Warning: no suitable certificate found - continuing without client authentication

Question

Team I am facing following issue when try to complete a mutual handshake using HTTPS

main, READ: TLSv1.2 Handshake, length = 30
*** CertificateRequest
Cert T         


        

Answer 1

This is actually an area where the TLS 1.0 specification and TLS 1.1/1.2 differ.

In particular, the following was added to Section 7.4.4 (Certificate Request) in TLS 1.1:

If the certificate_authorities list is empty then the client MAY send any certificate of the appropriate ClientCertificateType, unless there is some external arrangement to the contrary.

So empty Cert Authorities just means client is free to send any certificates to the server, which may or may not be accepted by server's internal rules.

Answer 2

1. The client was unable to find a certificate in its keystore that was signed directly or indirectly by any of the signers mentioned in the CertificateRequest message.
2. The reason for that was that the server didn't specify any trusted signers in that message.
3. Which in turn means that the server's truststore is empty.

Answer 3

I had a similar problem

ServerHelloDone
Warning: no suitable certificate found - continuing without client authentication

Certificate chain

For me problem was that I had incorrectly created keystore:

keytool -importcert -keystore keystore.jks -alias client-cert -file client-cert.pem  -storepass password

What helped me was:

openssl pkcs12 -export -chain -in client-cert.pem  -inkey client-key.pem  -out keystore.p12 -name client-cert -CAfile ca-cert.pem
keytool -importkeystore -destkeystore keystore.jks -srckeystore keystore.p12 -alias client-cert

I found this solution here: https://blogs.oracle.com/jtc/installing-trusted-certificates-into-a-java-keystore

Answer 4

In my case, the problem turned out to be that I was passing in null as the password when loading my key store:

KeyStore keyStore = KeyStore.getInstance("PKCS12")
InputStream inputStream = new FileInputStream('/path/to/mykeystore.p12')

try {
    keyStore.load(inputStream, null); // <-- PROBLEM HERE!
}
finally {
    inputStream.close();
}

This didn't produce any error messages, but it silently failed to load the client key & certificate.

The solution was to pass in the password:

keyStore.load(inputStream as InputStream, 'mypassword'.toCharArray());