Hello,

I use Sun Application Server 8.
What I intend to do - generate new server key pair, then generate client key pair. Export client pair to IE & Netscape for mutual auth.

Command I use:

Server pair:
1. keytool -genkey -keyalg rsa -keystore keystore.jks -storepass pass -alias server -dname "cn=www.myCompany.com,o=O2,ou=Ou2,L=W,C=US,S=W "
2. keytool -export -alias server -file server.cer -keystore keystore.jks --storepass pass
3. keytool -noprompt -import -v -trustcacerts -file server.cer -alias server -keystore cacerts.jks -storepass pass2

Client pair:
1. keytool -genkey -keyalg rsa -keystore keystore.jks -storepass ssaperots -alias client -dname "cn=client1,o=O2,ou=Ou2,L=W,C=US,S=W"
2. keytool -export -alias client -file client.cer -keystore keystore.jks --storepass pass
3. keytool -noprompt -import -v -trustcacerts -file client.cer -alias client -keystore
cacerts.jks -storepass pass2

Now I replace domain1/config/cacerts.jks and domain1/config/keystore.jks with new files, restart the server.
Mutual auth with jax-rpc from j2ee tutorial works flawlessly.

Finally I want IE & Netscape to be able to do mutual auth:
Using jstk-1.0.1 from http://www.j2ee-security.net/book/dnldsrc/
jstk-1.0.1/bin/crypttool.sh export -keystore keystore.jks -alias client -storepass pass -outform PKCS12

I have client.p12 which I import into IE personal certificates.
Enter secure site on the server. Server cert is OK. I choose client1 pair for mutual auth.
Then I see in the browser: HTTP Status 403 - Access to the requested resource has been denied.
During the handshake in server.log I see:

[#|2004-06-02T01:12:42.496+0200|WARNING|j2ee-appserver1.4|org.apache.coyote.http11.Http11Proces sor|_ThreadID=11;|
Exception getting SSL Cert
java.net.SocketException: Socket Closed
..
a lot of stuff here
..
[at the end]
http1043-Processor3, handling exception: java.net.SocketTimeoutException: Read

I tries also additional java security package with JDK 1.5.0 beta to generate PKCS12 pair.
The same error diffrent exceptions.

In Netscape the same error.
Didn't try openssl yet.

Question:
1. Did I do something wrong ?
2. Is the PKCS12 file corrupted in some way ?
3. Is there a tutorial on how to do this ?

Thank You.