Dev Stack Source

Answer : Decode the Base64 to binary, with some InputStream reading it, then try CertificateFactory cf = CertificateFactory.getInstance("X.509"); Certificate cert = cf.generateCertificate(is); I have a similar problem, I'm pasting also here the java code that worked for me in case anyone neaded it : import java.util.Base64; public static X509Certificate parseCertificate(String _headerName, HttpServletRequest _request) throws CertificateException { String certStr = _request.getHeader("x-clientcert"); //before decoding we need to get rod off the prefix and suffix byte [] decoded = Base64.getDecoder().decode(certStr.replaceAll(X509Factory.BEGIN_CERT, "").replaceAll(X509Factory.END_CERT, "")); return (X509Certificate) CertificateFactory.getInstance("X.509").generateCertificate(new ByteArrayInputStream(decoded)); } The steps in conversion of PEM formatted String is opposite of how (x509 -> String) took place. Sample...

Answer : I was able to convert pem to crt using this: openssl x509 -outform der -in your-cert.pem -out your-cert.crt Converting Using OpenSSL These commands allow you to convert certificates and keys to different formats to make them compatible with specific types of servers or software. Convert a DER file (.crt .cer .der) to PEM openssl x509 -inform der -in certificate.cer -out certificate.pem Convert a PEM file to DER openssl x509 -outform der -in certificate.pem -out certificate.der Convert a PKCS#12 file (.pfx .p12) containing a private key and certificates to PEM openssl pkcs12 -in keyStore.pfx -out keyStore.pem -nodes You can add -nocerts to only output the private key or add -nokeys to only output the certificates. Convert a PEM certificate file and a private key to PKCS#12 (.pfx .p12) openssl pkcs12 -export -out certificate.pfx -inkey privateKey.key -in certificate.crt -certfile CACert.crt Convert PEM to CRT (.CRT file) openssl x509 -outform der -in certificate.pem -out cert...

Answer : As you seem to be connecting to the default port 21 (no explicit port specified anywhere), you need to use the "Explicit" mode: conn.EncryptionMode = FtpEncryptionMode.Explicit;

Answer : I am answering to this to give an idea about the scenario and solution as per the android developer site for others benefit. I have solved this using custom trust manager. The problem was with the server certificate, it misses intermediate certificate authority. However with the first flow certificate path is completed somehow and result was successful certificate path validation. There is a solution for this in android developer site. it suggest to use custom trust manager that trusts this server certificate or it suggest to server to include the intermediate CA in the server chain. custom trust manager. source: https://developer.android.com/training/articles/security-ssl.html#UnknownCa // Load CAs from an InputStream // (could be from a resource or ByteArrayInputStream or ...) CertificateFactory cf = CertificateFactory.getInstance("X.509"); // From https://www.washington.edu/itconnect/security/ca/load-der.crt InputStream caInput = new BufferedInputStream...