{"action":"created","issue":{"url":"https://api.github.com/repos/grpc/grpc-java/issues/2320","repository_url":"https://api.github.com/repos/grpc/grpc-java","labels_url":"https://api.github.com/repos/grpc/grpc-java/issues/2320/labels{/name}","comments_url":"https://api.github.com/repos/grpc/grpc-java/issues/2320/comments","events_url":"https://api.github.com/repos/grpc/grpc-java/issues/2320/events","html_url":"https://github.com/grpc/grpc-java/issues/2320","id":180489934,"number":2320,"title":"Client certificate not sent","user":{"login":"ChaosData","id":434346,"avatar_url":"https://avatars.githubusercontent.com/u/434346?v=3","gravatar_id":"","url":"https://api.github.com/users/ChaosData","html_url":"https://github.com/ChaosData","followers_url":"https://api.github.com/users/ChaosData/followers","following_url":"https://api.github.com/users/ChaosData/following{/other_user}","gists_url":"https://api.github.com/users/ChaosData/gists{/gist_id}","starred_url":"https://api.github.com/users/ChaosData/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ChaosData/subscriptions","organizations_url":"https://api.github.com/users/ChaosData/orgs","repos_url":"https://api.github.com/users/ChaosData/repos","events_url":"https://api.github.com/users/ChaosData/events{/privacy}","received_events_url":"https://api.github.com/users/ChaosData/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":8,"created_at":"2016-10-02T01:44:01Z","updated_at":"2016-11-07T19:33:44Z","closed_at":null,"body":"Hi,\n\nI'm trying to use gRPC from Java (as a client) to communicate with a gRPC Node.js server.\nI am trying to get TLS mutual auth between the two, but I can't seem to get the Java client to send its client cert. I've verified via packet capture that the Node server is requesting a client cert.\n\n``` java\nManagedChannelBuilder<?> mcb = NettyChannelBuilder.forAddress(\"127.0.0.1\", 50051)\n  .sslContext(GrpcSslContexts.forClient()\n    .keyManager(client_leaf.key, client_ca.cert, client_leaf.cert)\n    .trustManager(server_ca.cert)\n    .build()\n  )\n  .negotiationType(NegotiationType.TLS);\n\nmcb.overrideAuthority(\"localhost\");\n```\n\nI am dynamically generating CA certs and leaf certs under them to bind the communication.\nDue to this, I'm using the `keyManager(PrivateKey,X509Certificate...)` overload, and the private key is generated from a `KeyPairGenerator.getInstance(\"RSA\")` object. I'm currently generating two chains (one for the server's cert, and one for the client cert) and verification of the server cert works fine (connections work when I disable the client cert requirement on the Node server).\n\nMy relevant dependencies are below:\n\n``` groovy\ncompile group: 'io.grpc', name: 'grpc-netty', version: '1.0.1'\ncompile group: 'io.grpc', name: 'grpc-protobuf', version: '1.0.1'\ncompile group: 'io.grpc', name: 'grpc-stub', version: '1.0.1'\ncompile group: 'io.netty', name: 'netty-tcnative-boringssl-static', version: '+'//'1.1.33.Fork19'\n```\n\nThe `+` currently resolves to `1.1.33.Fork23`. I've found that the `1.1.33.Fork19` version specified in the documentation results in an exception on Linux (and OS X) caused by:\n\n```\nCaused by: javax.net.ssl.SSLHandshakeException: error:00000000:invalid library (0):OPENSSL_internal:invalid library (0)\n```\n\nAs per CONTRIBUTING.md, my setup is as follows:\n\n```\n$ java -version\nopenjdk version \"1.8.0_91\"\nOpenJDK Runtime Environment (build 1.8.0_91-8u91-b14-0ubuntu4~14.04-b14)\nOpenJDK 64-Bit Server VM (build 25.91-b14, mixed mode)\n$ uname -a\nLinux ubuntu 3.13.0-85-generic #129-Ubuntu SMP Thu Mar 17 20:50:15 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux\n```\n\nAny ideas on what might be causing this behavior or what I'm doing wrong?\n"},"comment":{"url":"https://api.github.com/repos/grpc/grpc-java/issues/comments/258938247","html_url":"https://github.com/grpc/grpc-java/issues/2320#issuecomment-258938247","issue_url":"https://api.github.com/repos/grpc/grpc-java/issues/2320","id":258938247,"user":{"login":"ejona86","id":2811396,"avatar_url":"https://avatars.githubusercontent.com/u/2811396?v=3","gravatar_id":"","url":"https://api.github.com/users/ejona86","html_url":"https://github.com/ejona86","followers_url":"https://api.github.com/users/ejona86/followers","following_url":"https://api.github.com/users/ejona86/following{/other_user}","gists_url":"https://api.github.com/users/ejona86/gists{/gist_id}","starred_url":"https://api.github.com/users/ejona86/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ejona86/subscriptions","organizations_url":"https://api.github.com/users/ejona86/orgs","repos_url":"https://api.github.com/users/ejona86/repos","events_url":"https://api.github.com/users/ejona86/events{/privacy}","received_events_url":"https://api.github.com/users/ejona86/received_events","type":"User","site_admin":false},"created_at":"2016-11-07T19:33:44Z","updated_at":"2016-11-07T19:33:44Z","body":"@ChaosData, I just uploaded a new `1.1.0-SNAPSHOT` version of gRPC that is using Netty 4.1.5. Could you try it out? You'll need to use tcnative version `1.1.33.Fork23` (newer versions may work, but gRPC is using Fork23 during its own testing)."}}
{"actor":{"display_login":"ejona86"}}