My Tech Blog

In addition to the standard X509 *.cer certificates there are also certificate files ending with *.PFX or *.P12. The later ones are X509 certs as well, but may in addition contain a private key, too.   PFX was a Microsoft extension, while P12 was the Netscape one. Generating from Scratch using OpenSSL 1. Generate a 2048-bit RSA private key $ openssl genrsa -out private_key.pem 2048 This will generate a key file in traditional key format also called ssLeay private key format. 2. Convert private Key to PKCS#8 format (so Java can read it) $ openssl pkcs8 -topk8 -inform PEM -outform DER -in private_key.pem -out private_key.der -nocrypt 3. Output public key portion in DER format (so Java can read it) $ openssl rsa -in private_key.pem -pubout -outform DER -out public_key.der Generating from the .p12 File Private key: openssl pkcs12 -in   yourP12File.pfx   -nocerts -out   privateKey.pem This will generate the private key alone...

First of all the JVM Needs to start in the Debug mode as many servers report the errors vaguely. It is better to start in Debug mode Add the JVM parameter -Djavax.net.debug=all After that before Even trying to run the transaction try to connect the server with the certificate using openssl openssl s_client -showcerts -connect 10.24.256.69:443 If the certificate is present it shows the last statement as Verify return code: 0 (ok) Check the link below for a more detailed tutorial. http://www.cyberciti.biz/faq/test-ssl-certificates-diagnosis-ssl-certificate/ If for some reason is receiving an error OpenSSL: socket: Connection refused connect:errno=111 It means that the PORT might be wrong in the connection. So we need to find the right port on which https is running. This can be done using nmap So what u do is nmap -sS 10.24.256.69 sample output for above command  Host is up (0.0051s latency). Not shown: 999 closed ports PORT    STATE ...