# Error with Client Certificate Authentication **URL:** \ **Category:** Solace Event Broker\ **Tags:** failover, security\ **Created:** [April 7, 2020, 8:56pm UTC](https://community.solace.com/t/error-with-client-certificate-authentication/244 "2020-04-07T20:56:43Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![rdesoju](https://avatars.discourse-cdn.com/v4/letter/r/a4c791/32.png) [@rdesoju](https://community.solace.com/u/rdesoju)\ **Post date:** [April 7, 2020, 8:56pm UTC](https://community.solace.com/t/error-with-client-certificate-authentication/244/1 "2020-04-07T20:56:43Z")
Hi, I have enabled `authentication` for message-vpn to be `client-certificate` by following the instruction on the docs page. ```auto # commands used enable configure message-vpn authentication client-certificate validate-certificate-date allow-api-provided-username no shutdown ``` While using SDK Perf to test the SSL connectivity, seeing below error: ```auto JAVA: /bin/java SOLACE_VM_ARGS: -Xms512m -Xmx1024m Run Info: CPU usage currently disabled. Client naming used: logging ID = router generated. username = perf_client000001 vpn = default client names = sdk generated. > VM Name: OpenJDK 64-Bit Server VM Run Info: Using Java Nanosecond Timer for Timing > Timing Package Clock Speed (Hz): 1000000000 > Getting ready to init clients E: Initialization error: client creation failed. com.solacesystems.pubsub.sdkperf.core.PubSubException: Error while connecting. at com.solacesystems.pubsub.sdkperf.core.AbstractClientCollection.connect(AbstractClientCollection.java:449) at com.solacesystems.pubsub.sdkperf.SDKPerf_java.run(SDKPerf_java.java:183) at com.solacesystems.pubsub.sdkperf.SDKPerf_java.main(SDKPerf_java.java:117) Caused by: com.solacesystems.jcsmp.InvalidPropertiesException: Client Certificate Authenticate is supported only for SSL secured schemes at com.solacesystems.jcsmp.secure.SecureProperties.(SecureProperties.java:237) at com.solacesystems.jcsmp.JCSMPFactory.createSession(JCSMPFactory.java:163) at com.solacesystems.pubsub.sdkperf.jcsmpcore.JcsmpClient.connect(JcsmpClient.java:1084) at com.solacesystems.pubsub.sdkperf.core.AbstractClientCollection.connect(AbstractClientCollection.java:447) ... 2 more ``` Am I missing something, could someone please help? Thanks, Raghu ---
**Author:** ![uherbst](https://yyz1.discourse-cdn.com/solace/user_avatar/community.solace.com/uherbst/32/291_2.png) [@uherbst](https://community.solace.com/u/uherbst)\ **Post date:** [April 8, 2020, 4:01am UTC](https://community.solace.com/t/error-with-client-certificate-authentication/244/2 "2020-04-08T04:01:46Z")
The line with “Client Certificate Authenticate is supported only for SSL secured schemes” indicates, that you are not connecting to a SSL port (eg SMF over TLS or MQTT over TLS). What is your sdkperf-commandline ? What is the output of “show service” ? And always a good idea: Have a look at the broker event.log for any errors. ---
**Author:** ![TomF](https://yyz1.discourse-cdn.com/solace/user_avatar/community.solace.com/tomf/32/1749_2.png) [@TomF](https://community.solace.com/u/TomF)\ **Post date:** [April 8, 2020, 7:19am UTC](https://community.solace.com/t/error-with-client-certificate-authentication/244/3 "2020-04-08T07:19:56Z")
Hi @rdesoju, looks like you’re making progress, which is good. @uherbst has it right - you’re connecting to the unencrypted broker port. By default, if you specify just the broker address with the -cip option to sdkperf, it connects to port 55555 - the unencrypted broker port. Try -cip :55443 which is the default encrypted port. ---
**Author:** ![rdesoju](https://avatars.discourse-cdn.com/v4/letter/r/a4c791/32.png) [@rdesoju](https://community.solace.com/u/rdesoju)\ **Post date:** [April 8, 2020, 12:55pm UTC](https://community.solace.com/t/error-with-client-certificate-authentication/244/4 "2020-04-08T12:55:50Z")
Here is the command I’m using. Still seeing the same issue. ```auto #!/bin/bash broker_hosts=:55443,:55443 vpn= cert_keystore=./client.keystore keystore_pass= ./sdkperf_java.sh -cip=tcps://$broker_hosts -cu=@$vpn \ -pt1=ssl/topic -mn=10000 -stl=ssl/topic -q -md \ -sslks=$cert_keystore -sslksp=$ketystore_pass ``` Also, I tried with and without port number in -cip switch. Default and non-default port numbers both throw the same error. Here is the `show service` command output: ```auto Msg-Backbone: Enabled VRF: management SMF: Enabled Web-Transport: Enabled REST Incoming: Enabled REST Outgoing: Enabled MQTT: Enabled AMQP: Enabled Health-check: Enabled Mate-link: Enabled Redundancy: Enabled Max Incoming Connections: 100 Service SMF: 100 Service Web-Transport: 100 Service REST: 100 Service MQTT: 100 Service AMQP: 100 Max Outgoing Connections: Service REST: 100 Max SSL Connections: 100 Event Threshold Set Value Clear Value ---------------------------------- ---------------- ---------------- Incoming Connections 80%(80) 60%(60) Service SMF 80%(80) 60%(60) Outgoing Connections Service REST 80%(80) 60%(60) SSL Connections 80%(80) 60%(60) Flags Legend: TP - Transport T+U - TCP and UDP ---Press any key to continue, or `q' to quit--- S - SSL (Y=Yes, N=No, -=not-applicable) C - Compressed (Y=Yes, N=No, -=not-applicable) R - Routing Ctrl (Y=Yes, N=No, -=not-applicable) VRF - VRF (Mgmt=management, MsgBB=msg-backbone) A - Admin State (U=Up, D=Down, -=not-applicable) O - Oper State (U=Up, D=Down, -=not-applicable) Status Service TP S C R VRF MsgVpn Port A O Failed Reason ---------- --- ----- ----- --------------- ----- --- -------------------------- SEMP TCP N - - Mgmt 8080 U U SEMP TCP Y - - Mgmt 943 U U SMF TCP N N N Mgmt 55555 U U SMF TCP N Y N Mgmt 55003 U U SMF TCP N N Y Mgmt 55556 U D SMF TCP Y N N Mgmt 55443 U U SMF WEB N - - Mgmt 80 U U SMF WEB Y - - Mgmt 443 U U MQTT TCP N - - Mgmt default 1883 U U MQTT TCP Y - - Mgmt default 8883 U U MQTT WEB N - - Mgmt default 8000 U U MQTT WEB Y - - Mgmt default 8443 U U AMQP TCP N - - MsgBB default 5672 U U AMQP TCP Y - - MsgBB default 5671 U U REST WEB N - - Mgmt default 9000 U U REST WEB Y - - Mgmt default 9443 U U MATELINK TCP N N N Mgmt 8741 U U HEALTHCHK TCP N N N Mgmt 5550 U U REDUNDANCY TCP Y N N Mgmt 8300 U U REDUNDANCY T+U Y N N Mgmt 8301 U U REDUNDANCY T+U Y N N Mgmt 8302 U U ``` Thanks, Raghu ---
**Author:** ![rdesoju](https://avatars.discourse-cdn.com/v4/letter/r/a4c791/32.png) [@rdesoju](https://community.solace.com/u/rdesoju)\ **Post date:** [April 8, 2020, 6:11pm UTC](https://community.solace.com/t/error-with-client-certificate-authentication/244/5 "2020-04-08T18:11:03Z")
Above mentioned SDK Perf command is working when the `-cip` switch is proivided with only one IP Address and port number `broker_hosts=:55443`. However, if I give two ips and ports as mentioned initially it is still failing with the same error. Also, when I add below properties in my java smf code, it is still failing with same error as mentioned above: ```auto properties.setProperty(JCSMPProperties.HOST, "ip:55443"); properties.setProperty(JCSMPProperties.AUTHENTICATION_SCHEME, JCSMPProperties.AUTHENTICATION_SCHEME_CLIENT_CERTIFICATE); properties.setProperty(JCSMPProperties.SSL_VALIDATE_CERTIFICATE, true); properties.setProperty(JCSMPProperties.SSL_VALIDATE_CERTIFICATE_DATE, false); properties.setProperty(JCSMPProperties.SSL_TRUST_STORE, "./cacerts"); properties.setProperty(JCSMPProperties.SSL_TRUST_STORE_PASSWORD, ); properties.setProperty(JCSMPProperties.SSL_KEY_STORE, "./client.keystore"); properties.setProperty(JCSMPProperties.SSL_KEY_STORE_PASSWORD, ); ``` So, only SDK Perf is working with single IP and port combination right now. Please help. Thanks, Raghu ---
**Author:** ![rdesoju](https://avatars.discourse-cdn.com/v4/letter/r/a4c791/32.png) [@rdesoju](https://community.solace.com/u/rdesoju)\ **Post date:** [April 8, 2020, 7:58pm UTC](https://community.solace.com/t/error-with-client-certificate-authentication/244/6 "2020-04-08T19:58:22Z")
After some trail and error, I figured it out that java code needs HOST parameter in below format: ```auto properties.setProperty(JCSMPProperties.HOST, "tcps://:55443"); ``` So, How do we mention multiple hosts? does `tcps://:55443,tcps://:55443` this work?