3805015 - BCJSSE client fails with handshake_failure(40) when IAS requests a client certificate during TLS 1.2 renegotiation

A client using the Bouncy Castle JSSE (BCJSSE) provider fails to establish certificate-based authentication with SAP Cloud Identity Services - Identity Authentication.

The initial TLS 1.2 handshake completes successfully. However, when Identity Authentication subsequently requests a client certificate by initiating TLS renegotiation, the BCJSSE client terminates the connection.

The client log may contain an error similar to:

org.bouncycastle.tls.TlsFatalAlertReceived: handshake_failure(40)

or:

com.sap.cloud.security.xsuaa.client.OAuth2ServiceException:

Unexpected error retrieving JWT token:

org.bouncycastle.tls.TlsFatalAlertReceived: handshake_failure(40)

The issue can occur, for example, when a BCJSSE-based application calls an Identity Authentication OAuth endpoint such as:

/oauth2/token

and client-certificate authentication is requested during the TLS connection.

The initial TLS connection itself may appear successful and the failure can occur only when the HTTP response is being processed.

SAP Cloud Identity Services - Identity Authentication

TLS 1.2

Client applications using the Bouncy Castle JSSE (BCJSSE) TLS provider

Certificate-based client authentication / mutual TLS scenarios in which the client certificate is requested during TLS renegotiation

BCJSSE, Bouncy Castle, BouncyCastle, Bouncy Castle JSSE, TlsFatalAlertReceived, handshake_failure, handshake_failure(40), TLS handshake, TLS 1.2, TLS renegotiation, server initiated renegotiation, server-initiated renegotiation, secure renegotiation, RFC 5746, renegotiation_info, 65281, 0xff01, HelloRequest, CertificateRequest, client certificate, client certificate authentication, mutual TLS, mTLS, OAuth, oauth2/token, IAS, Identity Authentication, SAP Cloud Identity Services, acceptRenegotiation, org.bouncycastle.jsse.client.acceptRenegotiation, certificate popup, no certificate popup, no popup , KBA , BC-IAM-IDS , Identity Authentication Service , Problem