# Issue while running tls-full sample **URL:** \ **Category:** Community Support\ **Tags:** security\ **Created:** [April 25, 2022, 12:30pm UTC](https://community.temporal.io/t/issue-while-running-tls-full-sample/4533 "2022-04-25T12:30:51Z")\ **Posts on this page:** 5\ **Page:** 1
**Author:** ![Ruchir](https://sea2.discourse-cdn.com/flex016/user_avatar/community.temporal.io/ruchir/32/6141_2.png) [@Ruchir](https://community.temporal.io/u/Ruchir)\ **Post date:** [April 25, 2022, 12:30pm UTC](https://community.temporal.io/t/issue-while-running-tls-full-sample/4533/1 "2022-04-25T12:30:51Z")
Hi, Facing an issue while running tls-full sample([samples-server/tls/tls-full at main · temporalio/samples-server · GitHub](https://github.com/temporalio/samples-server/tree/main/tls/tls-full)). Steps followed as below: 1. I have generated the certificates using the given generate-certs.sh script and started temporal with start-temporal.sh script. 2. Added “server-root-ca.pem” certificate in cacerts using below command : keytool -trustcacerts -keystore cacerts -storepass changeit -importcert -alias \ -file \ 3. While running HelloActivity Workflow, trying to create service stubs as below: ```auto InputStream clientCert1 = new FileInputStream(getFile("client-accounting-namespace.pfx")); // Create SSL enabled client by passing SslContext, created by SimpleSslContextBuilder. WorkflowServiceStubs service = WorkflowServiceStubs.newInstance( WorkflowServiceStubsOptions.newBuilder() .setSslContext(SimpleSslContextBuilder.forPKCS12(clientCert1).build()) .build()); ``` Getting below error: **Client logs:** ```auto Caused by: javax.net.ssl.SSLException: error:10000412:SSL routines:OPENSSL_internal:SSLV3_ALERT_BAD_CERTIFICATE at io.grpc.netty.shaded.io.netty.handler.ssl.ReferenceCountedOpenSslEngine.shutdownWithError(ReferenceCountedOpenSslEngine.java:1071) at io.grpc.netty.shaded.io.netty.handler.ssl.ReferenceCountedOpenSslEngine.sslReadErrorResult(ReferenceCountedOpenSslEngine.java:1365) at io.grpc.netty.shaded.io.netty.handler.ssl.ReferenceCountedOpenSslEngine.unwrap(ReferenceCountedOpenSslEngine.java:1305) at io.grpc.netty.shaded.io.netty.handler.ssl.ReferenceCountedOpenSslEngine.unwrap(ReferenceCountedOpenSslEngine.java:1392) at io.grpc.netty.shaded.io.netty.handler.ssl.ReferenceCountedOpenSslEngine.unwrap(ReferenceCountedOpenSslEngine.java:1435) at io.grpc.netty.shaded.io.netty.handler.ssl.SslHandler$SslEngineType$1.unwrap(SslHandler.java:221) at io.grpc.netty.shaded.io.netty.handler.ssl.SslHandler.unwrap(SslHandler.java:1341) at io.grpc.netty.shaded.io.netty.handler.ssl.SslHandler.decodeJdkCompatible(SslHandler.java:1234) at io.grpc.netty.shaded.io.netty.handler.ssl.SslHandler.decode(SslHandler.java:1283) at io.grpc.netty.shaded.io.netty.handler.codec.ByteToMessageDecoder.decodeRemovalReentryProtection(ByteToMessageDecoder.java:507) at io.grpc.netty.shaded.io.netty.handler.codec.ByteToMessageDecoder.callDecode(ByteToMessageDecoder.java:446) ... 17 more Caused by: io.grpc.netty.shaded.io.netty.handler.codec.DecoderException: javax.net.ssl.SSLException: error:10000412:SSL routines:OPENSSL_internal:SSLV3_ALERT_BAD_CERTIFICATE Caused by: javax.net.ssl.SSLException: error:10000412:SSL routines:OPENSSL_internal:SSLV3_ALERT_BAD_CERTIFICATE ``` **Temporal Server logs:** ```auto temporal_1 | {"level":"warn","ts":"2022-04-25T08:59:29.190Z","msg":"cannot find a per-host provider for attempted incoming TLS connection. returning default TLS configuration","server-name":"","address":"192.168.160.1:56434","logging-call-at":"localStoreTlsProvider.go:271"} ``` 1. In the above code, the “clientCert1” being passed is “client-accounting-namespace.pfx”. Is this correct? If I want to build SSLContext using PKCS8, then should I use “client-accounting-namespace.pem” or “client-accounting-namespace-chain.pem”? 2. Also, need a clear understanding of whether the accounting and development indicating 2 different clients or 2 different namespaces? Why do we have multiple CLIs in docker-compose.yaml? 3. In docker-compose.yaml, there is no env variable mentioned for client’s ca certificate. Could this be the reason for the above error? Also, which client ca certificate should be mentioned? client Root ca or client intermediate ca? ---
**Author:** ![tihomir](https://sea2.discourse-cdn.com/flex016/user_avatar/community.temporal.io/tihomir/32/6580_2.png) [@tihomir](https://community.temporal.io/u/tihomir)\ **Post date:** [April 25, 2022, 9:09pm UTC](https://community.temporal.io/t/issue-while-running-tls-full-sample/4533/3 "2022-04-25T21:09:17Z")
> If I want to build SSLContext using PKCS8 currently the certificates built in this repo are PKCS1 and not PKCS8, see open issue [here](https://github.com/temporalio/samples-server/issues/28). 1. Two different clients that have different server names 2. Yes, the sample is really not meant to be used with Java SDK locally to do an end-to-end test. It’s there more as example for configuration. We will work on this. Your code looks correct, [here](https://github.com/temporalio/samples-java/blob/main/src/main/java/io/temporal/samples/ssl/SslEnabledWorker.java) is full sample. Once the issue for generating PKCS8 is fixed we can update the sample to allow to be tested by Java SDK. ---
**Author:** ![tihomir](https://sea2.discourse-cdn.com/flex016/user_avatar/community.temporal.io/tihomir/32/6580_2.png) [@tihomir](https://community.temporal.io/u/tihomir)\ **Post date:** [April 25, 2022, 9:26pm UTC](https://community.temporal.io/t/issue-while-running-tls-full-sample/4533/4 "2022-04-25T21:26:29Z")
We also opened [this](https://github.com/temporalio/samples-server/issues/29) issue recently, just fyi. You can set for example: export SERVER\_TAG=1.15.2 in `start-temporal.sh` to specify a version \< 1.16.0 ---
**Author:** ![tihomir](https://sea2.discourse-cdn.com/flex016/user_avatar/community.temporal.io/tihomir/32/6580_2.png) [@tihomir](https://community.temporal.io/u/tihomir)\ **Post date:** [April 26, 2022, 1:06am UTC](https://community.temporal.io/t/issue-while-running-tls-full-sample/4533/5 "2022-04-26T01:06:50Z")
[PR](https://github.com/temporalio/samples-server/pull/31) for PKCS8 cert generation. I tested with this PR locally, and was able to run workflows in both “tls-simple” and “tls-full” via: ```auto service = WorkflowServiceStubs.newInstance( WorkflowServiceStubsOptions.newBuilder() .setSslContext( SimpleSslContextBuilder.forPKCS8(CLIENT_CERT, CLIENT_KEY) .setUseInsecureTrustManager(true) ``` (where CLIENT\_CERT is the generated client.pem, and CLIENT\_KEY is the generated client.key) Note that `setUseInsecureTrustManager` is needed still, trying to fix the “CN” values of the generated certificates so it works without it, but for now it should do the trick. ---
**Author:** ![spikhalskiy](https://sea2.discourse-cdn.com/flex016/user_avatar/community.temporal.io/spikhalskiy/32/1250_2.png) [@spikhalskiy](https://community.temporal.io/u/spikhalskiy)\ **Post date:** [September 20, 2022, 8:47pm UTC](https://community.temporal.io/t/issue-while-running-tls-full-sample/4533/7 "2022-09-20T20:47:43Z")
Faced the same exact problem and error. In my case it was caused by an expired client CA certificate registered with the Temporal Server.