I have added the necessary certificates to communicate a web service by TLS, both the client and the server added the certificates to the keystore, but in the handshake, certificate unknown is returned.
SSL Conversation:
Is initial handshake: true
....
*** ClientHello, TLSv1
*** ServerHello, TLSv1
*** Certificate chain
[ chain [0] = [
[
Version: V3
Subject: CN=certificate_server, OU=163831, O=groupc Inc., C=US
Signature Algorithm: SHA1withRSA, OID = 1.2.840.113549.1.1.5
Key: IBMJCE RSA Public Key:
modulus:
... more data
public exponent:
65537
Validity: [From: Mon Apr 03 10:43:20 CDT 2017,
To: Wed Apr 03 09:43:20 CST 2019]
Issuer: CN=Internal DeviceCA Untrusted, DC=nsroot, DC=net
SerialNumber: [110855813xxxxxxxxxxxxxxx]
Certificate Extensions: 10
Found trusted certificate:
*** CertificateRequest
Cert Types: RSA, DSS
Cert Authorities:
....
*** ServerHelloDone
** Certificate chain
[ O chain [0] = [
[
Version: V3
Subject: CN=certificateClient, OU=55552, O=groupc Inc., C=US
Signature Algorithm: SHA256withRSA, OID = 1.2.840.113549.1.1.11
Key: IBMJCE RSA Public Key:
modulus:
.... more data
public exponent:
65537
Validity: [From: Tue Aug 08 16:26:27 CDT 2017,
To: Thu Aug 08 16:26:27 CDT 2019]
Issuer: CN=Device CA1 G2 DEV, O=groupc Inc., C=US
SerialNumber: [23415xxxxxxxxxxxxxxxxxxxxxxx]
Certificate Extensions: 10
*** CertificateVerify
*** Finished
verify_data: { 101, 203, 80, 212, 246, 137, 144, 225, 31, 134, 63, 46 }
***
READ: TLSv1 Alert, length = 2
3, RECV TLSv1 ALERT: fatal, certificate_unknown
3 fatal: engine already closed. Rethrowing javax.net.ssl.SSLException: Received fatal alert: certificate_unknown
And list the keystore to see the keys and are the required, in the server are also the certificates.
Is there a way to know which certificate is unknown? or compare the courted string between the client and the server?