How to Use KeyStore API for Mutual TLS Handshake?

Here, the Experienced Java Application Development team describes all about setting up your mutual TLS client code (Java HTTPS client certificate authentication), which will communicate to your server with HTTPS protected with the certificate.

Please watch this video to learn more about the details with codebase uploaded to Git.

Click here for download

Java Configuration required for mutual TLS:

Client certificate authentication can only be enforced by the server. (When the server requests a client certificate (as part of the TLS handshake), it will likewise give a rundown of trusted CA's like a feature of the cert request). The CA root cert should be imported into a Java TrustStore (cacerts).

The client TS is a straightforward JKS design document containing the root or intermediate CA certs. These CA certs will figure out which endpoints you will be permitted to speak with, for this situation it will permit your client to interface with whichever server presents a certificate that was signed by one of the TS's CA's.

We can use the Java keystool command-line utility to import example.ca.crt into a new Java TrustStore but here what we have done is instead of the command line, We can Programmatically Import CA trust cert into the existing trust store file without using keytool and here I have used Keystore API from Java itself.

We can create a KS (Keystore) instance using the getInstance() method. Then we have to initialize the Keystore. We use the load method here. To create a new Keystore, we have to pass null as the first parameter. To access the Keystore, a password is being provided.

In Sample Example or Any Common Use case:

• I have a client certificate/bootstrap certificate composed of two files (.crt and .key), which we have to import to a Java KeyStore.
• Then we can use an SSLContext to send HTTP requests with Apache's HTTPClient or through the Rest template. The Apache HTTPClient typically takes SSLContext instances configured with the details needed to enable a safe and secure HTTPS connection.
• Also, I have developed a utility program that can import OpenSSL-formatted private keys into a Java Key Store while still preserving the JKS file format. Here we can use SSLContext. No prior understanding of SSLContact or TrustManager or KeyManager is required, ManagerFactory. Only we should provide an identity and trustStore.