Can't call the server with 2-way TLS based on trusting CA authority - javax.net.ssl.SSLHandshakeException: None of the TrustManagers trust this server certificate chain

After going through the instructions for setting up two way TLS bases on trusting the certificate authority, when I run the tests I get the following exception:

javax.net.ssl.SSLHandshakeException: None of the TrustManagers trust this server certificate chain

	at java.base/sun.security.ssl.Alert.createSSLException(Alert.java:131)
	at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:320)
	at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:263)
	at java.base/sun.security.ssl.TransportContext.fatal(TransportContext.java:258)
       <...>
	at nl.altindag.client.service.ApacheHttpClientService.executeRequest(ApacheHttpClientService.java:32)
	at nl.altindag.client.stepdefs.HelloStepDefs.iSayHelloWithClient(HelloStepDefs.java:47)
	at ✽.I say hello with "Apache HttpClient"(file:///Users/eugeneh/Development/mutual-tls-ssl/client/src/test/resources/features/Hello.feature:6)
Caused by: java.security.cert.CertificateException: None of the TrustManagers trust this server certificate chain
	at nl.altindag.sslcontext.trustmanager.CompositeX509TrustManager.checkServerTrusted(CompositeX509TrustManager.java:86)
	at io.netty.handler.ssl.util.X509TrustManagerWrapper.checkServerTrusted(X509TrustManagerWrapper.java:63)
	at java.base/sun.security.ssl.CertificateMessage$T12CertificateConsumer.checkServerCerts(CertificateMessage.java:629)
	at java.base/sun.security.ssl.CertificateMessage$T12CertificateConsumer.onCertificate(CertificateMessage.java:464)
      <...>
	at com.intellij.rt.junit.IdeaTestRunner$Repeater.startRunnerWithArgs(IdeaTestRunner.java:33)
	at com.intellij.rt.junit.JUnitStarter.prepareStreamsAndStart(JUnitStarter.java:230)
	at com.intellij.rt.junit.JUnitStarter.main(JUnitStarter.java:58)

Any ideas what I’m doing wrong?

[Hakky54]

Great, I just pulled your latest commit. When I start the App.java and afterwards ClientRunnerIT.java it passes. If I run maven clean install from the root directory it is also passing. I also validated your identities and truststores of both the server and the client. The setup looks good and the keystores are loaded by the ClientConfig class with the SSLFactory. Do you still have uncommitted local changes?

I also made a video of the test of your repo, see here: https://youtu.be/K5GHCfR-wNY

Let me know if it is still occurring with the latest version of your commit without any local changes. If it is still occuring, let’s do a remote session

[Hakky54]

Hi again @EugeneBy

I got the same SSLHandshakeException exception when using the Oracle JDK and especially the following exception even deeper in the stacktrace: ValidatorException: TrustAnchor with subject is not a CA certificate. The issue was that the root-ca provided in this project was created without the following property: -ext bc:c. So it was basically not a really valid ca because of missing that property. I pushed the fix, so it should work for you as well right now. Could you let me know if it is working?