Using multiple SSL client certificates with the same host in Java

SSL can prompt the client for a certificate to display. This might allow you to use one keystore with multiple identities, but, unfortunately, most servers don't use this hinting feature. So it will be more robust if you specify a client certificate to use for each connection.

Here is sample code to set up SSLContextwith the specified identity and trust store . You can repeat these steps to create multiple contexts, one for each client certificate to be used. Everyone SSLContextmay use the same trust store, but a different identity store (containing a single client key entry to be used in that context).

Initialize the required context once, then reuse the correct context for each connection. If you want to establish multiple connections, you can take advantage of SSL sessions.

KeyManagerFactory kmf = 
  KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
kmf.init(identityStore, password);
TrustManagerFactory tmf =
  TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
tmf.init(trustStore);
SSLContext ctx = SSLContext.getInstance("TLS");
ctx.init(kmf.getKeyManagers(), tmf.getTrustManagers(), null);

Later, you can create the socket directly:

SSLSocketFactory factory = ctx.getSocketFactory();
Socket socket = factory.createSocket(host, port);

Or, if you're using a URLclass, you can specify SSLSocketFactorywhich to use when making HTTPS requests:

HttpsURLConnection con = (HttpsURLConnection) url.openConnection();
con.setSSLSocketFactory(ctx.getSocketFactory());

Java 6 has some additional APIs that make it easier to configure sockets based on your preferences for cipher suites etc.