title: Two-way SSL between two applications on the same Tomcat Server
body: <p>I have the following scenario: two Java applications are running on the same Tomcat server -- let's call them App A and App B -- and they need to talk to each other via a webservice that is already up and running on App A. This webservice only accepts authenticated clients (clientAuth="true").</p>
  
  <p>After all is configured, my Tomcat, acting as a client, sends an empty certificate chain to the server (which is the same Tomcat). Here's what I have done.</p>
  
  <p>I generated a self-signed certificate for the server using keytool:</p>
  
  <pre><code>keytool -genkeypair -keyalg RSA -keysize 2048 -keystore keystore.jks -alias server
  </code></pre>
  
  <p>Then exported this certificate:</p>
  
  <pre><code>keytool -exportcert -keystore keystore.jsk -alias server -file server.crt
  </code></pre>
  
  <p>And added it to the truststore:</p>
  
  <pre><code>keytool -importcert -keystore truststore.jsk -alias server -file server.crt
  </code></pre>
  
  <p>The SSL negotiation is as follows:</p>
  
  <ol>
  <li>Client says hello</li>
  <li>Server says hello and presents its certificate (generated above) for
  the client</li>
  <li>Client accepts it (since it's in the truststore)</li>
  <li>Server requires client certificate by presenting a list of valid DNs (which contains a single entry, the certificate generated above)</li>
  <li>Client somehow decides it has no valid certificates and sends an empty cert chain</li>
  <li>SSL handshake fails</li>
  </ol>
  
  <p>I didn't post the actual SSL log because the client and the server are the same Tomcat, so everything is a mixed up mess.</p>
  
  <p>What have I done wrong here? Keep in mind that these two apps are on the same server and the cert is self-signed. I also did a test where I generated another self-signed cert, exported it to a .p12 file and installed it in my browser, then called the webservice via URL directly into the address box, it worked flawlessly.</p>
  
  <p>Thanks!</p>