TlsConnector adds certificate chain from PKCS12 identity in reverse order

[ancwrd1]

Using native-tls 0.2.1 on Linux (openssl).

When building TlsConnector with pkcs12 identity which contains 3 certificates: [leaf, intermediate, root] the intermediate and root certificates are sent to the server peer in reverse order [leaf, root, intermediate] resulting in handshake errors (in particular the javax.net.ssl.SSLException: subject/issuer name chaining check failed).

[sfackler]

What order are the certificates stored in the PKCS12 file?

[ancwrd1]

If I dump it with keytool the order is correct:
Certificate[1]: leaf
Certificate[2]: intermediate
Certificate[3]: root

It also works fine with Java TLS client or for example with openssl s_client command when exported into pem file (openssl pkcs12 -in identity.p12 -out server.pem -nodes) and the pem file has it listed in proper order as well: [private key, leaf, intermediate, root].

[sfackler]

#111 should fix this - could you try it out to confirm?

[ancwrd1]

#111 should fix this - could you try it out to confirm?

I think it's only implemented for TlsAcceptor in this PR, should be also changed for TlsConnector. When I change it manually it works, yes.

[sfackler]

Great! I'll cut a release with the fix this morning.