How to provide a DER server certificate file to Akka HTTP - scala

Question

I am trying to provide a server certificate file to my Akka HTTP application using the following code.
import java.io.{BufferedInputStream, IOException}
import java.security.{KeyStore, SecureRandom}
import java.security.cert.Certificate
import java.security.cert.CertificateFactory
import javax.net.ssl.{KeyManagerFactory, SSLContext, SSLSocketFactory, TrustManagerFactory}
import scala.util.Try
trait TLSSupport extends Logging {
// Add support for self-signed (local) SSL certificates
// Based on http://developer.android.com/training/articles/security-ssl.html#UnknownCa
def https(implicit configuration: Configuration): Either[Throwable, HttpsConnectionContext] = { // Load CAs from an InputStream
// (could be from a resource or ByteArrayInputStream or ...)
val cf = CertificateFactory.getInstance("X.509")
// From https://www.washington.edu/itconnect/security/ca/load-der.crt
configuration.config.get("certificate").map {
x =>
Try {
log.info(s"Retrieving resource ${x}")
import java.io.FileInputStream
val is = new FileInputStream(x)
log.info(s"Creating stream for resource ${x}")
val fis = new BufferedInputStream(is)
log.info(s"Generating Certificate ${x}")
val ca: Certificate = cf.generateCertificate(fis)
log.info(s"Loading keystore Certificate ${x}")
val keyStoreType = KeyStore.getDefaultType
val keyStore = KeyStore.getInstance(keyStoreType)
keyStore.load(null, null)
log.info(s"Adding certificate entry to keystore ")
keyStore.setCertificateEntry("ca", ca)
// Create a TrustManager that trusts the CAs in our KeyStore
val tmfAlgorithm = TrustManagerFactory.getDefaultAlgorithm
val tmf = TrustManagerFactory.getInstance(tmfAlgorithm)
tmf.init(keyStore)
// Create an SSLContext that uses our TrustManager
val sslContext = SSLContext.getInstance("TLS")
sslContext.init(null, tmf.getTrustManagers, null)
val https = ConnectionContext.httpsServer(sslContext)
https
}.toEither}.getOrElse(Left(throw new RuntimeException(s"Error loading TLS configuration")))
}
}
object Main extends App with Logging with TLSSupport {
def main: Future[Http.ServerBinding] = https.map {
case x: HttpsConnectionContext => log.info("Listening on secure port 8080."); Http().newServerAt("0.0.0.0", 8443).enableHttps(x).bind(routes)
case _ => log.warn(new RuntimeException("Error loading tls configuration").toString); Http().newServerAt("0.0.0.0", 8080).bind(routes)
} .getOrElse( {log.warn(new RuntimeException("Error loading tls configuration").toString); Http().newServerAt("0.0.0.0", 8080).bind(routes)} )
}
val server = new Application
server.main
}
No errors are thrown, but when it try to connect to the application locally, I get the followign error in openssl:
▶ curl --tlsv1.1 -vvv https://localhost:8443/api/umls/search\?searchString\=blood
* Trying 127.0.0.1:8443...
* Connected to localhost (127.0.0.1) port 8443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
* CAfile: /etc/ssl/cert.pem
* CApath: none
* (304) (OUT), TLS handshake, Client hello (1):
* (304) (IN), TLS handshake, Server hello (2):
* (304) (OUT), TLS handshake, Client hello (1):
* (304) (IN), TLS handshake, Server hello (2):
* (304) (IN), TLS handshake, Unknown (8):
* error:1404B410:SSL routines:ST_CONNECT:sslv3 alert handshake failure
* Closing connection 0
curl: (35) error:1404B410:SSL routines:ST_CONNECT:sslv3 alert handshake failure
Doesnt seem to be an issue with ssl versioning etc as i have tested on multiple systems. Frankly I always get very confused with encryption even after reading the documentation cant find something that fits this particular case where I need to provide a preexisting server certificate.