Using a TLS1.2 client certificate in kSoap2

Question

I'm trying to connect my Android app to a TLS-secured SOAP endpoint using kSoap2 and EasyWSDL, but I'm getting the following exception:

W/System.err: javax.net.ssl.SSLHandshakeException: Connection closed by peer
                  at com.android.org.conscrypt.NativeCrypto.SSL_do_handshake(Native Method)
                  at com.android.org.conscrypt.OpenSSLSocketImpl.startHandshake(OpenSSLSocketImpl.java:351)
                  at com.android.okhttp.internal.io.RealConnection.connectTls(RealConnection.java:192)
                  at com.android.okhttp.internal.io.RealConnection.connectSocket(RealConnection.java:149)
W/System.err:     at com.android.okhttp.internal.io.RealConnection.connect(RealConnection.java:112)
                  at com.android.okhttp.internal.http.StreamAllocation.findConnection(StreamAllocation.java:184)
                  at com.android.okhttp.internal.http.StreamAllocation.findHealthyConnection(StreamAllocation.java:126)
                  at com.android.okhttp.internal.http.StreamAllocation.newStream(StreamAllocation.java:95)
W/System.err:     at com.android.okhttp.internal.http.HttpEngine.connect(HttpEngine.java:281)
                  at com.android.okhttp.internal.http.HttpEngine.sendRequest(HttpEngine.java:224)
                  at com.android.okhttp.internal.huc.HttpURLConnectionImpl.execute(HttpURLConnectionImpl.java:461)
                  at com.android.okhttp.internal.huc.HttpURLConnectionImpl.connect(HttpURLConnectionImpl.java:127)
                  at com.android.okhttp.internal.huc.HttpURLConnectionImpl.getOutputStream(HttpURLConnectionImpl.java:258)
                  at com.android.okhttp.internal.huc.DelegatingHttpsURLConnection.getOutputStream(DelegatingHttpsURLConnection.java:218)
                  at com.android.okhttp.internal.huc.HttpsURLConnectionImpl.getOutputStream(Unknown Source:0)
                  at org.ksoap2.transport.HttpsServiceConnectionSE.openOutputStream(HttpsServiceConnectionSE.java:127)
                  at com.easywsdl.exksoap2.mtom.MTOMTransportImplementation.sendData(MTOMTransportImplementation.java:65)
                  at com.easywsdl.exksoap2.transport.AdvancedHttpsTransportSE.sendData(AdvancedHttpsTransportSE.java:39)
                  at org.ksoap2.transport.HttpTransportSE.call(HttpTransportSE.java:184)
                  at com.easywsdl.exksoap2.transport.AdvancedHttpsTransportSE.call(AdvancedHttpsTransportSE.java:51)

Here is how I'm configuring my Transport:

@Override
    protected Transport createTransport() {
        Transport transport = super.createTransport();
        try {
            if(transport instanceof HttpsTransportSE) {
                HttpsTransportSE httpsTransport = (HttpsTransportSE)transport;
                if(httpsTransport.getServiceConnection() instanceof HttpsServiceConnectionSE) {
                    HttpsServiceConnectionSE httpsServiceConnection = (HttpsServiceConnectionSE)httpsTransport.getServiceConnection();
                    httpsServiceConnection.setSSLSocketFactory(getSSLSocketFactory());
                }
            }
        } catch (IOException e) {
            Log.e(TAG, "Could not add key store", e);
        } catch (NoSuchAlgorithmException e) {
            Log.e(TAG, "Could not add key store", e);
        } catch (KeyStoreException e) {
            Log.e(TAG, "Could not add key store", e);
        } catch (KeyManagementException e) {
            Log.e(TAG, "Could not add key store", e);
        }
        this.transport = transport;
        return transport;
    }

    private SSLSocketFactory getSSLSocketFactory() throws KeyStoreException, NoSuchAlgorithmException, KeyManagementException {
        TrustManagerFactory tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
        tmf.init(keyStore);
        SSLContext context = SSLContext.getInstance("TLS");
        context.init(null, tmf.getTrustManagers(), null);
        return context.getSocketFactory();
    }

I'm not sure how to troubleshoot this or if I'm using the keystore right. Please help.

Johnnyjohnnycake

Why you don't include CA during socket creation? Does Server require CA? – Cassel

And did you try using Android local Keystore with CA? As mentioned here #12346868 – Cassel

Answer 1

The solution was to configure the key manager too:

val keystore = KeyStore.getInstance("BKS")                                                  
keystore.load(assets.open("keystore.bks"), password)

// Create key manager
val keyManagerFactory = 
KeyManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm())                                 
keyManagerFactory.init(keystore, password)
val keyManagers = keyManagerFactory.keyManagers

// Create trust manager
val trustManagerFactory = 
TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm())                                                   
trustManagerFactory.init(keystore)
val trustManagers = trustManagerFactory.trustManagers

SSLContext context = SSLContext.getInstance("TLSv1.2");
context.init(this.keyManagers, this.trustManagers, null);
return context.getSocketFactory();

Johnnyjohnnycake