Ytukyg

I'm trying to give server "A" the ability to connect to server "B" using the same X509 client certificate it received from the user. Here are the basics of where I am so far:

public int makeRemoteCall() {

    URL url = new URL("https://host.com/service/request");

    HttpsURLConnection conn = url.openConnection();

    SSLSocketFactory factory = getFactoryFromSessionCert();

    conn.setSSLSocketFactory(factory);

    int responseCode = conn.getResponseCode();

    return responseCode;

}





public static SSLSocketFactory getFactoryFromSessionCert() throws Exception {

    HttpServletRequest request = getRequest();

    X509Certificate certs = (X509Certificate)request.getAttribute("javax.servlet.request.X509Certificate");



    KeyStore keyStore = KeyStore.getInstance("JKS");

    keyStore.load(null, null);

    keyStore.setCertificateEntry("client_cert", certs[0]);



    KeyManagerFactory keyManagerFactory = KeyManagerFactory.getInstance("SunX509");

    keyManagerFactory.init(keyStore,  null);



    SSLContext context = SSLContext.getInstance("TLS");

    context.init(keyManagerFactory.getKeyManagers(), null, null);



    return context.getSocketFactory();

}

I am able to retrieve the client's certificate without trouble, and can verify that it does indeed end up in keyStore. But the certificate doesn't seem to make it into keyManagerFactory.

I thought the issue was that I'm not providing a password in keyManagerFactory.init(keyStore, null), so I tried providing it but without success. And should I even have to? I understand that I would need a password if I were loading certificates and keys from a protected file, but here I'm just trying to pass along an already exposed public certificate.

As further background, this basic scheme works if I replace getFactoryFromSessionCert() with this:

public static SSLSocketFactory getFactory(File pKeyFile, String pKeyPassword) throws Exception {



    KeyManagerFactory keyManagerFactory = KeyManagerFactory.getInstance("SunX509");

    KeyStore keyStore = KeyStore.getInstance("JKS");

    InputStream keyInput = new FileInputStream(pKeyFile);

    keyStore.load(keyInput, pKeyPassword.toCharArray());

    keyInput.close();



    keyManagerFactory.init(keyStore,  pKeyPassword.toCharArray());

    SSLContext context = SSLContext.getInstance("TLS");

    context.init(keyManagerFactory.getKeyManagers(), null, new SecureRandom());

    return context.getSocketFactory();

}

So, what am I not understanding? And how should I pass along a client certificate?