In a client-server ssl handshake, my server sends a certificate chain back to the client in a server-hello message. But I want to understand as to how that particular certificate chain is getting selected.

My keystore has 5 chains

privatekey (expired at let's say date1) --
intermediate or server cert (valid) --
root (valid)

privatekey cert (valid for 6 more months)--
intermediate or server cert (valid)--
root (valid)

privatekey cert (expired at lets say date2) --
intermediate or server cert (valid)--
root (valid)

privatekey cert (valid for 1 year) --
intermediate or server cert (valid)--
root (valid)

privatekey cert (expired at lets say date3) --
intermediate or server cert (valid)--
root (valid)

Now whenever a client tries to connect to my server (for a webservice) the below exception is being obtained and the client is not able to connect

sun.security.validator.ValidatorException: PKIX path validation failed: java.security.cert.CertPathValidatorException: timestamp check failed.
.................. *more lines*..
caused by java.security.cert.CertPathValidatorException: timestamp check failed........ *more lines*..
caused by java.security.cert.CertPathValidatorException: NotAfter : date1

Tried reconnecting but again the same error with date2 this time. Now this was not happening earlier even when there were expired certs in my keystore.

Can anyone explain as to how the certificate chain gets selected in the server hello message? I tried researching a lot but couldn't get something concrete

  • There is no such thing as a general key store, i.e. the behavior is implementation dependent. With OpenSSL you usually explicitly set the certificates to use while with Java you have some key store which might contain multiple entries. As far as I know you can specify the key store entry to use with an alias in Java. If you don't specify an alias it is probably undefined which entry gets used, i.e. you better have only one. See also What is the purpose/role of the “alias” attribute in Java keystore files?. – Steffen Ullrich Nov 5 '17 at 17:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.