using EasySSLProtocolSocketFactory to accept self-signed certs

[Jian Zhen <zh...@gmail.com>]

Hi all,

Another thing I was investigating today was to make axis2 accept self- 
signed certs. I've found some references to axis1 on this topic but  
nothing on axis2.

After some searching and testing, I was finally able to get it work.  
I figure I will share it here just in case others are looking as  
well. Maybe someone can point me to a better solution if there's one.

I first found the SSL Guide for commons-httpclient: http:// 
jakarta.apache.org/commons/httpclient/sslguide.html

It gave some great explanations on how to accept self-signed certs.  
It also pointed to some contrib class (not supported by Apache) that  
did that. The one I used is EasySSLProtocolSocketFactory.java.

You will need to download the actual commons-httpclient source zip  
file, and get the EasyX509TrustManager.java file as well.

With those two java files, I compiled them into a new jar: commons- 
httpclient-3.0.1-contrib.jar

I put this jar into the WEB-INF/lib directory.

Then in my service, I basically added these two lines before the  
sendReceive call:

Protocol.unregisterProtocol("https");
Protocol.registerProtocol("https", new Protocol("https", new  
EasySSLProtocolSocketFactory(), 443));

After that, everything worked like a charm!

Word of caution: this method is great for dev environments where  
certs are generally self-signed. For production systems, it's highly  
recommended that you DO NOT do this as it allows person-in-the-middle  
attacks.

In any case, hopefully that helps someone out there.

thx

--
Jian Zhen <zh...@gmail.com>
http://www.zhen.org




---------------------------------------------------------------------
To unsubscribe, e-mail: axis-user-unsubscribe@ws.apache.org
For additional commands, e-mail: axis-user-help@ws.apache.org