Receiving error when sending AS4 message: Cannot find key for certificate

[gnazaryan]

@phax When I use the Phase4 to send AS4 message I do receive error in an Envelope, that means the targeting AS4 server received the message.

The error message "Cannot find key for certificate" seams weird, it seams to be looking for the private keys of the sender and not finding it.

We have another AS4 client Domibus, which can successfully send an AS4 message, which means the receiving server is working fine.

I am using the below code for configuring the crypto.

Any ideas highly appreciated on why would the receiving server complain with error: Cannot find key for certificate

final AS4CryptoProperties aCP = new AS4CryptoProperties().setKeyStoreType(EKeyStoreType.JKS)
                .setKeyStorePath("keystore_path")
                .setKeyStorePassword("keystore_password"))
                .setKeyAlias(keyAlias)
                .setKeyPassword("_key_password");
        clientMessage.setAS4CryptoFactory(new AS4CryptoFactoryProperties(aCP));
        clientMessage.cryptParams().setAlias(aCP.getKeyAlias());

        clientMessage.signingParams()
                .setAlgorithmSign(ECryptoAlgorithmSign.RSA_SHA_256)
                .setAlgorithmSignDigest(ECryptoAlgorithmSignDigest.DIGEST_SHA_256);

        clientMessage.cryptParams().setAlgorithmCrypt(ECryptoAlgorithmCrypt.AES_128_GCM);

<?xml version="1.0" encoding="UTF-8"?>
<env:Envelope xmlns:env="http://www.w3.org/2003/05/soap-envelope">
  <env:Header>
    <eb:Messaging xmlns:eb="http://docs.oasis-open.org/ebxml-msg/ebms/v3.0/ns/core/200704/" env:mustUnderstand="true">
      <eb:SignalMessage>
        <eb:MessageInfo>
          <eb:Timestamp>2022-11-25T01:25:35.380Z</eb:Timestamp>
          <eb:MessageId>[email protected]</eb:MessageId>
          <eb:RefToMessageId>df92bfc0-e1d4-4bd8-b828-31a40b6dc875@phase4</eb:RefToMessageId>
        </eb:MessageInfo>
        <eb:Error category="PROCESSING" errorCode="EBMS:0103" origin="security" refToMessageInError="df92bfc0-e1d4-4bd8-b828-31a40b6dc875@phase4" severity="failure" shortDescription="PolicyNoncompliance">
          <eb:Description xml:lang="">The processor determined that the message's security methods, parameters, scope or other security policy-level requirements or agreements were not satisfied.</eb:Description>
          <eb:ErrorDetail>Cannot find key for certificate</eb:ErrorDetail>
        </eb:Error>
      </eb:SignalMessage>
    </eb:Messaging>
  </env:Header>
  <env:Body>
    <env:Fault>
      <env:Code>
        <env:Value>env:Receiver</env:Value>
      </env:Code>
      <env:Reason>
        <env:Text xml:lang="en">An error occurred while processing your request. Please check the message header for more details.</env:Text>
      </env:Reason>
    </env:Fault>
  </env:Body>
</env:Envelope>

[phax]

@gnazaryan can you please let me know, in what context you are trying to send messages? Peppol, CEF, ENTSOGG, SDG, ...???

If the error from the other side is "Cannot find key for certificate", it usually means, you are using the wrong public certificate to encrypt the message.

[gnazaryan]

@phax I have some more finding on this issue, what I could figure out is the remote as4 service is looking up for my private key, and that is why it is not able to find it, because it only has my public key the certificate correct?
I am wondering why is the remote as4 domibus service looking for my private key when I am reaching to it with Phase4 client, it should be good with my public key only right ? When I send AS4 message with my local domibus service, it responds without issue and in that case remote domibus service is not looking for my private key.

@phax Would you please suggest, should I configure the Phase4 client crypto properties in some way that it relaxes remote domibus service for requiring my private key, thanks!

[phax]

Regarding the signature and encryption it is as follows:

• When you send a message, you sign it with your private key. The receiver takes your public key (that is part of the message transmission) and checks if the signature is correct and that the provided certificate matches the constraints you have in your area. That means that the receiver knows that the sender is trusted.

• When you send a message, you encrypt it with the public key of the receiver (its your job to get it). Then only the receiver can decrypt the message with its private key. If you would send it to the wrong receiver, this wrong receiver would not be able to decrypt the message.

So for signing an outgoing message phase4 needs your private key AND the public key of the receiver.

You NEVER SHARE your private key.

I am wondering why is the remote as4 domibus service looking for my private key

I don't think this is the case

it should be good with my public key only right ?

correct

When I send AS4 message with my local domibus service, it responds without issue and in that case remote domibus service is not looking for my private key.

That depends on your setup. You can setup to 1. sign and encrypt, or 2. just sign or 3. just encrypt or 4. do neither nor. As stated above, dependning on what you need, your certificate needs change. The CEF profile usually requires to sign and encrypt.

When using the phase4 client, try installing an outgoingDumper in your build call. E.g. with an instance of AS4OutgoingDumperFileBased to write to a file. Then you can inspect the message and see how it looks like. If you receive from Domibus you can do the same with .incomingDumper using AS4IncomingDumperFileBased. Then you can see if the messages you send/receive and signed and encrypted "at all".

hth

[gnazaryan]

@phax Thanks for the hint:

So for signing an outgoing message phase4 needs your private key AND the public key of the receiver.

In this code fragment you can see I am using the '.setKeyAlias(keyAlias)' to set the alias, this would be the sender alias correct,
and later, below that 'clientMessage.cryptParams().setAlias(getConfig("recieverAlias"));' I am setting the same alias on the crypto params,
the later one must be the receivers alias correct, not the sender alias, otherwise it will use the sender certificate to encrypt the message content, but instead we need to use the receiver certificate to encrypt the message.
That is why the receiving end was complaining 'Cannot find key for certificate'

@phax I think it would make sense for the Phase4 to provide some interface for configuring these parameters, where it would be explicitly mentioned 'setReceiverAlias' and 'setSenderAlias', otherwise it is a bit confusing. Thanks!

final AS4CryptoProperties aCP = new AS4CryptoProperties().setKeyStoreType(EKeyStoreType.JKS)
                .setKeyStorePath("keystore_path")
                .setKeyStorePassword("keystore_password"))
                .setKeyAlias(keyAlias)
                .setKeyPassword("_key_password");
        clientMessage.setAS4CryptoFactory(new AS4CryptoFactoryProperties(aCP));
        clientMessage.cryptParams().setAlias(getConfig("recieverAlias")); <---- Set the receiver alias here

        clientMessage.signingParams()
                .setAlgorithmSign(ECryptoAlgorithmSign.RSA_SHA_256)
                .setAlgorithmSignDigest(ECryptoAlgorithmSignDigest.DIGEST_SHA_256);

        clientMessage.cryptParams().setAlgorithmCrypt(ECryptoAlgorithmCrypt.AES_128_GCM);

[phax]

@gnazaryan I am a bit confused. In the above example you use clientMessage and in the other example you use the builder. The "Builder"is meant to be an abstraction of the "ClientMessage"

By providing .cryptoFactory (as4CryptoFactory) you are exactly providing an implementation of IAS4CryptoFactory. And that interface offers all the methods you need to access your private key. The public key of the receiver may come from different sources - it's not necessarily inside the truststore - in Peppol it is e.g. retrieved from an SMP. That's why the Builder (below) has e.g. the method endpointDetailProvider so that you can provide the public certificate part of the receiver you want to send to.

Whenever it is about the "Key Store" it means the store that contains your private keys (for signing when sending, and for decrypting when receiving). The public (trusted) certificates of "the other side" is stored in a "Trust Store" (technically it is also a KeyStore) - usually the keystore has one entry, and the truststore has more then one entry.

hth

[gnazaryan]

@phax Right, first I attempted to use the clientMessage which ended up with the error 'Cannot find key for certificate', and then later as it led me to more research I used the Builder to send the message, which also resulted in 'Cannot find key for certificate'.

After your feedback about the receiver certificate I realized that I never used the receivers certificate and that led me to try setting the alias with the call 'clientMessage.cryptParams().setAlias(getConfig("recieverAlias"));' which made it work.

I understand the truststore is the most proper spot for the receiver certificates, but even I have it in the truststore, it can't find it seams.
I think the clientMessage interface works fine for me, maybe it would be a good idea to add a few methods on the AS4ClientUserMessage to restrict configuration of the aliases with some meaningful method names 'setReceiverAlias' and 'setSenderAlias' or maybe some other approaches could even be better., this is just a suggestion.

Thanks!

[gnazaryan]

@phax I am using the CEF one and also with just AS4ClientUserMessage both of them result same error. The CEF code you an see below
I use the same keystore with Domibus client and it successfully sends the payload to the remote server
Also I did set up a local domibus and Phase 4 is working with my local domibus successfully,

But when I use the same code to send a payload to a remote server, not managed by me, I get that error Cannot find key for certificate.

As I said the same keystore works to connect with Domibus Client to that remote server but phase 4 is receiving that error

Any help appreciated, thank you!

public void sendMessage2() throws SMPDNSResolutionException, Phase4Exception {
        ScopeManager.onGlobalBegin("my_test_id_123");
        final IAS4ClientBuildMessageCallback x1 = new IAS4ClientBuildMessageCallback ()
        {
            public void onAS4Message (final AbstractAS4Message <?> aMsg)
            {
                final AS4UserMessage aUserMsg = (AS4UserMessage) aMsg;
                System.out.println("Sending out AS4 message with message ID '" +
                        aUserMsg.getEbms3UserMessage ().getMessageInfo ().getMessageId () +
                        "'");
                System.out.println("Sending out AS4 message with conversation ID '" +
                        aUserMsg.getEbms3UserMessage ().getCollaborationInfo ().getConversationId () +
                        "'");
            }

            public void onSoapDocument (@Nonnull final Document aDoc)
            {
                if (false)
                    System.out.println("SOAP Document:\n" +
                            XMLWriter.getNodeAsString (aDoc, new XMLWriterSettings().setIndent (EXMLSerializeIndent.INDENT_AND_ALIGN)));
            }
        };
        String keyAlias = getConfigValue("key_alias");
        final AS4CryptoProperties aCP = new AS4CryptoProperties().setKeyStoreType(EKeyStoreType.JKS)
                .setKeyStorePath(getConfigValue("keystore_path"))
                .setKeyStorePassword(getConfigValue("keystore_password"))
                .setKeyAlias(keyAlias)
                .setKeyPassword(getConfigValue("key_password"));
        IAS4CryptoFactory as4CryptoFactory = new AS4CryptoFactoryProperties(aCP);
        final IParticipantIdentifier aReceiverID = new SimpleParticipantIdentifier (CAS4.FINAL_RECIPIENT, "urn:oasis:names:tc:ebcore:partyid-type:unregistered:C4");
        String sAS4MessageID = UUID.randomUUID() + "@phase4";
        final byte [] aPayloadBytes = SimpleFileIO.getAllFileBytes (new File(payload));
        final AbstractAS4UserMessageBuilder.ESimpleUserMessageSendResult eRes = Phase4CEFSender.builder ()
                .cryptoFactory (as4CryptoFactory)
                .httpRetrySettings (new HttpRetrySettings().setMaxRetries (0))
                .action ("submitMessage")
                .service ("{type_censored}", "{value_censored}")
                .senderParticipantID(new SimpleParticipantIdentifier(CAS4.ORIGINAL_SENDER, "urn:oasis:names:tc:ebcore:partyid-type:unregistered:C1"))
                .receiverParticipantID(aReceiverID)
                .fromPartyIDType (getConfigValue("party_id_type"))
                .fromPartyID (sender)
                .fromRole (CAS4.DEFAULT_INITIATOR_URL)
                .toPartyIDType (getConfigValue("party_id_type"))
                .toPartyID (responder)
                .toRole (CAS4.DEFAULT_RESPONDER_URL)
                .messageID (sAS4MessageID)
                .payload (Phase4OutgoingAttachment.builder ()
                        .data (aPayloadBytes)
                        .filename ("businessContentPayload")
                        .compressionGZIP ()
                        .mimeType (CMimeType.TEXT_XML)
                        .contentID ("eudamedxmlAttachment")
                        .build ())
                .buildMessageCallback (x1)
                .endpointDetailProvider (new AS4EndpointDetailProviderConstant(CertificateHelper.convertStringToCertficateOrNull ("-----BEGIN CERTIFICATE-----\n" +
                        "MIIGtjCCBZ6gAwIBAgIMLajMYDsu+8FgcvMcMA0GCSqGSIb3DQEBCwUAMFAxCzAJ\n" +
                        "BgNVBAYTAkJFMRkwFwYDVQQKExBHbG9iYWxTaWduIG52LXNhMSYwJAYDVQQDEx1H\n" +
                        "bG9iYWxTaWduIFJTQSBPViBTU0wgQ0EgMjAxODAeFw0yMjA4MDgwOTUxMDRaFw0y\n" +
                        "MzA5MDkwOTUxMDNaMH8xCzAJBgNVBAYTAkJFMSAwHgYDVQQIExdCcnVzc2Vscy1D\n" +
                        "YXBpdGFsIFJlZ2lvbjERMA8GA1UEBxMIQnJ1c3NlbHMxHDAaBgNVBAoTE0V1cm9w\n" +
                        "ZWFuIENvbW1pc3Npb24xHTAbBgNVBAMMFCouZXVzZnguZWMuZXVyb3BhLmV1MIIB\n" +
                        "IjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAs7Y5nEr9xxQQx1cE3z9gLnQf\n" +
                        "t4R0qMxXz/xBVPDnHfyfzPC7s8bXY3zkAm90J+n9a67GgWcrCp1Y1qJZnuFkhbeH\n" +
                        "Yu262uRP7o1LyPFnoFn4n0EThmrVGt+aEnxfBX8jttXN2HalefwC5CQ/9ufhd6P2\n" +
                        "q8GZ1d5cHWgDqsmWOclLx6R/SSJFIR1K4BgMGHwFYAd9pMo7hdc4XdCbhPIfJwHT\n" +
                        "QHMATvOsyNL/pfMpioGtQkd8Notr6pfCXKKzsCkVfhOzB62oc2ETkdki/1ViQu4o\n" +
                        "E4+o0YY/PvFXq57N8qhXSDrVEVjWwxnFwQSDx0AWxFiUaVk69BruTOEAoRElBwID\n" +
                        "AQABo4IDXzCCA1swDgYDVR0PAQH/BAQDAgWgMIGOBggrBgEFBQcBAQSBgTB/MEQG\n" +
                        "CCsGAQUFBzAChjhodHRwOi8vc2VjdXJlLmdsb2JhbHNpZ24uY29tL2NhY2VydC9n\n" +
                        "c3JzYW92c3NsY2EyMDE4LmNydDA3BggrBgEFBQcwAYYraHR0cDovL29jc3AuZ2xv\n" +
                        "YmFsc2lnbi5jb20vZ3Nyc2FvdnNzbGNhMjAxODBWBgNVHSAETzBNMEEGCSsGAQQB\n" +
                        "oDIBFDA0MDIGCCsGAQUFBwIBFiZodHRwczovL3d3dy5nbG9iYWxzaWduLmNvbS9y\n" +
                        "ZXBvc2l0b3J5LzAIBgZngQwBAgIwCQYDVR0TBAIwADA/BgNVHR8EODA2MDSgMqAw\n" +
                        "hi5odHRwOi8vY3JsLmdsb2JhbHNpZ24uY29tL2dzcnNhb3Zzc2xjYTIwMTguY3Js\n" +
                        "MDMGA1UdEQQsMCqCFCouZXVzZnguZWMuZXVyb3BhLmV1ghJldXNmeC5lYy5ldXJv\n" +
                        "cGEuZXUwHQYDVR0lBBYwFAYIKwYBBQUHAwEGCCsGAQUFBwMCMB8GA1UdIwQYMBaA\n" +
                        "FPjvf/LNeGeo3m+PJI2I8YcDArPrMB0GA1UdDgQWBBRsETqjQfl1K4VONKjl629m\n" +
                        "3RpM/jCCAX4GCisGAQQB1nkCBAIEggFuBIIBagFoAHcA6D7Q2j71BjUy51covIlr\n" +
                        "yQPTy9ERa+zraeF3fW0GvW4AAAGCfN2AXwAABAMASDBGAiEAw2FqjcGiYS8LwF9j\n" +
                        "4zZ/zYYpuO+YhAmU/PSuQrP3oEgCIQD2on1XKr9xVj015KBF1lGr25tTjAN20/bk\n" +
                        "XxssXKrtIQB1AG9Tdqwx8DEZ2JkApFEV/3cVHBHZAsEAKQaNsgiaN9kTAAABgnzd\n" +
                        "fgYAAAQDAEYwRAIgdNLCUL/NNXCo+AJxR9M7N/aDT4znzay/P7aiT9FpC5ECIGs9\n" +
                        "6A1K94YDboXdzI9UeNcQRfbTcXNNsSuO0ewD5ELpAHYAs3N3B+GEUPhjhtYFqdwR\n" +
                        "CUp5LbFnDAuH3PADDnk2pZoAAAGCfN1/JQAABAMARzBFAiEA9NQS20W2mIy95Lv+\n" +
                        "TxlOn6VjWUeDIvtAFhguiRTtO50CIGodolOw1ARFdo7k52Y4ZDzo8nlxKd5qXiWi\n" +
                        "I/EdF4W/MA0GCSqGSIb3DQEBCwUAA4IBAQCOARQ7jyCQ+cY8zVe75vPzfR1j3o0G\n" +
                        "XdjPGXUYCeLUhLs7r7thnfVOqYobzVzBHrYAt3M5nNJGq+du1e7sksepb22y7UyR\n" +
                        "zL8E028hBnL9lZWUmywWfKHNYieLToiNuL5qu1saL5BSTxuQrr1rTVWb7Nxuy1n7\n" +
                        "1UMdd02Q5+6tSrzWR8FxyTTuteCLSSp9IR8kmhXr0SYAZcOglRiWT7PpC/3sxv/n\n" +
                        "YTvQ7NRFb72nYOggLt36SU8YR63YL77Nk5P+ORZyzgNLafbgdcqWUxi4sCCYtaL+\n" +
                        "S2tzcV/EqipBqQctSlpdKaDE5c3o6MC2PREem37Li8hZHUipsiEcyEaI\n" +
                        "-----END CERTIFICATE-----\n"),
                        "{url_censored}"))
                .sendMessageAndCheckForReceipt ();
    }

[phax]

Okay, so you are trying to exchange messages in the context of EUDAMED.

My assumption is, that at least these values are invalid:

new SimpleParticipantIdentifier (CAS4.FINAL_RECIPIENT, "urn:oasis:names:tc:ebcore:partyid-type:unregistered:C4");

and

.senderParticipantID(new SimpleParticipantIdentifier(CAS4.ORIGINAL_SENDER, "urn:oasis:names:tc:ebcore:partyid-type:unregistered:C1"))

As I couldn't find a full AS4 profile of EUDAMED I found some "related" documents on https://health.ec.europa.eu/ and they made me provide a new submodule phase4-eudamed-client.

• I didn't release it yet, so you would need to switch your dependency to version 1.4.2-SNAPSHOT.
• Change your dependency from phase4-cef-client to phase4-eudamed-client
• Change CEFUserMessageBuilder to EudamedUserMessageBuilder
• Change .senderParticipantID(new SimpleParticipantIdentifier(CAS4.ORIGINAL_SENDER, "urn:oasis:names:tc:ebcore:partyid-type:unregistered:C1")) to .senderParticipantID("urn:oasis:names:tc:ebcore:partyid-type:unregistered:C1") (and similar to Receiver C4)