title: SSL: 400 no required certificate was sent
body: <p><strong>The code and inputs</strong></p>
  
  <p>I'm trying to establish SSL connection and I'm getting <code>400 No required SSL certificate was sent</code> response from the server. I'm doing this in a standard way like it's described for example <a href="https://stackoverflow.com/a/24007536">here</a>; I run Java 8.</p>
  
  <p>The sample of my code would be:</p>
  
  <pre><code>    OkHttpClient client     = new OkHttpClient();
      KeyStore keyStoreClient = getClientKeyStore();
      KeyStore keyStoreServer = getServerKeyStore();
      String algorithm        = ALGO_DEFAULT;//this is defined as "PKIX"
  
      KeyManagerFactory keyManagerFactory = KeyManagerFactory.getInstance(algorithm);
      keyManagerFactory.init(keyStoreClient, PASSWORD_SERVER.toCharArray());
  
      SSLContext sslContext = SSLContext.getInstance("TLS");
  
      TrustManagerFactory trustManagerFactory = TrustManagerFactory.getInstance(algorithm);
      trustManagerFactory.init(keyStoreServer);
  
      sslContext.init(keyManagerFactory.getKeyManagers(), trustManagerFactory.getTrustManagers(), new SecureRandom());
  
      client.setSslSocketFactory(sslContext.getSocketFactory());
      client.setConnectTimeout(32, TimeUnit.SECONDS); // connect timeout
      client.setReadTimeout(32, TimeUnit.SECONDS);    // socket timeout
  
      return client;
  </code></pre>
  
  <p>And here is the code that I use to send GET-request:</p>
  
  <pre><code>public String get(String url) throws IOException
  {
      String callUrl  = URL_LIVE.concat(url);
      Request request = new Request.Builder()
              .url(callUrl)
              .build();
      Response response = this.client.newCall(request).execute();
      return response.body().string();
  }
  </code></pre>
  
  <p>I enabled:</p>
  
  <pre><code>System.setProperty("javax.net.debug", "ssl");
  </code></pre>
  
  <p>So to see debug messages - but there's no errors/warnings/alerts there, the only thing is in the very end:</p>
  
  <pre><code>main, called close()
  main, called closeInternal(true)
  main, SEND TLSv1.2 ALERT:  warning, description = close_notify
  main, WRITE: TLSv1.2 Alert, length = 26
  main, called closeSocket(true)
  </code></pre>
  
  <p>Which is the only thing I can treat as "abnormal" stuff (but I doubt it is). </p>
  
  <p><strong>I tried:</strong></p>
  
  <ul>
  <li>Different protocols disabling/enabling. For instance, forcing <code>TLSv1</code> / <code>TLSv1.1</code> for the socket with no success. To try that I wrapped my ssl factory into another factory which disables/enables certain protocols.</li>
  <li>Disabling <code>SSLv2Hello</code> - but it doesn't change the picture. </li>
  <li>Install <a href="http://www.oracle.com/technetwork/java/javase/downloads/jce8-download-2133166.html" rel="nofollow noreferrer">Oracle policies</a> because before there were notices about some skipped algorithms and this installation "solved" that but the overall result is still same.</li>
  <li>Setting <code>System.setProperty("sun.security.ssl.allowUnsafeRenegotiation", "true");</code> - lame, but also didn't change a thing apart from message in the log <code>Allow unsafe renegotiation: true</code> (was "false" obviously)</li>
  <li>Using <code>KeyManagerFactory.getDefaultAlgorithm()</code> as <code>algorithm</code> for <code>KeyManagerFactory.getInstance()</code> call. That raises exception <code>Get Key failed: Given final block not properly padded</code> and as far as I got the idea, it's because of wrong algorithm used (read <a href="https://stackoverflow.com/a/8053459/2637490">this</a>). My default algorithm is: <code>SunX509</code></li>
  <li>Adding the certificate directly to my machine with <code>keytool -importcert -file /path/to/certificate -keystore keystore.jks -alias "Alias"</code> and then using this in my program via <code>System.setProperty("javax.net.ssl.trustStore","/path/to/keystore.jks");</code> with setting password: <code>System.setProperty("javax.net.ssl.trustStorePassword","mypassword");</code> (I set password in <code>keytool</code> after which confirmed trusted certificate with <code>yes</code>); see <a href="https://stackoverflow.com/a/4326346/2637490">this</a> and <a href="https://stackoverflow.com/a/5871352/2637490">this</a> posts. No errors were raised with this - but issue persisted.</li>
  <li>Adding the certificate to the global keystore (the one located in <code>JAVA_PATH/jre/lib/security/cacerts</code>) with: <code>keytool -import -trustcacerts -keystore cacerts -storepass changeit -noprompt -alias Alias -file /path/to/certificate</code> (see <a href="https://stackoverflow.com/a/27928213/2637490">this</a>); looks like import operation was successful but it didn't change the picture</li>
  </ul>
  
  <p>There's also notice in debug: <code>ssl: KeyMgr: choosing key: 1 (verified: OK)</code> - not sure if it's relevant as I'm not SSL expert.</p>
  
  <p>Unfortunately I can not see the server-side logs so I can't observe the full picture.</p>
  
  <p><strong>Question</strong></p>
  
  <p>What can be the reason for this 400 error and how can I progress further (debug/try something else) ? Any tips would be much appreciated.</p>