title: Spring Boot: Use specific alias form keystore to consume HTTPS SOAP webservice
body: <p>I have a spring boot application in which am trying to consume consume HTTPS SOAP webservice which requires authentication with private key which is part of my keystore.jks as alias <code>client</code></p>
  
  <p>I have a spring boot application with below config</p>
  
  <pre><code>server:  
    port: 8443
    sessionTimeout: 30
    ssl:
      key-store: keystore.jks
      key-store-password: 123456    
      keyAlias: tomcat
      key-password: 123456
      keyPassword: 123456
      trust-store: truststore.jks
      trust-store-password: 123456
  </code></pre>
  
  <p><code>keystore.jks</code> has 2 aliases(PFX) <code>tomcat</code> which serves the hosted service and <code>client</code>for authenticating with <code>SOAP</code> web service</p>
  
  <p>I am seeing below exception when am trying to invoke java soap client stub</p>
  
  <pre><code>%% Invalidated:  [Session-2, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256]
  https-jsse-nio-443-exec-4, SEND TLSv1.2 ALERT:  fatal, description = certificate_unknown
  https-jsse-nio-443-exec-4, WRITE: TLSv1.2 Alert, length = 2
  [Raw write]: length = 7
  0000: 15 03 03 00 02 02 2E                               .......
  https-jsse-nio-443-exec-4, called closeSocket()
  https-jsse-nio-443-exec-4, handling exception: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
  2017-04-18 17:15:26.253 ERROR 2360 --- [-nio-443-exec-4] o.a.c.c.C.[.[.[/].[dispatcherServlet]    : Servlet.service() for servlet [dispatcherServlet] in context with path [] threw exception [Request processing failed; nested exception is javax.xml.ws.WebServiceException: Failed to access the WSDL at: https://tseiod-test.trustweaver.com/ts/svs.asmx?wsdl. It failed with: 
      sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target.] with root cause
  
  sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
      at sun.security.provider.certpath.SunCertPathBuilder.build(Unknown Source)
      at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(Unknown Source)
      at java.security.cert.CertPathBuilder.build(Unknown Source)
      at sun.security.validator.PKIXValidator.doBuild(Unknown Source)
      at sun.security.validator.PKIXValidator.engineValidate(Unknown Source)
      at sun.security.validator.Validator.validate(Unknown Source)
      at sun.security.ssl.X509TrustManagerImpl.validate(Unknown Source)
      at sun.security.ssl.X509TrustManagerImpl.checkTrusted(Unknown Source)
      at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(Unknown Source)
      at sun.security.ssl.ClientHandshaker.serverCertificate(Unknown Source)
      at sun.security.ssl.ClientHandshaker.processMessage(Unknown Source)
      at sun.security.ssl.Handshaker.processLoop(Unknown Source)
      at sun.security.ssl.Handshaker.process_record(Unknown Source)
      at sun.security.ssl.SSLSocketImpl.readRecord(Unknown Source)
      at sun.security.ssl.SSLSocketImpl.performInitialHandshake(Unknown Source)
      at sun.security.ssl.SSLSocketImpl.startHandshake(Unknown Source)
      at sun.security.ssl.SSLSocketImpl.startHandshake(Unknown Source)
      at sun.net.www.protocol.https.HttpsClient.afterConnect(Unknown Source)
      at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(Unknown Source)
      at sun.net.www.protocol.http.HttpURLConnection.getInputStream0(Unknown Source)
      at sun.net.www.protocol.http.HttpURLConnection.getInputStream(Unknown Source)
      at sun.net.www.protocol.https.HttpsURLConnectionImpl.getInputStream(Unknown Source)
      at java.net.URL.openStream(Unknown Source)
      at com.sun.xml.internal.ws.wsdl.parser.RuntimeWSDLParser.createReader(Unknown Source)
      at com.sun.xml.internal.ws.wsdl.parser.RuntimeWSDLParser.resolveWSDL(Unknown Source)
      at com.sun.xml.internal.ws.wsdl.parser.RuntimeWSDLParser.parse(Unknown Source)
      at com.sun.xml.internal.ws.wsdl.parser.RuntimeWSDLParser.parse(Unknown Source)
      at com.sun.xml.internal.ws.wsdl.parser.RuntimeWSDLParser.parse(Unknown Source)
      at com.sun.xml.internal.ws.client.WSServiceDelegate.parseWSDL(Unknown Source)
      at com.sun.xml.internal.ws.client.WSServiceDelegate.&lt;init&gt;(Unknown Source)
      at com.sun.xml.internal.ws.client.WSServiceDelegate.&lt;init&gt;(Unknown Source)
      at com.sun.xml.internal.ws.client.WSServiceDelegate.&lt;init&gt;(Unknown Source)
      at com.sun.xml.internal.ws.client.WSServiceDelegate.&lt;init&gt;(Unknown Source)
      at com.sun.xml.internal.ws.spi.ProviderImpl.createServiceDelegate(Unknown Source)
      at javax.xml.ws.Service.&lt;init&gt;(Unknown Source)
  </code></pre>
  
  <p>Looks like <code>client</code> alias from <code>keystore.jks</code> is not used for authenticating with HTTPS web service, is there anyway I can force spring boot to use specific alias from <code>keystore</code>? Or is there any workaround to achieve this?</p>