What is the reason of this issue org.bouncycastle.tls.TlsFatalAlert

Question

What is the reason of this issue org.bouncycastle.tls.TlsFatalAlert,Client raised fatal(2) certificate_unknown(46) alert: Failed to read record org.bouncycastle.tls.TlsFatalAlert: certificate_unknown(46)

Provider: SecureRandom.null algorithm from: BCFIPS_RNG
Mon Mar 28 16:44:00.330 IST 2022 [main] [o.b.jsse.provider.ProvTlsClient: INFO ] - Client raised fatal(2) certificate_unknown(46) alert: Failed to read record
org.bouncycastle.tls.TlsFatalAlert: certificate_unknown(46)
    at org.bouncycastle.jsse.provider.ProvSSLSocketDirect.checkServerTrusted(ProvSSLSocketDirect.java:135)
    at org.bouncycastle.jsse.provider.ProvTlsClient$1.notifyServerCertificate(ProvTlsClient.java:360)

Answer 1

According to the source code, it is likely that you are not using a trusted CA certificate (or at least, your client program doesn't trust it). https://github.com/bcgit/bc-java/blob/master/tls/src/main/java/org/bouncycastle/jsse/provider/ProvSSLSocketDirect.java#L135 shows the trust store check failing.

This guide (and many others on sf) show how to register a trust store with your client SSL context: https://downloads.bouncycastle.org/fips-java/BC-FJA-(D)TLSUserGuide-1.0.9.pdf

import java.security.Security;
import javax.net.ssl.SSLContext;
import javax.net.ssl.SSLSocket;
import javax.net.ssl.SSLSocketFactory;
import javax.net.ssl.TrustManagerFactory;
import org.bouncycastle.jcajce.provider.BouncyCastleFipsProvider;
import org.bouncycastle.jsse.provider.BouncyCastleJsseProvider;
/**
* Basic SSL Client - using the '!' protocol.
*/
public class TLSClientExample
{
 public static void main(
 String[] args)
 throws Exception
 {
 Security.addProvider(new BouncyCastleFipsProvider()); // or use regular if not doing fips.
 Security.addProvider(new BouncyCastleJsseProvider());
 SSLContext sslContext = SSLContext.getInstance("TLS", "BCJSSE");
 TrustManagerFactory trustMgrFact = TrustManagerFactory.getInstance(
 "PKIX", "BCJSSE");
 trustMgrFact.init(Utils.createServerTrustStore()); // <--- a java keystore containing the X509 root CA certificate.
 sslContext.init(null, trustMgrFact.getTrustManagers(), null);
 SSLSocketFactory fact = sslContext.getSocketFactory();
 SSLSocket cSock = (SSLSocket)fact.createSocket(
 Utils.HOST, Utils.PORT_NO);

 Protocol.doClientSide(cSock);
 }
}