Myujth

I need a simple, embedded HTTPS server (preferably com.sun.net.httpserver.HttpsServer) that listens on multiple interfaces and uses the correct certificate per interface.

Luckily, the IP of each interface corresponds to a unique DNS name. In other words DNS reverse lookup returns the correct CN for the certificate to be used and SNI (Server Name Indication) is not required.

In the first step, I followed this answer to include the HTTPS server into my application. My certificates are signed using a chain of two intermediate CAs and a final root CA. E.g. the chain of trust looks like

certForInterfaceA --
 +-- intermediateCA1 -- intermediateCA2 -- rootCA
certForInterfaceB --/

Everything works fine, if I modify my code such that the HTTPS server only listens to a specific interface and if I exclusively put the corresponding certificate (together with its private key and the chain) into the keystore as a single PrivateKey entry.

I hoped that everything would still work if the HTTPS server listened to the wildcard address and if the keystore had two PrivateKey entries, one for each interface. I hoped that the Java library would figure out by itself what the correct certificate is to be sent back to the client depending on the request.

Unfortunately, tests show an unreliable and unpredictable behavior. It seems as if the library picks one of the keys randomly. E.g. I get an certificate error due to a name mismatch in half of the cases.

I tried to look at the Java Reference for javax.net.ssl and at the Java Security Guide and to figure out what I might miss. I thought there should be a way to hook into the library to provide the correct key while the SSL session is going to be established. But I was lost. I did not even understand how the individual classes (HttpsServer, SSLContext, SSLSession, TrustManager, KeyManager) interact with each other and what the correct place is to select the correct certificate depending on the request. The whole doc is this kind of "get-a-factory-for-a-provider-that-gives-you-a-strategy-for-a-factory-for-your-object"-style that I do not get it.