title: Java client certificates and keystores
body: <p>we are trying to build a MUTUAL/2WAY authentication mechanism.</p>
  
  <p>Because we hit two different hosts, we have the same client certificate stored in the client keystore container under two different aliases (please note the same fingerprint):</p>
  
  <pre><code>root@perf-golem-4:/opt/golem# keytool -list -keystore ./client.keystore -storepass ________
  
  Keystore type: JKS
  Keystore provider: SUN
  
  Your keystore contains 2 entries
  
  i.domain.io, Jun 16, 2015, trustedCertEntry,
  Certificate fingerprint (SHA1): 28:94:45:A1:78:C0:BD:D6:82:7E:09:66:15:11:8D:A5:56:0B:99:39
  r.domain.io, Jun 16, 2015, trustedCertEntry,
  Certificate fingerprint (SHA1): 28:94:45:A1:78:C0:BD:D6:82:7E:09:66:15:11:8D:A5:56:0B:99:39
  </code></pre>
  
  <p>Now, under the trusted container we have the target domains certificates (please note how the fingerprint is different between them and also compared to the keystore above):</p>
  
  <pre><code>root@perf-golem-4:/opt/golem# keytool -list -keystore ./trusted.keystore -storepass _______
  
  Keystore type: JKS
  Keystore provider: SUN
  
  Your keystore contains 2 entries
  
  i.domain.io, Jun 16, 2015, trustedCertEntry,
  Certificate fingerprint (SHA1): 73:F5:96:68:89:56:5E:50:9C:06:69:67:AC:8E:18:D2:D9:C1:33:71
  r.domain.io, Jun 16, 2015, trustedCertEntry,
  Certificate fingerprint (SHA1): 12:93:C8:41:3F:68:22:8F:40:F8:3C:B9:B6:C4:90:C0:60:49:D0:50
  </code></pre>
  
  <p>My understanding is that if you have to store a certificate with an alias matching the target domain name (in our case i.domain.io or r.domain.io) so java can provide the associated certificate as a client certificate when you are attempting a SSL connection to that domain e.g. <a href="https://r.domain.io" rel="nofollow">https://r.domain.io</a></p>
  
  <p>We are launching our app like this:</p>
  
  <pre><code>java    -Djavax.net.debug=all \
          -Djavax.net.ssl.keyStore=/opt/golem/client.keystore \
          -Djavax.net.ssl.keyStorePassword=_____ \
          -Djavax.net.ssl.trustStore=/opt/golem/trusted.keystore \
          -Djavax.net.ssl.trustStorePassword=_____ \
  </code></pre>
  
  <p>Our problem is that no client certificate is being presented, or used from the client side so, the big question is does java provide the client certificate associated with an alias that matches target domain name (or subject line in the target SSL cert) or the name of the certificate should be mangled from the code?</p>