Mailing-List: contact users-help@tomcat.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "Tomcat Users List" <users@tomcat.apache.org>
Received-SPF: pass (nike.apache.org: domain of nancee.riehl@gmail.com
 designates 209.85.220.193 as permitted sender)
MIME-Version: 1.0
Date: Fri, 6 Dec 2013 09:46:59 +0100
Message-ID: 
 <CAEucG4XSnV6u0ykDX6c6ex+J_eDbyOecgGsMVJWo7o0KfcKSHQ@mail.gmail.com>
Subject: Different SSLHandshakeExceptions tomcat 6.0.35 and 7.0.47
From: Nancee Riehl <nancee.riehl@gmail.com>
To: users@tomcat.apache.org
Content-Type: multipart/alternative; boundary=047d7b34427a77f38c04ecd9b03e

--047d7b34427a77f38c04ecd9b03e
Content-Type: text/plain; charset=ISO-8859-1

Hi all,

I've implemented my own JSSE-Implemantation to do some special
Client-Certificate Validations.
When I sent a Client Certificate with length 0 I get in tomcat 6.0.35 this
Exception:
javax.net.ssl.SSLHandshakeException: Received fatal alert: bad_certificate

This is good because I can check it in my JUnit-Test.

When I do the same test with tomcat 7.0.47 I get only this Exception:
java.net.SocketException: Software caused connection abort: recv failed

My Implemation for further Certificate Validations is not affected at this
moment.

The Handshake in my own Socket-Factory looks like this:
try {
 super.handshake(sock);
} catch (IOException e) {
 LOGGER.error(e);
throw new SSLHandshakeException("Test");
} catch (Exception e) {
 LOGGER.error(e);
throw new SSLException(e);
}

I've also created wireshark traces there I could see that with tomcat
6.0.35 I get an Alert Message with Level Fatal (2) and Description Bad
Certificate (42)

With tomcat 7.0.47 I get an Encrypted Alert without further information.

Best regards,
Nancee

--047d7b34427a77f38c04ecd9b03e--