Problem with SSL client certificates

[Dave Seidel <da...@mindreef.com>]

Hi,
 
We're using HttpClient 2.0 with AuthSSLProtocolSocketFactory.  Following the
way that class is documented, we have a keystore and a truststore, and we
instruct our users to add their client cert to the keystore and the server's
CA cert to the truststore.  In our testing here, where the server is
Apache/mod_ssl, this works fine, meaning that our client and the server
mutually authenticate.
 
However, we have a customer who is unable to get this to work; he always
gets a 403 response from the server  I've been able to get him to create
Ethereal traces, and in the part of the conversation where the client issues
the Certificate message, the certificate data is not actually present in the
packet.  Looking at the Ethereal trace, I see a sequence like so:
 
(TCP/IP handshake...)
client: Client Hello
server: Server Hello, Certificate, Certificate Request, Server Hello Done
client: Certificate[1], Client Key Exchange
client: Change Cipher Spec
client: Certificate[2]
server: Change Cipher Spec, Client Key Exchange
(encrypted data, consisting of an HTTP 403 error)
 
[1] This one is empty. i.e., certficate length = 0
[2] This one looks bogus: Ethereal says that the certificate length is
14732467, but the total length of the TLS record in the packet is 37 bytes.
 
I am no SSL expert, so if anyone can provide any hint on what might be the
problem, I would really appreciate it.
 
- Dave