title: SSLHandshakeException: null cert chain
body: <p>I am trying to establish an SSL connection in a Java client-server application. I have provided a JKS keystore with the complete certificate chain, but I'm still getting the following exception in the server:</p>
  
  <pre><code>upcoming handshake states: server finished[20]
  *** Certificate chain
  &lt;Empty&gt;
  ***
  fatal error: 42: null cert chain
  javax.net.ssl.SSLHandshakeException: null cert chain
  %% Invalidated:  [Session-5, TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384]
  MyThread
  , SEND TLSv1.2 ALERT:  
  fatal, 
  description = bad_certificate
  MyThread, WRITE: TLSv1.2 Alert, length = 2
  MyThread, fatal: engine already closed.  Rethrowing javax.net.ssl.SSLHandshakeException: null cert chain
  Stack Trace
  javax.net.ssl.SSLHandshakeException: null cert chain
      at sun.security.ssl.Handshaker.checkThrown(Handshaker.java:1521) ~[?:1.8.0_211]
      at sun.security.ssl.SSLEngineImpl.checkTaskThrown(SSLEngineImpl.java:528) ~[?:1.8.0_211]
      at sun.security.ssl.SSLEngineImpl.writeAppRecord(SSLEngineImpl.java:1197) ~[?:1.8.0_211]
      at sun.security.ssl.SSLEngineImpl.wrap(SSLEngineImpl.java:1165) ~[?:1.8.0_211]
      at javax.net.ssl.SSLEngine.wrap(SSLEngine.java:469) ~[?:1.8.0_211]
      ... 4 more
  Caused by: javax.net.ssl.SSLHandshakeException: null cert chain
      at sun.security.ssl.Alerts.getSSLException(Alerts.java:192) ~[?:1.8.0_211]
      at sun.security.ssl.SSLEngineImpl.fatal(SSLEngineImpl.java:1647) ~[?:1.8.0_211]
      at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:318) ~[?:1.8.0_211]
      at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:306) ~[?:1.8.0_211]
      at sun.security.ssl.ServerHandshaker.clientCertificate(ServerHandshaker.java:1939) ~[?:1.8.0_211]
      at sun.security.ssl.ServerHandshaker.processMessage(ServerHandshaker.java:232) ~[?:1.8.0_211]
      at sun.security.ssl.Handshaker.processLoop(Handshaker.java:1037) ~[?:1.8.0_211]
      at sun.security.ssl.Handshaker$1.run(Handshaker.java:970) ~[?:1.8.0_211]
      at sun.security.ssl.Handshaker$1.run(Handshaker.java:967) ~[?:1.8.0_211]
      at java.security.AccessController.doPrivileged(Native Method) ~[?:1.8.0_211]
      at sun.security.ssl.Handshaker$DelegatedTask.run(Handshaker.java:1459) ~[?:1.8.0_211]
      ... 2 more
  </code></pre>
  
  <p>This is <strong>not caused by a lack of certificates</strong>. Earlier in the debug, we see the following certificates, which are in the correct order for SSL (most specific first, root ca last):</p>
  
  <pre><code>upcoming handshake states: server finished[20]
  chain [0] = [
  [
    Version: V3
    Subject: CN=ABC
    ...
    Issuer: CN=DEF
    ...
  ]
  chain [1] = [
  [
    Version: V3
    Subject: CN=DEF
    ...
    Issuer: CN=GHI
    ...
  ]
  chain [2] = [
  [
    Version: V3
    Subject: CN=GHI
    ...
    Issuer: CN=GHI
    ...
  ]
  </code></pre>
  
  <p>So can someone tell me why this is occurring? Could it be that the client is rejecting the certificates?</p>
  
  <p>Note: the keys and certificates were provided by another party; I can't just generate my own.</p>