Setting up TLS mutual authentication fails according to the documentation

[larychen]

Generated server and client certificates according to the documentation:
In the console, the server certificate and root certificate have been configured, and client verification has been enabled.

Using the MQTTX tool with the client certificate and root certificate configured, the connection is successful.

However, using the Java Paho client, the setup fails when following the example:

` Security.addProvider(new BouncyCastleProvider());

    // Load CA certificates
    KeyStore caKs = loadCAKeyStore(caCrtFile);

    // Load client certificate chain and key
    KeyStore ks = KeyStore.getInstance(KeyStore.getDefaultType());
    ks.load(null, null);

    // Load the entire client certificate chain
    Certificate[] chain;
    try (FileInputStream fis = new FileInputStream(crtFile)) {
        CertificateFactory cf = CertificateFactory.getInstance("X509");
        Collection<? extends Certificate> certs = cf.generateCertificates(fis);
        chain = certs.toArray(new Certificate[0]);
    }

    // Load client private key
    try (PEMParser pemParser = new PEMParser(new FileReader(keyFile))) {
        Object object = pemParser.readObject();
        JcaPEMKeyConverter converter = new JcaPEMKeyConverter().setProvider("BC");
        PrivateKey key = converter.getPrivateKey((PrivateKeyInfo) object);
        ks.setKeyEntry("private-key", key, password.toCharArray(), chain);
    }

    // Set up key managers and trust managers
    TrustManagerFactory tmf = TrustManagerFactory.getInstance("X509");
    tmf.init(caKs);
    KeyManagerFactory kmf = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
    kmf.init(ks, password.toCharArray());

    // finally, create SSL socket factory
    SSLContext context = SSLContext.getInstance("TLSv1.2");
    context.init(kmf.getKeyManagers(), tmf.getTrustManagers(), null);

    return context.getSocketFactory();`

I have repeatedly checked, and the certificate paths are correct.
Is there any way to handle this?

---

Translated Screenshots

Screenshot 1 Translation:
Here's the translation of the Chinese text in the image:

• 验证客户端证书: Verify Client Certificate
• 文件路径: File Path
• 重新: Reload / Reset (This appears multiple times, likely as a button label for "Reload" or "Reset")
• SSL 版本: SSL Version
• 没有证书则 SSL 失败: SSL fails without a certificate
• CA 证书深度: CA Certificate Depth
• 启用 OCSP Stapling: Enable OCSP Stapling
• 启用 CRL 检查: Enable CRL Check
• 密钥文件密码: Key File Password

Screenshot 2 Translation:
测试环境 - Test Environment

---

This issue was automatically translated from Chinese.

[Kiki513H]

最后怎么解决的 这种方式连接不成功 就得通过Ng 不通过Ng 是没办法成功的