Mutual authentication failing with the error "javax.net.ssl.SSLPeerUnverifiedException: peer not authenticated"Issue <!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } When trying to setup mutual authentication customer could end up getting the error below. javax.net.ssl.SSLPeerUnverifiedException: peer not authenticated .......org.apache.commons.httpclient.HttpException: Session contains no certificates - Untrusted Release<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } Up to and including Zurich, and probably later. Cause<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } During TLS handshake for mutual authentication the instance initiates the process.The instance starts by sending ClientHello with contains parameters such as the TLS versions, cipher suites and signature algorithms that it supports alongside other information. See sample ClientHello payload below. The server then responds to the clientHello from the instance with a ServerHello. The ServerHello contains Server certificate, TLS version, cipher suite and most importantly "certificate request" alongside other information.In the "certificate request" in the ServerHello, has several attributes such as certificate types, signature algorithms and certificate authorities. See sample payload below. * Certificate types indicates that the certificate provided by the instance MUST contain a key that matches this entry * Signature algorithms contains a list of signature algorithms that the server is able to verify. Therefore the certificate configured on the instance MUST be signed using one of these signature algorithms. * Certificate authorities might be empty. However if it contains a list of distinguished names. These is a list of desired distinguished names for the root CA (certificate authority) or intermediate CA. Ensure that the certificate configured on the instance has one of the distinguished name as the CA. In the screenshot below we can see that "Distinguished Names Length" is zero. Which means that the server has not provided any preferred CA. The Server then sends ServerHelloDone to indicate end of ServerHello messages. See the screenshot above.In response to the "certificate request" the instance should send a certificate that matches the attributes specified by the servers' "certificate request" along side other information. In our case (see screenshot below) the instance did not find a certificate that matches the attributes that the server specified in the "certificate request". Therefore there is no certificate sent. We can see that "Certificates Length" is zero. Based on the above response to the "Certificate Request" that the server has received from the instance, the server will determine whether or not to establish the TLS session. If there is an issue with the certificate provided by the instance, the server responds with a TLS alert and mutual authentication will fail at this step. Since in step (6) above the instance did not send any certificate, the server terminated the connection. See sample failed connection below. For more information about the Certificate Request message see section 7.4.6 in RFC5246 Resolution<!-- /*NS Branding Styles*/ --> .ns-kb-css-body-editor-container { p { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } span { font-size: 12pt; font-family: Lato; color: var(--now-color--text-primary, #000000); } h2 { font-size: 24pt; font-family: Lato; color: var(--now-color--text-primary, black); } h3 { font-size: 18pt; font-family: Lato; color: var(--now-color--text-primary, black); } h4 { font-size: 14pt; font-family: Lato; color: var(--now-color--text-primary, black); } a { font-size: 12pt; font-family: Lato; color: var(--now-color--link-primary, #00718F); } a:hover { font-size: 12pt; color: var(--now-color--link-primary, #024F69); } a:target { font-size: 12pt; color: var(--now-color--link-primary, #032D42); } a:visited { font-size: 12pt; color: var(--now-color--link-primary, #00718f); } ul { font-size: 12pt; font-family: Lato; } li { font-size: 12pt; font-family: Lato; } img { display: ; max-width: ; width: ; height: ; } } The instruction provided in the documentation below in the step "Generate a Java keystore and key pair" generates an RSA key and a certificate signed with SHA265 RSA https://docs.servicenow.com/en-US/bundle/sandiego-platform-administration/page/administer/security/concept/c_MutualAuthentication.html Since SHA265 RSA is not in the list of signature hash algorithms provided in the "certificate request" in step (4) above, the TLS handshake will fail.To generate a certificate that will successfully match the response of the "certificate request" in step (4) above, we can use the keytool to generate a certificate that will match one of the signature hash algorithms in the "certificate request" such as SHA265 DSA. We can create a SHA265 DSA signed certificate by running the command below. keytool -genkey -alias mydomain -keyalg DSA -keystore my.keystore