Opening a SSL socket using a pem certificate
<p>I'm trying to connect to a ssl server using Java. I've already managed to do that in Python, however I've got a <code>PEM</code> file which isn't supported by Java. Converting it to <code>PKCS12</code> didn't work </p>

<p>Error when trying to connect was:</p>

<pre><code>sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
</code></pre>

<p>My question is: Can you give me the Java equivalent? (Using another library is also ok)</p>

<pre><code>import ssl
import socket

mysock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
mysslsock = ssl.wrap_socket(mysock, keyfile='mykey.pem', certfile='mycert.pem')
mysslsock.connect(("SOMEHOST", XXXXX))
</code></pre>

<p>Please note that the server requires client authentication.</p>

<p><strong>Edit</strong></p>

<p>That's what I did in Java:</p>

<p>I used openssl to convert my certificate into PKCS12 format:</p>

<pre><code>openssl pkcs12 -export -out mystore.p12 -inkey mykey.pem -in mycert.pem
</code></pre>

<p>Then I've used the keytool that comes with the JDK to convert it into JKS:</p>

<pre><code>keytool -importkeystore -destkeystore mystore.jks -srcstoretype PKCS12 -srckeystore mystore.p12
</code></pre>

<p>And that's my Java code:</p>

<pre><code>System.setProperty("javax.net.ssl.keyStore", "mystore.jks");
System.setProperty("javax.net.ssl.keyStorePassword", "123456");
System.setProperty("javax.net.ssl.keyStoreType", "JKS");

SSLSocketFactory socketFactory = (SSLSocketFactory) SSLSocketFactory.getDefault();
SSLSocket socket = (SSLSocket) socketFactory.createSocket(HOST, PORT);
socket.startHandshake(); // That's the line I get the exception
socket.close();
</code></pre>

<p>I'm sure I'm making some really stupid mistake as I don't have any experience with SSL.</p>

<p><strong>Edit:</strong>
Probably I've somehow the wrong certificates so that's what they look like:</p>

<pre><code>&lt;mykey.pem&gt;
-----BEGIN RSA PRIVATE KEY-----
ljnoabndibnwzb12387uGJBEIUQWBIDAB
....... (Some more lines)
-----END RSA PRIVATE KEY-----

&lt;mycert.pem&gt;
Bag Attributes
    localKeyId: XX XX XX XX
subject:...
issuer:...
-----BEGIN CERTIFICATE-----
LAinaw8921hnA.......
.....
-----END CERTIFICATE-----
</code></pre>

<p>don't you need to load the Key into the Java Keystore?</p>

<p>that is a seperate program.</p>

<p><a href="http://docs.oracle.com/javase/7/docs/technotes/tools/solaris/keytool.html" rel="nofollow">http://docs.oracle.com/javase/7/docs/technotes/tools/solaris/keytool.html</a></p>

<p>-importcert {-alias alias} {-file cert_file} [-keypass keypass] {-noprompt} 
{-trustcacerts} {-storetype storetype} {-keystore keystore} [-storepass 
storepass] {-providerName provider_name} {-providerClass provider_class_name 
{-providerArg provider_arg}} {-v} {-protected} {-Jjavaoption}</p>

<p>Reads the certificate or certificate chain (where the latter is supplied
in a PKCS#7 formatted reply or a sequence of X.509 certificates) from the 
file cert_file, and stores it in the keystore entry identified by alias. If 
no file is given, the certificate or certificate chain is read from stdin.</p>

<p>keytool can import X.509 v1, v2, and v3 certificates, and PKCS#7 
formatted certificate chains consisting of certificates of that type. The 
data to be imported must be provided either in binary encoding format, or in 
printable encoding format (also known as Base64 encoding) as defined by the 
Internet RFC 1421 standard. In the latter case, the encoding must be bounded 
at the beginning by a string that starts with "-----BEGIN", and bounded at 
the end by a string that starts with "-----END".</p>

java python sockets ssl ssl-certificate