certificate_unknown(46)

[MakakWasTaken]

Hey there,

I recently started receiving the error:

Caused by: org.bouncycastle.tls.TlsFatalAlert: certificate_unknown(46)
        at org.bouncycastle.tls.TlsUtils.checkTlsFeatures(TlsUtils.java:4758)
        at org.bouncycastle.tls.TlsUtils.processServerCertificate(TlsUtils.java:4832)
        at org.bouncycastle.tls.TlsClientProtocol.handleServerCertificate(TlsClientProtocol.java:786)
        at org.bouncycastle.tls.TlsClientProtocol.receive13ServerCertificate(TlsClientProtocol.java:1574)
        at org.bouncycastle.tls.TlsClientProtocol.handle13HandshakeMessage(TlsClientProtocol.java:160)
        at org.bouncycastle.tls.TlsClientProtocol.handleHandshakeMessage(TlsClientProtocol.java:360)
        at org.bouncycastle.tls.TlsProtocol.processHandshakeQueue(TlsProtocol.java:708)
        at org.bouncycastle.tls.TlsProtocol.processRecord(TlsProtocol.java:584)
        at org.bouncycastle.tls.RecordStream.readRecord(RecordStream.java:245)
        at org.bouncycastle.tls.TlsProtocol.safeReadRecord(TlsProtocol.java:856)
        at org.bouncycastle.tls.TlsProtocol.blockForHandshake(TlsProtocol.java:417)
        at org.bouncycastle.tls.TlsClientProtocol.connect(TlsClientProtocol.java:88)
        at org.bouncycastle.jsse.provider.ProvSSLSocketWrap.startHandshake(ProvSSLSocketWrap.java:620)
        at org.bouncycastle.jsse.provider.ProvSSLSocketWrap.startHandshake(ProvSSLSocketWrap.java:596)
        at org.apache.hc.client5.http.ssl.SSLConnectionSocketFactory.executeHandshake(SSLConnectionSocketFactory.java:303)
        at org.apache.hc.client5.http.ssl.SSLConnectionSocketFactory.createLayeredSocket(SSLConnectionSocketFactory.java:275)
        at org.apache.hc.client5.http.ssl.SSLConnectionSocketFactory.connectSocket(SSLConnectionSocketFactory.java:251)
        at org.apache.hc.client5.http.impl.io.DefaultHttpClientConnectionOperator.connect(DefaultHttpClientConnectionOperator.java:181)
        at org.apache.hc.client5.http.impl.io.PoolingHttpClientConnectionManager.connect(PoolingHttpClientConnectionManager.java:447)
        at org.apache.hc.client5.http.impl.classic.InternalExecRuntime.connectEndpoint(InternalExecRuntime.java:162)
        at org.apache.hc.client5.http.impl.classic.InternalExecRuntime.connectEndpoint(InternalExecRuntime.java:172)
        at org.apache.hc.client5.http.impl.classic.ConnectExec.execute(ConnectExec.java:142)
        at org.apache.hc.client5.http.impl.classic.ExecChainElement.execute(ExecChainElement.java:51)
        at org.apache.hc.client5.http.impl.classic.ProtocolExec.execute(ProtocolExec.java:192)
        at org.apache.hc.client5.http.impl.classic.ExecChainElement.execute(ExecChainElement.java:51)
        at org.apache.hc.client5.http.impl.classic.HttpRequestRetryExec.execute(HttpRequestRetryExec.java:96)
        at org.apache.hc.client5.http.impl.classic.ExecChainElement.execute(ExecChainElement.java:51)
        at org.apache.hc.client5.http.impl.classic.ContentCompressionExec.execute(ContentCompressionExec.java:152)
        at org.apache.hc.client5.http.impl.classic.ExecChainElement.execute(ExecChainElement.java:51)
        at org.apache.hc.client5.http.impl.classic.RedirectExec.execute(RedirectExec.java:115)
        at org.apache.hc.client5.http.impl.classic.ExecChainElement.execute(ExecChainElement.java:51)
        at org.apache.hc.client5.http.impl.classic.InternalHttpClient.doExecute(InternalHttpClient.java:170)
        at org.apache.hc.client5.http.impl.classic.CloseableHttpClient.execute(CloseableHttpClient.java:245)
        at org.apache.hc.client5.http.impl.classic.CloseableHttpClient.execute(CloseableHttpClient.java:188)
        at com.helger.httpclient.HttpClientManager.execute(HttpClientManager.java:137)
        at com.helger.httpclient.HttpClientManager.execute(HttpClientManager.java:102)
        at com.helger.phase4.messaging.http.BasicHttpPoster.sendGenericMessage(BasicHttpPoster.java:201)
        at com.helger.phase4.messaging.http.BasicHttpPoster.sendGenericMessageWithRetries(BasicHttpPoster.java:318)
        at com.helger.phase4.client.AbstractAS4Client.sendMessageWithRetries(AbstractAS4Client.java:558)
        at com.helger.phase4.sender.AS4BidirectionalClientHelper.sendAS4UserMessageAndReceiveAS4SignalMessage(AS4BidirectionalClientHelper.java:140)
        at com.helger.phase4.sender.AbstractAS4UserMessageBuilderMIMEPayload.mainSendMessage(AbstractAS4UserMessageBuilderMIMEPayload.java:220)
        ... 43 more

I was wondering if anyone had experienced the same issue and could elaborate a bit on what the message involves. From what I have been able to read about the error it is caused by the inability to perform the TLS handshake. I do however not know what prevents it from doing so.
I have tried researching the general error, but have not been able to find any solutions.

        <dependency>
            <groupId>org.bouncycastle</groupId>
            <artifactId>bcjmail-jdk15on</artifactId>
            <version>${bouncycastle.version}</version>
        </dependency>
        <dependency>
            <groupId>org.bouncycastle</groupId>
            <artifactId>bctls-jdk15on</artifactId>
            <version>${bouncycastle.version}</version>
        </dependency>
        <dependency>
            <groupId>org.bouncycastle</groupId>
            <artifactId>bcprov-jdk15on</artifactId>
            <version>${bouncycastle.version}</version>
        </dependency>
        <dependency>
            <groupId>org.bouncycastle</groupId>
            <artifactId>bcpkix-jdk15on</artifactId>
            <version>${bouncycastle.version}</version>
        </dependency>

OBS. bouncycastle.version is 1.70. I am also using phase4 v3.0.1.

I will happily provide any additional code, just let me know :)

[phax]

According to https://stackoverflow.com/questions/57556909/ssl-alert-number-46-alert-certificate-unknown-how-to-ignore-this-exceptions this seems to be an issue with the truststore???? Please try and check the truststore you use for the TLS connection

[MakakWasTaken]

This is the configuration I use for my TLS.

    public Phase4ENTSOGHttpClientSettings() throws GeneralSecurityException {
        // CEF requires TLS v1.2
        final SSLContext aSSLContext = SSLContext.getInstance(ETLSVersion.TLS_12.getID());
        // But we're basically trusting all hosts - the exact list is hard to
        // determine
        aSSLContext.init(null, new TrustManager[] { new TrustManagerTrustAll(false) }, null);
        setSSLContext(aSSLContext);

        // Set an explicit user agent
        setUserAgent(CAS4.LIB_NAME + "/" + CAS4Version.BUILD_VERSION + " " + CAS4.LIB_URL);
    }

I have also tried enabling debug for the TrustManager, but did not see any more changes.

This is a more complete version of the error:
[client #23 @186c3e65] raised fatal(2) certificate_unknown(46) alert: Failed to read record

[MakakWasTaken]

I have found out what the reason for the error was. I was getting the error because of the way I was setting up my BouncyCastleProvider:

Before:

Security.insertProviderAt(new BouncyCastleProvider(), 2);
Security.insertProviderAt(new BouncyCastleJsseProvider(), 3);

After (Working):

Security.insertProviderAt(new BouncyCastleProvider(), 2);
// Security.insertProviderAt(new BouncyCastleJsseProvider(), 3);

Removing the BouncyCastleJsseProvider resolved the issue. To my understanding this provider is however required in order to use the BDEW profile. So if someone has a workaround for this issue I would be grateful.

[phax]

As these security providers are gloabl, the only solution I see is to use 2 different instances of phase4 for different profiles (evtl. running in different JDKs)