How to Use SSL Client Certificate with Apache HttpClient

In some case, the HTTPS server side requires the client side provides certificate. Here is the method how to make the client sends the client certificate to the server side when sending requrest with the Apache HttpClient library in Java.

Basically we need 2 steps:

Convert the “pem” certificate file into the Java “keystore” format file.
Write Java code to use the “keystore” file when connecting the HTTPS server.

Please check the details below.

1. Convert pem to jks

From here.

# Generate a pem file example(just for demo usage).
# Then concatenate the "key.pem" and "cert.pem" files into the "target.pem" file.
openssl req -newkey rsa:2048 -new -nodes -x509 -days 3650 -keyout key.pem -out cert.pem
# Convert the pem format into the pkcs12 format.
openssl pkcs12 -export -out target.pkcs12 -in target.pem
# Create an empty keystore file.
keytool -genkey -keyalg RSA -alias manifest -keystore keystore.jks
keytool -delete -alias manifest -keystore keystore.jks
# Import the pkcs12 cert into the keystore file.
keytool -v -importkeystore -srckeystore target.pkcs12 -srcstoretype PKCS12 -destkeystore keystore.jks -deststoretype JKS

2. Use the keystore file in code

From here.

public class MyClientCertTest {

    private static final String KEYSTOREPATH = "/clientkeystore.jks"; // or .p12
    private static final String KEYSTOREPASS = "keystorepass";
    private static final String KEYPASS = "keypass";

    KeyStore readStore() throws Exception {
        try (InputStream keyStoreStream = this.getClass().getResourceAsStream(KEYSTOREPATH)) {
            KeyStore keyStore = KeyStore.getInstance("JKS"); // or "PKCS12"
            keyStore.load(keyStoreStream, KEYSTOREPASS.toCharArray());
            return keyStore;
        }
    }
    @Test
    public void readKeyStore() throws Exception {
        assertNotNull(readStore());
    }
    @Test
    public void performClientRequest() throws Exception {
        SSLContext sslContext = SSLContexts.custom()
                .loadKeyMaterial(readStore(), KEYPASS.toCharArray()) // use null as second param if you don't have a separate key password
                .build();

        HttpClient httpClient = HttpClients.custom().setSSLContext(sslContext).build();
        HttpResponse response = httpClient.execute(new HttpGet("https://slsh.iki.fi/client-certificate/protected/"));
        assertEquals(200, response.getStatusLine().getStatusCode());
        HttpEntity entity = response.getEntity();

        System.out.println("----------------------------------------");
        System.out.println(response.getStatusLine());
        EntityUtils.consume(entity);
    }
}

Here is a “pem” file example(generated by the “openssl req -newkey rsa:2048 -new -nodes -x509 -days 3650 -keyout key.pem -out cert.pem” command):

More details about the “pem” file can be found here.

Gangmax Blog

How to Use SSL Client Certificate with Apache HttpClient

1. Convert pem to jks

2. Use the keystore file in code

Comments