[8.5.16] SSLHostConfig certificateVerification="optionalNoCA" ignored?

[Martynas Jusevičius]

Hey list,

I need my webapp to accept all SSL client certificates and do its own
validation.

I'm upgrading server.xml from the JSSE SSL Connector which used
clientAuth="want" and a custom trustManagerClassName in order to do that.

The 8.5.16 docs indicate that this should be replaced with SSLHostConfig
certificateVerification="optionalNoCA". I have done, and also using OpenSSL
implementation now:

    <Connector port="8443"
protocol="org.apache.coyote.http11.Http11AprProtocol"
               maxThreads="150" SSLEnabled="true" >
        <UpgradeProtocol className="org.apache.coyote.http2.Http2Protocol"
/>
        <SSLHostConfig certificateVerification="optionalNoCA">
            <Certificate certificateKeyFile="/usr/local/ssl/tomcat.key.pem"
                         certificateFile="/usr/local/ssl/tomcat.cert.pem"
                         type="RSA" />
        </SSLHostConfig>
    </Connector>

However, I'm getting an exception that shows my client certificate is
validated and rejected by Tomcat/OpenSSL:

tomcat_1                         | https-openssl-apr-8443-exec-3, handling
exception: javax.net.ssl.SSLHandshakeException:
sun.security.validator.ValidatorException: PKIX path building failed:
sun.security.provider.certpath.SunCertPathBuilderException: unable to find
valid certification path to requested target
tomcat_1                         | https-openssl-apr-8443-exec-3,
IOException in getSession():  javax.net.ssl.SSLHandshakeException:
sun.security.validator.ValidatorException: PKIX path building failed:
sun.security.provider.certpath.SunCertPathBuilderException: unable to find
valid certification path to requested target
tomcat_1                         | https-openssl-apr-8443-exec-3, called
close()
tomcat_1                         | https-openssl-apr-8443-exec-3, called
closeInternal(true)

Am I missing something? certificateVerification="optional" exhibits the
same behaviour.

Thanks.

Martynas