<!DOCTYPE html>
<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=UTF-8">
</head>
<body>
<p>Hi,<br>
<br>
I think that maybe I found a bad message for SSLHanshakeException
in sun.security.ssl.CertificateMessage.<br>
<br>
At server side configured with <b>CLIENT_AUTH_REQUIRED</b>, I get
this SSLHanshakeException when trying to connect with a client
sending an empty cert chain : <br>
<br>
</p>
<pre class="notranslate"><code class="notranslate">Caused by: javax.net.ssl.SSLHandshakeException: Empty server certificate chain
at sun.security.ssl.Alert.createSSLException(Alert.java:131)
at sun.security.ssl.Alert.createSSLException(Alert.java:117)
at sun.security.ssl.TransportContext.fatal(TransportContext.java:318)
at sun.security.ssl.TransportContext.fatal(TransportContext.java:274)
at sun.security.ssl.TransportContext.fatal(TransportContext.java:265)
at sun.security.ssl.CertificateMessage$T12CertificateConsumer.onCertificate(CertificateMessage.java:390)
at sun.security.ssl.CertificateMessage$T12CertificateConsumer.consume(CertificateMessage.java:375)
at sun.security.ssl.SSLHandshake.consume(SSLHandshake.java:377)
at sun.security.ssl.HandshakeContext.dispatch(HandshakeContext.java:444)
at sun.security.ssl.SSLEngineImpl$DelegatedTask$DelegatedAction.run(SSLEngineImpl.java:981)
at sun.security.ssl.SSLEngineImpl$DelegatedTask$DelegatedAction.run(SSLEngineImpl.java:968)
at java.security.AccessController.doPrivileged(Native Method)
at sun.security.ssl.SSLEngineImpl$DelegatedTask.run(SSLEngineImpl.java:915)
at io.netty.handler.ssl.SslHandler.runDelegatedTasks(SslHandler.java:1651)
at io.netty.handler.ssl.SslHandler.unwrap(SslHandler.java:1497)
at io.netty.handler.ssl.SslHandler.decodeJdkCompatible(SslHandler.java:1338)
at io.netty.handler.ssl.SslHandler.decode(SslHandler.java:1387)
at io.netty.handler.codec.ByteToMessageDecoder.decodeRemovalReentryProtection(ByteToMessageDecoder.java:530)
at io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:469)
</code></pre>
In that case, I think it should be "Empty client certificate chain<code
class="notranslate"></code>" ?<br>
<br>
Looking at the <b>sun.security.ssl.CertificateMessage</b> code it
seems that same error message is used for client/server and for
"empty when required cert chain" and "certificate message receive
when not required or requested".<br>
We should probably have 3 different message : <br>
<ul>
<li>"Empty server certificate chain"</li>
<li>"Client authentication required but empty client certificate
chain<code class="notranslate"></code> received"</li>
<li>"Unexpected client Certificate message received because client
authentication is not requested or required"</li>
</ul>
<p>(some more details at :
<a class="moz-txt-link-freetext" href="https://github.com/netty/netty/issues/13993#issuecomment-2074966726">https://github.com/netty/netty/issues/13993#issuecomment-2074966726</a>)</p>
<p>tested with openJDK 8 and 17.<br>
</p>
<p>HTH<br>
<br>
Simon<br>
</p>
</body>
</html>