title: Mutual Authentication - null cert chain
body: <p>I'm trying to set up mutual (2 way) SSL authentication. Ultimately I will have a mulesoft application (as client) calling a webapp (as the server). For now I am testing using Firefox browser as the client to simplify testing.</p>
  
  <p>I followed this tutorial 
  <a href="http://www.baeldung.com/x-509-authentication-in-spring-security" rel="nofollow noreferrer">http://www.baeldung.com/x-509-authentication-in-spring-security</a></p>
  
  <p>and managed to get this working fine. This uses a self signed certificate for the server and a self signed certificate for the client which is installed into firefox to make the client call. </p>
  
  <p>So far so good...</p>
  
  <p>However I am having issues once I try and use certificates signed by my company.</p>
  
  <p>So I have a client certificate which my company has signed. This has been provided as a client.cer file. I can view the details of this and see that it is issued by the company intermediary (which in turn is issued by the company root CA)</p>
  
  <p>The client CSR was created with </p>
  
  <pre><code>keytool -genkey -alias client -keyalg RSA -keysize 2048 -keystore client.jks -dname "CN=client-dev,OU=Dept, O=Company, L=London, ST=Greater London, C=GB"
  
  keytool -certreq -alias client -file client.csr -keystore client.jks
  </code></pre>
  
  <p>The next step of my testing is to try and use this company signed client.cer file to call my server on localhost (which is using a self signed certificate as per the tutorial).</p>
  
  <p>On having received the signed client.cer file the steps I have taken are...</p>
  
  <ul>
  <li>Import the companies Root.cer into the keystore I used to generate my
  client certificate signing request. </li>
  <li>Import the companies Intermediate.cer into the same keystore. </li>
  <li>Import the client.cer into the same keystore </li>
  <li>I then export a p12 file from this keystore and install this into firefox as my client certificate.</li>
  </ul>
  
  <p>The commands I use to do this are as follows</p>
  
  <pre><code>keytool -import -trustcacerts -alias primaryintermediate -file Root.cer -keystore client.jks -storepass &lt;pwd&gt;
  
  keytool -import -trustcacerts -alias secondaryintermediate -file Int.cer -keystore client.jks -storepass &lt;pwd&gt;
  
  keytool -import -trustcacerts -alias client -file client.cer -keystore client.jks -storepass &lt;pwd&gt;
  
  keytool -importkeystore -srcalias client -srckeystore client.jks -srcstorepass &lt;pwd&gt; -destkeystore "client.p12" -deststorepass &lt;pwd&gt; -deststoretype PKCS12
  </code></pre>
  
  <p>However when I try and hit my localhost app endpoint from firefox and view the log output I see the server side SSL handshake succeed but then get a "null cert chain" error in the client handshake. So the following steps look to succeed</p>
  
  <ul>
  <li>ClientHello</li>
  <li>ServerHello</li>
  <li>Certificate</li>
  <li>CertificateRequest</li>
  <li>ServerHelloDone</li>
  <li>Certificate - Error occurs here</li>
  </ul>
  
  <p>The relevant part of the log looks like this...</p>
  
  <pre><code>*** CertificateRequest
  Cert Types: RSA, DSS, ECDSA
  Supported Signature Algorithms: SHA512withECDSA, SHA512withRSA, SHA384withECDSA, SHA384withRSA, SHA256withECDSA, SHA256withRSA, SHA224withECDSA, SHA224withRSA, SHA1withECDSA, SHA1withRSA, SHA1withDSA, MD5withRSA
  Cert Authorities:
  &lt;CN=Root&gt;
  &lt;CN=client-dev, OU=Dept, O=Company, L=London, ST=Greater London, C=GB&gt;
  &lt;CN=Intermediate, DC=HBEU, DC=ADROOT, DC=Company&gt;
  *** ServerHelloDone
  https-jsse-nio-8443-exec-1, WRITE: TLSv1.2 Handshake, length = 2710
  https-jsse-nio-8443-exec-2, READ: TLSv1.2 Handshake, length = 77
  *** Certificate chain
  &lt;Empty&gt;
  ***
  https-jsse-nio-8443-exec-2, fatal error: 42: null cert chain
  javax.net.ssl.SSLHandshakeException: null cert chain
  </code></pre>
  
  <p>I'm unclear what I have done wrong but assume I must have created the p12 file incorrectly?</p>
  
  <p>Can anyone point me in the right direction?</p>