Use Client Certificate Authentication with Java and RestTemplate

Nayden Gochev
Nov 4 · 2 min read

As a follow up of the https://medium.com/@gochev/convert-pfx-certificate-to-jks-p12-crt-97ab8350af07 we now have a keystore and a truststore (if anyone needs) and we will use this keystore to send client side authentication using Spring’s RestTemplate.

First copy your keystore.jks and truststore.jks in your classpath, no one wants absolute paths right ?:)

Again a reminder The difference between truststore and keystore if you are not aware is(quote from the JSSE ref guide):

TrustManager: Determines whether the remote authentication credentials (and thus the connection) should be trusted.

KeyManager: Determines which authentication credentials to send to the remote host.

The magic happens in the creation of SSLContext. Keep in mind the Spring Boot have a nice RestTemplateBuilder but I will not gonna use it, because someone of you might have an older version or like me, might just use a plain old amazing Spring.

If you just want to use the keystore:

final String allPassword = “123456”;
SSLContext sslContext = SSLContextBuilder
.create()
.loadKeyMaterial(ResourceUtils.getFile(“classpath:keystore.jks”),
allPassword.toCharArray(), allPassword.toCharArray())
.build();

if you just want to use the truststore

final String allPassword = “123456”;
SSLContext sslContext = SSLContextBuilder
.create()
.loadTrustMaterial(ResourceUtils.getFile(“classpath:truststore.jks”), allPassword.toCharArray())
.build();

I guess you know how to use both ;), if you want to IGNORE the truststore certificate checking and trust ALL certificates (might be handy for testing purposes and localhost)

final String allPassword = “123456”;
TrustStrategy acceptingTrustStrategy = (X509Certificate[] chain, String authType) -> true;
SSLContext sslContext = SSLContextBuilder
.create()
.loadTrustMaterial(ResourceUtils.getFile(“classpath:truststore.jks”), allPassword.toCharArray())
.loadTrustMaterial(null, acceptingTrustStrategy) //accept all
.build();

Ones you have the sslContext you simply do :

HttpClient client = HttpClients.custom()
.setSSLContext(sslContext)
.build();
HttpComponentsClientHttpRequestFactory requestFactory =
new HttpComponentsClientHttpRequestFactory();
requestFactory.setHttpClient(client);RestTemplate restTemplate = new RestTemplate(requestFactory);return restTemplate;

And Voala, now each time you make a get/post or exchange with your restTemplate you will send the client side certificate.

Full example (the “tests” version) that sends client side certificate and ignores the SSL certificate

private RestTemplate getRestTemplateClientAuthentication()
throws IOException, UnrecoverableKeyException, CertificateException, NoSuchAlgorithmException,
KeyStoreException, KeyManagementException {
final String allPassword = “123456”;
TrustStrategy acceptingTrustStrategy = (X509Certificate[] chain, String authType) -> true;
SSLContext sslContext = SSLContextBuilder
.create()
.loadKeyMaterial(ResourceUtils.getFile(“classpath:keystore.jks”),
allPassword.toCharArray(), allPassword.toCharArray())
//.loadTrustMaterial(ResourceUtils.getFile(“classpath:truststore.jks”), allPassword.toCharArray())
.loadTrustMaterial(null, acceptingTrustStrategy)
.build();
HttpClient client = HttpClients.custom()
.setSSLContext(sslContext)
.build();
HttpComponentsClientHttpRequestFactory requestFactory =
new HttpComponentsClientHttpRequestFactory();
requestFactory.setHttpClient(client);RestTemplate restTemplate = new RestTemplate(requestFactory);return restTemplate;
}

Hope this is handy for you !

Nayden Gochev

Written by

Superhero with Java powers &&(Sci-Fi & Star Wars geek)&& Bulgarian Java User Group Leader && nerds2nerds podcaster && http://java.beer guy ? this : null

Welcome to a place where words matter. On Medium, smart voices and original ideas take center stage - with no ads in sight. Watch
Follow all the topics you care about, and we’ll deliver the best stories for you to your homepage and inbox. Explore
Get unlimited access to the best stories on Medium — and support writers while you’re at it. Just $5/month. Upgrade