Unable to get client certificate because HttpsExchange.getSSLSession() returns null #16
Description
Version used: 1.0.20
We need the HttpsExchange.getSSLSession() method to get the SSLSession from the exchange in order to be able to check the client certificate used in the SSL Handshake.
Unfortunately, when using the robaho httpserver, the result of this method seems to be always null, even when https is used and the client has sent a certificate in the handshake. With the jdk httpserver this works fine.
Thanks in advance for any help.
Here our code, which works fine with jdk httpserver:
try {
getLogger().log(Level.FINE, "get TLS client certificate, if any");
SSLSession sslSession = exchange.getSSLSession();
if (sslSession == null) {
getLogger().log(Level.FINE, "No SSLSession in exchange");
} else {
Certificate[] certs = sslSession.getPeerCertificates();
if (certs[0] instanceof X509Certificate x509Cert) {
exchangeInfos.setTlsClientCert(x509Cert);
exchangeInfos.setTlsClientVerified(true);
getLogger().log(Level.FINEST, "Client certificate: {0}", x509Cert);
} else {
getLogger().log(Level.SEVERE, "Not a X509Certificate: {0}", certs[0].getClass().getName());
}
}
} catch (SSLPeerUnverifiedException e) {
if (commonConfig.isSSLDebugOn()) {
getLogger().log(Level.FINEST, "No client certificate", e);
} else {
getLogger().log(Level.FINE, "No client certificate");
}
}
Reactions are currently unavailable