[android-developers] SSL handshake Client Certificate not sent

2012-11-28 Thread Ashish Gupta
Hi,

On Nexus7, when my app tries to connect to my SSL server, network capture 
shows that certificate was requested by the SSL server but ssl client sent 
a Client Certificate (11) message with certificate length being zero, 
basically no certificate was sent by the SSL client. Same apk when ran on 
previous devices did send the certificate and connected successfully to the 
same SSL server.

One possible reason for this is DN mismatch between the list of acceptable 
DNs as part of Certificate Request Message from the server and the DNs 
which are part of the SSL client certificates. I am not sure if this is the 
case since SSL client cert is signed by an intermediate CA (call it X) 
which is signed by another CA (call it Y). Y's DN is listed under the 
Certificate Request Message sent by the server but X's DN is not listed. 

In the working case, all 3 certificates(X,Y, and SSL client's own 
certificate) were sent by the SSL client. Any suggestion ?

Thanks
Ashish

-- 
You received this message because you are subscribed to the Google
Groups Android Developers group.
To post to this group, send email to android-developers@googlegroups.com
To unsubscribe from this group, send email to
android-developers+unsubscr...@googlegroups.com
For more options, visit this group at
http://groups.google.com/group/android-developers?hl=en

Re: [android-developers] SSL handshake Client Certificate not sent

2012-11-28 Thread Nikolay Elenkov
On Wed, Nov 21, 2012 at 6:59 AM, Ashish Gupta aguptamob...@gmail.com wrote:

 One possible reason for this is DN mismatch between the list of acceptable
 DNs as part of Certificate Request Message from the server and the DNs
 which are part of the SSL client certificates. I am not sure if this is the
 case since SSL client cert is signed by an intermediate CA (call it X) which
 is signed by another CA (call it Y). Y's DN is listed under the Certificate
 Request Message sent by the server but X's DN is not listed.


You might have to show some code. What does the server send as the
'list of acceptable DNs'? Are any of those trusted by the client?

-- 
You received this message because you are subscribed to the Google
Groups Android Developers group.
To post to this group, send email to android-developers@googlegroups.com
To unsubscribe from this group, send email to
android-developers+unsubscr...@googlegroups.com
For more options, visit this group at
http://groups.google.com/group/android-developers?hl=en