my application, and follow the link, corresponding to the application, I get a message from glassfish server HTTP Status 400 – No client certificate chain in this request”.

So, it seems, that the client (browser) doesn’t send the certificate with the request

I tried adding the .cer certificate to Chrome, firefox, internet explorer and they are added (no error is displayed), but as you see that doesn’t help.

So, the question is:

How to get the access to my application through the web browser having client .cer certificate?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    You can debug ssl on the server-side by adding (somewhere in Glassfish) system properties:

    -Djavax.net.debug=all

    see this page for details.

    You can also debug from the client perspective using openssl tool:

    openssl s_client -connect host:port -debug -msg

    you should see something like this:

    ...
Acceptable client certificate CA names
/C=PL/O=company/OU=xx/CN=host/emailAddress=email@example.com
/C=PL/O=company/OU=xx/CN=ca/emailAddress=email@example.com
---
SSL handshake has read 2536 bytes and written 116 bytes
...

    your problem is probably related to bad truststore configuration on the server-side – server sends some Acceptable client certificate CA names (or no at all), but browser doesn’t have anything to offer – it doesn’t have any private key+certificate issued by acceptable ca.

    • 0