title: Signature does not match java pfx certificate
body: <p>Hi i am trying to write a soap client in java for a webservice behind ssl , the webservice's company give me a pfx certificate ; i have managed to test the webservice in soapui ; but i can not write a java client, i got a lot of errors with ssl and the last error i have got is  Signature does not match
  please if you could show me the right way to configure this ssl thing to work fine</p>
  <pre><code>public class SoapSSLTest {
  /***
   * path to the client keystore 
   * */
  private static final String CLIENT_KEYSTORE_PATH=&quot;27384425attada_132707366942472887.pfx&quot;;
  
  /***
   * Password for the the client keystore 
   */
  private static final String CLIENT_KEYSTORE_PASSWORD=&quot;attada@123&quot;;
  
  /***
   * The servers certificate's alias within the client key store 
   */
  private static final String SERVER_CERTIFICATE_ALIAS=&quot;u6337-attadamoune&quot;;
  
  /**
   * URL to THE QUANTIC SOAP UI service 
   */
  private static final String SOAP_URI=&quot;https://www.test.quantikcb.com/testui/Services/LiveRequestService.svc&quot;;
  private static final String URN =&quot;urn:examples:helloservice&quot;;
  
  
  private static final String REQUEST=&quot;&lt;REQUEST REQUEST_ID=\&quot;1\&quot;&gt;\r\n&quot;
          + &quot;             &lt;REQUEST_PARAMETERS&gt;\r\n&quot;
          + &quot;                 &lt;REPORT_PARAMETERS REPORT_ID=\&quot;2657\&quot; SUBJECT_TYPE=\&quot;COMM\&quot; RESPONSE_TYPE=\&quot;1\&quot;/&gt;\r\n&quot;
          + &quot;                 &lt;APPLICATION_DETAILS LOAN_TYPE=\&quot;0113\&quot;/&gt;\r\n&quot;
          + &quot;             &lt;/REQUEST_PARAMETERS&gt;\r\n&quot;
          + &quot;             &lt;SEARCH_PARAMETERS SEARCH_TYPE=\&quot;NMIDSRCH\&quot;&gt;\r\n&quot;
          + &quot;                 &lt;NAME&gt;CALPAL GROUP&lt;/NAME&gt;\r\n&quot;
          + &quot;                 &lt;ID_TYPE&gt;C&lt;/ID_TYPE&gt;\r\n&quot;
          + &quot;                 &lt;TRIBUNAL_CODE&gt;85&lt;/TRIBUNAL_CODE&gt;\r\n&quot;
          + &quot;                 &lt;IDENTIFIER_NUMBER&gt;81867&lt;/IDENTIFIER_NUMBER&gt;\r\n&quot;
          + &quot;             &lt;/SEARCH_PARAMETERS&gt;\r\n&quot;
          + &quot;              &lt;/REQUEST&gt;&quot;;
  
  
  /**
   * Loads the keystore using the default keystorle type (apks) with the given
   * file path and password 
   * @param filePath : the path to the keystore 
   * @param password : the keystore password 
   * @return : returns the keystore 
   * @throws IOException 
   * @throws KeyStoreException 
   * @throws CertificateException 
   * @throws NoSuchAlgorithmException 
   * @throws :NoSuchAlgorithmException
   * @see keystore#load(inputstream, char[])
   * @throws : IOException
   * @see FileInputSteam()
   * @throws keyStoreException
   * @see keystore#getInstance()
   */
  
  private KeyStore loadKeystore(String filePath,char [] password) throws IOException, KeyStoreException, NoSuchAlgorithmException, CertificateException {
      FileInputStream is = new FileInputStream(new File(filePath));
  
      final KeyStore keystore = KeyStore.getInstance(KeyStore
              .getDefaultType());
  
      keystore.load(is, password);
  
      return keystore;
  }
  
  
  public void run() throws KeyStoreException, NoSuchAlgorithmException, CertificateException, IOException, UnrecoverableKeyException, KeyManagementException, SOAPException {
      /*
       * Load the keystore
       */
      char[] password = CLIENT_KEYSTORE_PASSWORD.toCharArray();
      KeyStore keystore = loadKeystore(CLIENT_KEYSTORE_PATH, password);
  
      /*
       * Get the servers trusted certificate.
       */
      
      
      final Certificate trusted = keystore
              .getCertificate(SERVER_CERTIFICATE_ALIAS);
  
      /*
       * Create a trust manager that validates the servers certificate
       */
      TrustManager[] trustManager = new TrustManager[] { new X509TrustManager() {
          public java.security.cert.X509Certificate[] getAcceptedIssuers() {
              return null;
          }
  
          public void checkClientTrusted(X509Certificate[] certs,
                  String authType) {
          }
  
          public void checkServerTrusted(X509Certificate[] certs,
                  String authType) throws CertificateException {
  
              if (certs == null || certs.length == 0) {
                  throw new IllegalArgumentException(
                          &quot;null or zero-length certificate chain&quot;);
              }
  
              if (authType == null || authType.length() == 0) {
                  throw new IllegalArgumentException(
                          &quot;null or zero-length authentication type&quot;);
              }
  
              // check if certificate sent is your CA's
  
              if (!certs[0].equals(trusted)) {
  
                  // check if its been signed by the CA
  
                  try {
                      certs[0].verify(trusted.getPublicKey());
                  } catch (InvalidKeyException | NoSuchAlgorithmException
                          | NoSuchProviderException | SignatureException e) {
                      throw new CertificateException(e);
                  }
              }
  
              certs[0].checkValidity();
          }
      } };
  
      KeyManagerFactory kmf = KeyManagerFactory.getInstance(KeyManagerFactory
              .getDefaultAlgorithm());
  
      kmf.init(keystore, password);
  
      // set the trust manager
      SSLContext sc = SSLContext.getInstance(&quot;SSL&quot;);
      sc.init(kmf.getKeyManagers(), trustManager,
              new java.security.SecureRandom());
  
      HttpsURLConnection.setDefaultSSLSocketFactory(sc.getSocketFactory());
  
      // create an all-trusting host name verifier
      HostnameVerifier allHostsValid = new HostnameVerifier() {
          public boolean verify(String hostname, SSLSession session) {
              return true;
          }
      };
  
      HttpsURLConnection.setDefaultHostnameVerifier(allHostsValid);
  
      
      MessageFactory messageFactory =MessageFactory.newInstance();
      SOAPMessage soapMessage = messageFactory.createMessage();
      SOAPPart soapPart = soapMessage.getSOAPPart();
      
      SOAPEnvelope envelope = soapPart.getEnvelope();
      envelope.removeNamespaceDeclaration(&quot;SOAP-ENV&quot;);
      envelope.addNamespaceDeclaration(&quot;soap&quot;, &quot;http://www.w3.org/2003/05/soap-envelope&quot;);
      envelope.addNamespaceDeclaration(&quot;sbw&quot;,&quot;http://dnbsilverbladeproduct.com/SBWebsite&quot;);
      envelope.addNamespaceDeclaration(&quot;dnb&quot;, &quot;http://schemas.datacontract.org/2004/07/Dnb.SB.Web.WebClient.Services&quot;);
      envelope.setPrefix(&quot;soap&quot;);
      /**
      *   &lt;soap:Envelope xmlns:soap=&quot;http://www.w3.org/2003/05/soap-envelope&quot; xmlns:sbw=&quot;http://dnbsilverbladeproduct.com/SBWebsite&quot; xmlns:dnb=&quot;http://schemas.datacontract.org/2004/07/Dnb.SB.Web.WebClient.Services&quot;&gt;
      *      &lt;soap:Header/&gt;
      *      &lt;soap:Body&gt;
      *         &lt;sbw:GetLiveCIR&gt;
      *            &lt;!--Optional:--&gt;
      *            &lt;sbw:ReqLiveReport&gt;
      *               &lt;dnb:UserName&gt;&lt;![CDATA[userFinal1]]&gt; &lt;/dnb:UserName&gt;
      *               &lt;dnb:Password&gt;&lt;![CDATA[soapclient@123]]&gt; &lt;/dnb:Password&gt;
      *               &lt;dnb:RequestXML&gt;&lt;![CDATA[&lt;REQUEST REQUEST_ID=&quot;1&quot;&gt;
      *                       &lt;REQUEST_PARAMETERS&gt;
      *                       &lt;REPORT_PARAMETERS REPORT_ID=&quot;2657&quot; SUBJECT_TYPE=&quot;COMM&quot; RESPONSE_TYPE=&quot;1&quot;/&gt;
      *                            &lt;APPLICATION_DETAILS LOAN_TYPE=&quot;0113&quot;/&gt;
      *                       &lt;/REQUEST_PARAMETERS&gt;
      *                       &lt;SEARCH_PARAMETERS SEARCH_TYPE=&quot;NMIDSRCH&quot;&gt;
      *                           &lt;NAME&gt;CALPAL GROUP&lt;/NAME&gt;
      *                           &lt;ID_TYPE&gt;C&lt;/ID_TYPE&gt;
      *                           &lt;TRIBUNAL_CODE&gt;85&lt;/TRIBUNAL_CODE&gt;
      *                           &lt;IDENTIFIER_NUMBER&gt;81867&lt;/IDENTIFIER_NUMBER&gt;
      *                       &lt;/SEARCH_PARAMETERS&gt;
      *                       &lt;/REQUEST&gt;]]&gt; 
      *               &lt;/dnb:RequestXML&gt;
      *            &lt;/sbw:ReqLiveReport&gt;
      *         &lt;/sbw:GetLiveCIR&gt;
      *      &lt;/soap:Body&gt;
      *   &lt;/soap:Envelope&gt;
      **/
      
      SOAPHeader soapHeader = envelope.getHeader();
      soapHeader.setPrefix(&quot;soap&quot;);
      
      SOAPBody soapBody = envelope.getBody();
      soapBody.setPrefix(&quot;soap&quot;);
      
      SOAPElement getLiveCIRElement=soapBody.addChildElement(&quot;GetLiveCIR&quot;,&quot;sbw&quot;);
      SOAPElement getLiveReportElement = getLiveCIRElement.addChildElement(&quot;ReqLiveReport&quot;,&quot;sbw&quot;);
      SOAPElement userNameElement=getLiveReportElement.addChildElement(&quot;UserName&quot;,&quot;dnb&quot;);
      SOAPElement passwordElement=getLiveReportElement.addChildElement(&quot;Password&quot;,&quot;dnb&quot;);
      SOAPElement requestXMLElement=getLiveReportElement.addChildElement(&quot;RequestXML&quot;,&quot;dnb&quot;);
      
      
      CDATASection usernameCDATA = userNameElement.getOwnerDocument().createCDATASection(&quot;27384425attada&quot;);
      userNameElement.appendChild(usernameCDATA);
      
      CDATASection passwordCDATA = passwordElement.getOwnerDocument().createCDATASection(&quot;attada@123&quot;);
      userNameElement.appendChild(passwordCDATA);
       
      CDATASection requestXMLCDATA = requestXMLElement.getOwnerDocument().createCDATASection(REQUEST);
      requestXMLElement.appendChild(requestXMLCDATA);
      
      //soapBodyElem2.addTextNode(&quot;EXample First Name&quot;);
      
      MimeHeaders headers = soapMessage.getMimeHeaders();
      headers.addHeader(&quot;SOAPAction&quot;, SOAP_URI+&quot;verifyEmail&quot;);
      soapMessage.saveChanges();
      
      
      //send request to the server 
      URL url = new URL(SOAP_URI);
      URLConnection con = url.openConnection();
      con.setDoOutput(true);
      soapMessage.writeTo(con.getOutputStream());
      
      //read in response and print it to screen 
      Reader reader = new InputStreamReader(con.getInputStream());
      
      while (true) {
          int ch = reader.read();
          if(ch==-1) {
              break;
          }
          System.out.println((char) ch);
      }
      
  }
  
  public static void main(String [] args)
          throws UnrecoverableKeyException, KeyManagementException, KeyStoreException,
          NoSuchAlgorithmException, CertificateException, IOException, SOAPException {
      SoapSSLTest test = new SoapSSLTest();
      test.run();
  }
  </code></pre>
  <p>the stacktrace :</p>
  <pre><code>Exception in thread &quot;main&quot; javax.net.ssl.SSLHandshakeException: java.security.cert.CertificateException: java.security.SignatureException: Signature does not match.
      at sun.security.ssl.Alert.createSSLException(Unknown Source)
      at sun.security.ssl.TransportContext.fatal(Unknown Source)
      at sun.security.ssl.TransportContext.fatal(Unknown Source)
      at sun.security.ssl.TransportContext.fatal(Unknown Source)
      at sun.security.ssl.CertificateMessage$T12CertificateConsumer.checkServerCerts(Unknown Source)
      at sun.security.ssl.CertificateMessage$T12CertificateConsumer.onCertificate(Unknown Source)
      at sun.security.ssl.CertificateMessage$T12CertificateConsumer.consume(Unknown Source)
      at sun.security.ssl.SSLHandshake.consume(Unknown Source)
      at sun.security.ssl.HandshakeContext.dispatch(Unknown Source)
      at sun.security.ssl.HandshakeContext.dispatch(Unknown Source)
      at sun.security.ssl.TransportContext.dispatch(Unknown Source)
      at sun.security.ssl.SSLTransport.decode(Unknown Source)
      at sun.security.ssl.SSLSocketImpl.decode(Unknown Source)
      at sun.security.ssl.SSLSocketImpl.readHandshakeRecord(Unknown Source)
      at sun.security.ssl.SSLSocketImpl.startHandshake(Unknown Source)
      at sun.security.ssl.SSLSocketImpl.startHandshake(Unknown Source)
      at sun.net.www.protocol.https.HttpsClient.afterConnect(Unknown Source)
      at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(Unknown Source)
      at sun.net.www.protocol.http.HttpURLConnection.getOutputStream0(Unknown Source)
      at sun.net.www.protocol.http.HttpURLConnection.getOutputStream(Unknown Source)
      at sun.net.www.protocol.https.HttpsURLConnectionImpl.getOutputStream(Unknown Source)
      at applications.SoapSSLTest.run(SoapSSLTest.java:261)
      at applications.SoapSSLTest.main(SoapSSLTest.java:280)
  Caused by: java.security.cert.CertificateException: java.security.SignatureException: Signature does not match.
      at applications.SoapSSLTest$1.checkServerTrusted(SoapSSLTest.java:160)
      at sun.security.ssl.AbstractTrustManagerWrapper.checkServerTrusted(Unknown Source)
      ... 19 more
  Caused by: java.security.SignatureException: Signature does not match.
      at sun.security.x509.X509CertImpl.verify(Unknown Source)
      at sun.security.x509.X509CertImpl.verify(Unknown Source)
      at applications.SoapSSLTest$1.checkServerTrusted(SoapSSLTest.java:157)
      ... 20 more
  </code></pre>