How to deal with .crt and .key files?

[brasta78]

Hi,

I've got .crt and .key files from API provider and I'm not sure how to deal with them.. I've converted to .pem with these commands:
openssl rsa -in server.key -text > private.pem
openssl x509 -inform PEM -in server.crt > public.pem

but trying to create:
X509ExtendedKeyManager keyManager = PemUtils.loadIdentityMaterial("cert/private.pem");

i get an error:
Exception in thread "main" java.lang.ArrayIndexOutOfBoundsException: Index 0 out of bounds for length 0
at nl.altindag.ssl.util.PemUtils.parseIdentityMaterial(PemUtils.java:150)
at nl.altindag.ssl.util.PemUtils.parseIdentityMaterial(PemUtils.java:103)
at nl.altindag.ssl.util.PemUtils.loadIdentityMaterial(PemUtils.java:172)
at nl.altindag.ssl.util.PemUtils.loadIdentityMaterial(PemUtils.java:166)

Thank You!

[Hakky54]

Hi Brasta78,

Thank you for stopping by and asking questions. The PemUtils.loadIdentityMaterial() method expects either a single file containing the private key and the certificate chain. Or two separate files needs to be supplied. It looks like with your setup you should use a different method.

Can you retry with the following method:

X509ExtendedKeyManager keyManager = PemUtils.loadIdentityMaterial("cert/public.pem", "cert/private.pem");

[brasta78]

Hi, Hakky54,

With your example I get this error:
javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure

So I need to add server key chain certifacate right? With this command:
openssl s_client -connect test.api.ob.xxx.com:443 -servername test.api.ob.xxx.com 2>/dev/null </dev/null | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p'
I got certificate and saved as server.pem then added this line:

X509ExtendedTrustManager trustManager = PemUtils.loadTrustMaterial("cert/server.pem");

after that i have this error:
javax.net.ssl.SSLHandshakeException: None of the TrustManagers trust this certificate chain

do I need to import this server certificate to JAVA_HOME truststore or something else?

[Hakky54]

So it looks like your previous exception is gone and therefor we can safely assume that the identity material is loaded correctly as a keymanager.

Your next exception is happening when the server is sending his publickey/certificate to you. In order to proceed the client will check if the server is a trusted one. Based on the exception what you are getting it is saying that it could not find a matching certificate within the trustmanager. So either the supplied certificate is incorrect or it does not contain a matching certificate at all.

Can you do the following actions:

1. Make sure the trustmaterial contains the following format: Example trusted certificate
2. Retry with the following command to get the server certificate: openssl s_client -showcerts -connect test.api.ob.xxx.com:443 </dev/null | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p'
3. Share your client configuration, including the ssl configuration
4. Re execute your https request with the following VM arguments: -Djavax.net.debug=SSL,keymanager,trustmanager,ssl:handshake and share the full logs here (remove confidential information)

[brasta78]

sorry, Hakky54, - after changing my code to:
X509ExtendedKeyManager keyManager = PemUtils.loadIdentityMaterial("cert/public.pem", "cert/private.pem");
and adding:
X509ExtendedTrustManager trustManager = PemUtils.loadTrustMaterial("cert/server.pem");

all is ok. Previously I forgot to change to test server URI. Thanks!

[Hakky54]

Ah great to hear that everything works well now. Good luck!