Warning: no suitable certificate found - continuing without client authentication

Question

Team I am facing following issue when try to complete a mutual handshake using HTTPS

main, READ: TLSv1.2 Handshake, length = 30
*** CertificateRequest
Cert Types: RSA, DSS, ECDSA
Supported Signature Algorithms: SHA1withRSA, SHA1withDSA, SHA1withECDSA, SHA256withRSA, Unknown (hash:0x4, signature:0x2), SHA256withECDSA, SHA384withRSA, Unknown (hash:0x5, signature:0x2), SHA384withECDSA
Cert Authorities:
<Empty>
main, READ: TLSv1.2 Handshake, length = 4
*** ServerHelloDone
Warning: no suitable certificate found - continuing without client authentication
*** Certificate chain
<Empty>

My JAVA class is a follows

public class ClientCustomSSL {

    @SuppressWarnings("deprecation")
    public final static void main(String[] args) throws Exception {
        // Trust own CA and all self-signed certs
        final String CLIENT_KEYSTORE = "yourkeystore.jks";
        final String CLIENT_TRUSTSTORE = "catruststore.jks";
        final char[] KEYPASS_AND_STOREPASS_VALUE = "Hello1".toCharArray();


        System.setProperty("https.protocols", "TLSv1");

        //SSLContext sslcontext = SSLContexts.custom().loadKeyMaterial(keystore, keyPassword)(YK,"Hello1".toCharArray(),"Hello1".toCharArray()).loadTrustMaterial(CA, "Hello1".toCharArray(), (TrustStrategy) new TrustSelfSignedStrategy()).build();

        KeyStore clientTrustStore = getStore(CLIENT_TRUSTSTORE, KEYPASS_AND_STOREPASS_VALUE);
        KeyStore clientKeyStore = getStore(CLIENT_KEYSTORE, KEYPASS_AND_STOREPASS_VALUE);  


        SSLContext sslContext = SSLContexts.custom().loadKeyMaterial(clientKeyStore, "Hello1".toCharArray()).loadTrustMaterial(clientTrustStore,(TrustStrategy) new TrustSelfSignedStrategy()).build();
       CloseableHttpClient httpclient = HttpClients.custom().setSSLContext(sslContext).build();

        System.out.println("SSLCONETXT   **** " + sslContext.getProvider());
        try {

            HttpGet httpget = new HttpGet("https://myserver:10220");

            CloseableHttpResponse response = httpclient.execute(httpget);

            try {
                System.out.println("Inside TRY blcok"); 
                HttpEntity entity = response.getEntity();
                System.out.println("----------------------------------------");
                System.out.println(response.getStatusLine());
                EntityUtils.consume(entity);

            } catch (Exception e) {
                e.getMessage();
                e.printStackTrace();
            }
            finally {
                response.close();
            }
        } finally {
            httpclient.close();
        }
    }


    public static KeyStore getStore(final String storeFileName, final char[] password) throws KeyStoreException, IOException, CertificateException, NoSuchAlgorithmException 
    {
        final String JAVA_KEYSTORE = "jks";
        final KeyStore store = KeyStore.getInstance(JAVA_KEYSTORE);
        URL url = ClientCustomSSL.class.getClassLoader().getResource(storeFileName);
        String workingDir = System.getProperty("user.dir");
        System.out.println("Current working directory : " + workingDir);

        System.out.println("Value of URL *** " + url);
        InputStream inputStream = url.openStream();
        try {
            store.load(inputStream, password);
} finally {
    inputStream.close();
}

return store;
}

}

I am preparing a jar file and testing this from UNIX box

Using following command java -Djavax.net.debug=ssl -cp snSSLclientTrustWithStoreCCC.jar cassandra.cass.ClientCustomSSL

I have followed post why doesn't java send the client certificate during SSL handshake? and also completed all the steps mentioned by Bruno.

I am not sure what I am missing here. Any help will be appreciated

Torquemada

Guys I am suspecting that SSLContext sslContext = SSLContexts.custom().loadKeyMaterial(clientKeyStore, "Hello1".toCharArray()).loadTrustMaterial(clientTrustStore,(TrustStrategy) new TrustSelfSignedStrategy()).build(); CloseableHttpClient httpclient = HttpClients.custom().setSSLContext(sslContext).build(); Is not adding all the certificates from ClientTrustStore. Anybody has encountered such issue ? – Torquemada

i had the same case day ago,and i deal with fallow: debug and observed those class: ClientHandshaker.serverHelloDone() and you will find the reson!goo luck! – Artefact

I don't understand the suggestion by 邱鸿霖 but I'm stuck on this too. (Java 7, TLS 1.2) – Spark

@Torquemada Did you find a solution? – Brandabrandais

@BernieLenz Did you find a solution ? – Rms

Answer 1

1. The client was unable to find a certificate in its keystore that was signed directly or indirectly by any of the signers mentioned in the CertificateRequest message.
2. The reason for that was that the server didn't specify any trusted signers in that message.
3. Which in turn means that the server's truststore is empty.

Carbamate

Answer 2

This is actually an area where the TLS 1.0 specification and TLS 1.1/1.2 differ.

In particular, the following was added to Section 7.4.4 (Certificate Request) in TLS 1.1:

If the certificate_authorities list is empty then the client MAY send any certificate of the appropriate ClientCertificateType, unless there is some external arrangement to the contrary.

So empty Cert Authorities just means client is free to send any certificates to the server, which may or may not be accepted by server's internal rules.

Whitsunday

Answer 3

In my case, the problem turned out to be that I was passing in null as the password when loading my key store:

KeyStore keyStore = KeyStore.getInstance("PKCS12")
InputStream inputStream = new FileInputStream('/path/to/mykeystore.p12')

try {
    keyStore.load(inputStream, null); // <-- PROBLEM HERE!
}
finally {
    inputStream.close();
}

This didn't produce any error messages, but it silently failed to load the client key & certificate.

The solution was to pass in the password:

keyStore.load(inputStream as InputStream, 'mypassword'.toCharArray());

Belgae

It is even necessary to add an empty byte[] in case when there is no password set for pkcs12 file. – Dennison

Answer 4

I had a similar problem

ServerHelloDone
Warning: no suitable certificate found - continuing without client authentication

Certificate chain

For me problem was that I had incorrectly created keystore:

keytool -importcert -keystore keystore.jks -alias client-cert -file client-cert.pem  -storepass password

What helped me was:

openssl pkcs12 -export -chain -in client-cert.pem  -inkey client-key.pem  -out keystore.p12 -name client-cert -CAfile ca-cert.pem
keytool -importkeystore -destkeystore keystore.jks -srckeystore keystore.p12 -alias client-cert

I found this solution here: https://blogs.oracle.com/jtc/installing-trusted-certificates-into-a-java-keystore

Composed