title: Client is sending empty certificate chain to server despite of it having all the required certificates and keys
body: <p>My application is running on jboss 6.4 and trying to communicate to load balancer. When server asks for certificate chain from client (jboss), it sends an empty certificate chain and ssl handshake fails.</p>
  
  <p>I used below command to generate self sign certificate and key in my keystore</p>
  
  <pre><code>keytool -genkey -alias bliui11345 -keyalg RSA -validity 365 -keysize 2048 -keystore bliui.jks
  </code></pre>
  
  <p>CN=BLI, OU=BUK-IIT, O=Bank, L=London, ST=London, C=GB</p>
  
  <p>Then I exported certificate </p>
  
  <pre><code>keytool -exportcert -rfc -file clientcert.pem –keystore bliui.jks -alias bliui11345
  </code></pre>
  
  <p>I installed clientcert.pem in servers truststore. and servers's CA signed cert in my truststore.</p>
  
  <p>I added below connector in my jboss standalone.xml - </p>
  
  <pre><code>&lt;connector name="https" protocol="HTTP/1.1" scheme="https" socket-binding="https" secure="true"&gt;
                  &lt;ssl name="https" password="xyz" certificate-key-file="/opt/eap/standalone/configuration/bliui.jks" verify-client="true" ca-certificate-file="/opt/eap/standalone/configuration/bliui.jks" ca-certificate-password="xyz" ssl-protocol="TLSv1.2"/&gt;
  &lt;/connector&gt;
  </code></pre>
  
  <p>Despite of adding this connector jboss communicates on 8080.</p>
  
  <p>This is how entry in my keystore looks like </p>
  
  <pre><code>Alias name: bliui11345
  Creation date: 08-Jul-2019
  Entry type: PrivateKeyEntry
  Certificate chain length: 1
  Certificate[1]:
  Owner: CN=BLI, OU=BUK-IIT, O=Bank, L=London, ST=London, C=GB
  Issuer: CN=BLI, OU=BUK-IIT, O=Bank, L=London, ST=London, C=GB
  Serial number: ******
  Valid from: Mon Jul 08 11:34:56 IST 2019 until: Thu Jul 07 11:34:56 IST 2022
  Certificate fingerprints:
           MD5:  ***
           SHA1: **
           SHA256: **
  Signature algorithm name: SHA256withRSA
  Subject Public Key Algorithm: 2048-bit RSA key
  Version: 3
  </code></pre>
  
  <p>Keystore also loads properly as I can see loading certificates and keys in jboss logs with debug=ssl</p>
  
  <pre><code>Starting JCA Subsystem (IronJacamar 1.0.42.Final-redhat-2)
  Starting Naming Service
  Bound mail session [java:jboss/mail/Default]
  System property jdk.tls.client.cipherSuites is set to 'null'
  System property jdk.tls.server.cipherSuites is set to 'null'
  Ignoring disabled cipher suite: SSL_RSA_WITH_DES_CBC_SHA
  Ignoring disabled cipher suite: SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA
  Ignoring disabled cipher suite: TLS_KRB5_WITH_DES_CBC_MD5
  Ignoring disabled cipher suite: SSL_DH_anon_EXPORT_WITH_RC4_40_MD5
  Ignoring disabled cipher suite: SSL_DH_anon_WITH_DES_CBC_SHA
  Ignoring disabled cipher suite: TLS_KRB5_WITH_3DES_EDE_CBC_SHA
  Ignoring disabled cipher suite: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
  Ignoring disabled cipher suite: TLS_KRB5_WITH_DES_CBC_SHA
  Ignoring disabled cipher suite: TLS_KRB5_EXPORT_WITH_DES_CBC_40_MD5
  Ignoring disabled cipher suite: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
  Ignoring disabled cipher suite: SSL_DHE_RSA_WITH_DES_CBC_SHA
  Ignoring disabled cipher suite: TLS_KRB5_WITH_3DES_EDE_CBC_MD5
  Ignoring disabled cipher suite: SSL_DH_anon_WITH_RC4_128_MD5
  Ignoring disabled cipher suite: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
  Ignoring disabled cipher suite: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
  Ignoring disabled cipher suite: SSL_DH_anon_WITH_3DES_EDE_CBC_SHA
  Ignoring disabled cipher suite: SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA
  Ignoring disabled cipher suite: TLS_ECDH_anon_WITH_RC4_128_SHA
  Ignoring disabled cipher suite: SSL_DHE_DSS_WITH_DES_CBC_SHA
  Ignoring disabled cipher suite: TLS_KRB5_EXPORT_WITH_RC4_40_SHA
  Ignoring disabled cipher suite: SSL_RSA_EXPORT_WITH_DES40_CBC_SHA
  Ignoring disabled cipher suite: TLS_KRB5_WITH_RC4_128_SHA
  Ignoring disabled cipher suite: SSL_RSA_EXPORT_WITH_RC4_40_MD5
  Ignoring disabled cipher suite: TLS_KRB5_EXPORT_WITH_DES_CBC_40_SHA
  Ignoring disabled cipher suite: TLS_KRB5_EXPORT_WITH_RC4_40_MD5
  Ignoring disabled cipher suite: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
  Ignoring disabled cipher suite: TLS_KRB5_WITH_RC4_128_MD5
  Ignoring disabled cipher suite: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
  Ignoring disabled cipher suite: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
  Ignoring disabled cipher suite: SSL_RSA_WITH_RC4_128_SHA
  Ignoring disabled cipher suite: TLS_ECDH_anon_WITH_3DES_EDE_CBC_SHA
  Ignoring disabled cipher suite: TLS_ECDH_RSA_WITH_RC4_128_SHA
  Ignoring disabled cipher suite: SSL_DH_anon_EXPORT_WITH_DES40_CBC_SHA
  Ignoring disabled cipher suite: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
  Ignoring disabled cipher suite: TLS_ECDHE_RSA_WITH_RC4_128_SHA
  Ignoring disabled cipher suite: SSL_RSA_WITH_RC4_128_MD5
  Ignoring disabled cipher suite: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
  Ignoring disabled cipher suite: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
  Ignoring disabled cipher suite: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
  Ignoring disabled cipher suite: SSL_RSA_WITH_3DES_EDE_CBC_SHA
  Ignoring disabled cipher suite: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
  Ignoring disabled cipher suite: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
  Ignoring disabled cipher suite: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
  Ignoring disabled cipher suite: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
  Ignoring disabled cipher suite: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
  Ignoring disabled cipher suite: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
  Ignoring disabled cipher suite: SSL_RSA_WITH_3DES_EDE_CBC_SHA
  Ignoring disabled cipher suite: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
  Ignoring disabled cipher suite: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
  Ignoring disabled cipher suite: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
  trustStore is: /opt/eap/standalone/configuration/bliui.jks
  trustStore type is : jks
  trustStore provider is : 
  init truststore
  adding as trusted cert:
  Subject: CN=Test Global Infrastructure Intermediate CA (7), OU=Test Global Infrastructure Intermediate CA (7), O=Barclays PLC
  Issuer:  CN=Test Global Infrastructure Root CA (7), OU=Test Global Infrastructure Root CA (7), O=Barclays PLC
  Algorithm: RSA; Serial number: 0x4ed6d35d0cf5f88e2162399a05a3c7d1
  Valid from Wed May 17 01:00:00 BST 2017 until Fri May 17 00:59:59 BST 2024
  
  Ignoring disabled cipher suite: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
  Ignoring disabled cipher suite: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
  Ignoring disabled cipher suite: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
  Ignoring disabled cipher suite: SSL_RSA_WITH_3DES_EDE_CBC_SHA
  Ignoring disabled cipher suite: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
  Ignoring disabled cipher suite: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
  Ignoring disabled cipher suite: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
  ***
  found key for : bliui11345
  chain [0] = [
  [
  Version: V3
  Subject: CN=BLI, OU=BUK-IIT, O=Bank, L=London, ST=London, C=GB
  Signature Algorithm: SHA256withRSA, OID = 1.2.840.113549.1.1.11
  Key:  Sun RSA public key, 2048 bits
  modulus: 20684769127101855227492774116772415979402075608086475705872282444802275351603045851226344549731179317732787593894367418004227770753430523757523483229300687424482724535998894744666727437462034313158018417744426363750571388616927327
  public exponent: 65537
  Validity: [From: Mon Jul 08 07:04:56 BST 2019,
  To: Thu Jul 07 07:04:56 BST 2022]
  Issuer: CN=BLI, OU=BUK-IIT, O=Bank, L=London, ST=London, C=GB
  SerialNumber: [    47fc10c5]
  Coyote HTTP/1.1 initializing on : http-0.0.0.0:8443
  Coyote HTTP/1.1 initializing on : http-0.0.0.0:8080
  Coyote HTTP/1.1 starting on: http-0.0.0.0:8443
  Coyote HTTP/1.1 starting on: http-0.0.0.0:8080
  Starting deployment of "1.0.012-BLIUI_SuppressedInsights.ear" (runtime-name: "1.0.012-BLIUI_SuppressedInsights.ear")
  Started FileSystemDeploymentService for directory /opt/eap/standalone/deployments
  Listening on 0.0.0.0:9999
  Listening on 0.0.0.0:4447
  </code></pre>
  
  <p>Client hello -</p>
  
  <pre><code>*** ClientHello, TLSv1.2
  RandomCookie:  , 58GMT: 1568247549 , bytes = { 41244, , 6763, , 6687, , 161230, , 6550, , 99210, , 213144, , 20220, , 230227, , 210158, , 12095, , 20275, , 95129, , 11094, , 9145, , 14205, , 146226, , 201215, , 161207, , 15196, , 196138, , 112156, , 195217, , 14195 }
  Session ID:  , {}
  51, 157Cipher Suites: [TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384, TLS_RSA_WITH_AES_256_CBC_SHA256, TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA384, TLS_ECDH_RSA_WITH_AES_256_CBC_SHA384, TLS_DHE_RSA_WITH_AES_256_CBC_SHA256, TLS_DHE_DSS_WITH_AES_256_CBC_SHA256, TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA, TLS_RSA_WITH_AES_256_CBC_SHA, TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA, TLS_ECDH_RSA_WITH_AES_256_CBC_SHA, TLS_DHE_RSA_WITH_AES_256_CBC_SHA, TLS_DHE_DSS_WITH_AES_256_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256, TLS_RSA_WITH_AES_128_CBC_SHA256, TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA256, TLS_ECDH_RSA_WITH_AES_128_CBC_SHA256, TLS_DHE_RSA_WITH_AES_128_CBC_SHA256, TLS_DHE_DSS_WITH_AES_128_CBC_SHA256, TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, TLS_RSA_WITH_AES_128_CBC_SHA, TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA, TLS_ECDH_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_DSS_WITH_AES_128_CBC_SHA, TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384, TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, TLS_RSA_WITH_AES_256_GCM_SHA384, TLS_ECDH_ECDSA_WITH_AES_256_GCM_SHA384, TLS_ECDH_RSA_WITH_AES_256_GCM_SHA384, TLS_DHE_RSA_WITH_AES_256_GCM_SHA384, TLS_DHE_DSS_WITH_AES_256_GCM_SHA384, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256, TLS_RSA_WITH_AES_128_GCM_SHA256, TLS_ECDH_ECDSA_WITH_AES_128_GCM_SHA256, TLS_ECDH_RSA_WITH_AES_128_GCM_SHA256, TLS_DHE_RSA_WITH_AES_128_GCM_SHA256, TLS_DHE_DSS_WITH_AES_128_GCM_SHA256, TLS_EMPTY_RENEGOTIATION_INFO_SCSV]
  Session ID:   }
  Extension elliptic_curves, curve names: {secp256r1, secp384r1, secp521r1, sect283k1, sect283r1, sect409k1, sect409r1, sect571k1, sect571r1, secp256k1}
  Extension ec_point_formats, formats: [uncompressed]
  Extension signature_algorithms, signature_algorithms: SHA512withECDSA, SHA512withRSA, SHA384withECDSA, SHA384withRSA, SHA256withECDSA, SHA256withRSA, SHA256withDSA, SHA224withECDSA, SHA224withRSA, SHA224withDSA, SHA1withECDSA, SHA1withRSA, SHA1withDSA
  { Extension extended_master_secret}
  Extension server_name, server_name: [type=host_name (0), value=bliapi-11344.appcloud-np.barcapint.com]
  ***
  </code></pre>
  
  <p>Server hello -</p>
  
  <pre><code>*** ServerHello, TLSv1.2
  Session ID:  {171, 62, 204, 191, 99, 232, 72, 53, 55, 26, 33, 162, 114, 101, 185, 219, 42, 179, 21, 12, 23, 152, 37, 165, 42, 194, 74, 187, 121, 10, 95, 255}
  Cipher Suite: TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
  Compression Method: 0
  Extension renegotiation_info, renegotiated_connection: &lt;empty&gt;
  Extension server_name, server_name: 
  Extension ec_point_formats, formats: [uncompressed]
  ***
  %% Initialized:  [Session-2, TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256]
  ** TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
  update handshake state: server_hello[2]
  upcoming handshake states: server certificate[11]
  upcoming handshake states: server_key_exchange[12](optional)
  upcoming handshake states: certificate_request[13](optional)
  upcoming handshake states: server_hello_done[14]
  upcoming handshake states: client certificate[11](optional)
  upcoming handshake states: client_key_exchange[16]
  upcoming handshake states: certificate_verify[15](optional)
  upcoming handshake states: client change_cipher_spec[-1]
  upcoming handshake states: client finished[20]
  upcoming handshake states: server change_cipher_spec[-1]
  upcoming handshake states: server finished[20]
  READ: TLSv1.2 Handshake, length = 3682
  check handshake state: certificate[11]
  update handshake state: certificate[11]
  upcoming handshake states: server_key_exchange[12](optional)
  certificate_request[13](optional)
  upcoming handshake states: server_hello_done[14]
  upcoming handshake states: client certificate[11](optional)
  upcoming handshake states: client_key_exchange[16]
  upcoming handshake states: certificate_verify[15](optional)
  upcoming handshake states: client change_cipher_spec[-1]
  upcoming handshake states: client finished[20]
  upcoming handshake states: server change_cipher_spec[-1]
  upcoming handshake states: client change_cipher_spec[-1]
  upcoming handshake states: server finished[20]
   *** Certificate chain
  chain [0] = [ few certificates here]
  </code></pre>
  
  <p>Certificate Request and client certificate chain is empty-</p>
  
  <pre><code>*** CertificateRequest
  Cert Types: RSA, DSS, ECDSA
  check handshake state: server_key_exchange[12]
  Supported Signature Algorithms: SHA256withRSA, SHA256withDSA, SHA256withECDSA, SHA384withRSA, Unknown (hash:0x5, signature:0x2), SHA384withECDSA, SHA512withRSA, Unknown (hash:0x6, signature:0x2), SHA512withECDSA, SHA1withRSA, SHA1withDSA, SHA1withECDSA
  Cert Authorities:
  &lt;CN=BLI, OU=BUK-IIT, O=Bank, L=London, ST=London, C=GB&gt;
  *** ECDH ServerKeyExchange
  upcoming handshake states: client finished[20]
  Signature Algorithm SHA256withRSA
  upcoming handshake states: server change_cipher_spec[-1]
  upcoming handshake states: server finished[20]
  Server key: Sun EC public key, 256 bits
  public x coord: 9119033559767037929973738794301384386482607672191668181147945847562822
  public y coord: 2509706886352702164670894720440491148370487015976959327973686224762
   parameters: secp256r1 [NIST P-256, X9.62 prime256v1] (1.2.840.10045.3.1.7)
  *** ServerHelloDone
  Warning: no suitable certificate found - continuing without client authentication
  *** Certificate chain
  &lt;Empty&gt;
  ***
  </code></pre>