Jetty/Java MTLS - Validate Client Cert Against Different Server Certs?

user_6020194 0
Viewed 205

I am trying to set up MTLS on a Jetty Server. From the documentation I have seen typically the server certificate is set up such as this

 SslContextFactory.Server sslContextFactory = new SslContextFactory.Server();
 sslContextFactory.setKeyStorePath("/Users/name/Downloads/server.jks");
 sslContextFactory.setKeyStorePassword("changeit");
 
 sslContextFactory.setTrustStorePath("/Users/name/Downloads/server_truststore.jks");
 sslContextFactory.setTrustStorePassword("changeit");
 sslContextFactory.setNeedClientAuth(true);

However, I want to have different server certificates to validate against depending on which device sent the client certificate? What settings do i need to change, or classes can I override to dynamically validate certificates?

mtls jetty-9 jetty
1 Answers

You'll have to download it and then configure your SslContextFactory.Server to use the local copy.

This is a Java SSL engine limitation.

Use the prior answer on how to download a file from Amazon S3 ... https://stackoverflow.com/a/28569038/775715

For mTLS, just set the SslContextFactory.Server features you want to use for your set of features.

The behavior is standard Java JVM behavior, Jetty does very little here (Jetty only configures the JVM SSLEngine and SSLParameters objects, and handles host/alias matching if using SNI), all of the mTLS behaviors are baked into the JVM.

Everything from this point forward is standard Java behaviors of Client Auth, and Server Keystore/Truststore, there is nothing unique or special about Jetty. It's all a matter of configuring your Keystore/Truststore and issuing valid client certificates from those stores.

If you want multiple server certificates, go for, that's supported by the keystore / truststore.

If you want the client to validate against different server certificates, then the client needs to use the appropriate combination of server hostname and SNI information (this is an extremely common TLS extension).

user_7757150
Related