You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
I assumed I could use this library to easily setup a client authenticated TLS request. This turned out to not be possible, so not sure if I'm doing something wrong. The same code via the old path worked fine.
val keystore = KeyStore.getInstance("PKCS12").apply {
load(File("me.p12").inputStream(), password.toCharArray())
}
val alias = keystore.aliases().toList().single()
val kmf = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm())
kmf.init(keystore, password.toCharArray())
val tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm())
tmf.init(null as KeyStore?)
val context = SSLContext.getInstance("TLS")
context.init(kmf.keyManagers, tmf.trustManagers, SecureRandom())
val ssf = context.socketFactory
val tm = tmf.trustManagers[0] as X509TrustManager
val authClient = client.newBuilder().sslSocketFactory(ssf, tm).build()
I tried replacing this with
var keystore = KeyStore.getInstance("PKCS12").apply {
load(File("me.p12").inputStream(), keyPass.toCharArray())
}
var key = keystore.getKey(keyName, keyPass.toCharArray()) as PrivateKey
val cert = keystore.getCertificate(keyName) as X509Certificate
val certChain = keystore.getCertificateChain(keyName)
val handshakeCertificates = HandshakeCertificates.Builder().apply {
addPlatformTrustedCertificates()
heldCertificate(HeldCertificate.Builder().keyPair(cert.publicKey, key).build(), *certChain)
}.build()
val client = OkHttpClient.Builder().sslSocketFactory(handshakeCertificates.sslSocketFactory(), handshakeCertificates.trustManager()).build()
It failed because it doesn't end up using a valid chain, I can separately send the ssl debug output that shows the difference.
Is it worth extending the API to allow introspecting a keystore for available keys, selecting one, and setting up a client to use one? Or is this too niche, what falls in and out of scope for this library?
The text was updated successfully, but these errors were encountered:
Some notes and usage questions
I assumed I could use this library to easily setup a client authenticated TLS request. This turned out to not be possible, so not sure if I'm doing something wrong. The same code via the old path worked fine.
I tried replacing this with
It failed because it doesn't end up using a valid chain, I can separately send the ssl debug output that shows the difference.
Is it worth extending the API to allow introspecting a keystore for available keys, selecting one, and setting up a client to use one? Or is this too niche, what falls in and out of scope for this library?
The text was updated successfully, but these errors were encountered: