You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@cxf.apache.org by Florin Pop <po...@gmail.com> on 2013/03/18 15:49:05 UTC
SSL WS-Client Configuration does not work!!
Hello everybody!
*I tried to create a WS-Client that uses a secure SSL connection with CXF
framework. Thus, I created a spring configuration file following the model
from the svn. https://svn.apache.org/repos/asf/cxf/trunk -
\ApacheCXF\distribution\src\main\release\samples\wsdl_first_https\*
The file looks like below:
<?xml version="1.0" encoding="UTF-8"?>
<beans xmlns="http://www.springframework.org/schema/beans"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xmlns:sec="http://cxf.apache.org/configuration/security"
xmlns:http="http://cxf.apache.org/transports/http/configuration"
xsi:schemaLocation="
http://cxf.apache.org/configuration/security
http://cxf.apache.org/schemas/configuration/security.xsd
http://cxf.apache.org/transports/http/configuration
http://cxf.apache.org/schemas/configuration/http-conf.xsd
http://www.springframework.org/schema/beans
http://www.springframework.org/schema/beans/spring-beans.xsd">
<http:conduit name="{http://pachet.ebs.com/}GreeterPort.http-conduit">
<http:tlsClientParameters>
<sec:keyManagers keyPassword="ckpass">
<sec:keyStore file="src/main/resources/clientKeystore.jks"
password="cspass" type="JKS"/>
</sec:keyManagers>
<sec:trustManagers>
<sec:keyStore file="src/main/resources/clientKeystore.jks"
password="cspass" type="JKS"/>
</sec:trustManagers>
<sec:cipherSuitesFilter>
<!-- these filters ensure that a ciphersuite with
export-suitable or null encryption is used,
but exclude anonymous Diffie-Hellman key change as
this is vulnerable to man-in-the-middle attacks -->
<sec:include>.*_EXPORT_.*</sec:include>
<sec:include>.*_EXPORT1024_.*</sec:include>
<sec:include>.*_WITH_DES_.*</sec:include>
<sec:include>.*_WITH_AES_.*</sec:include>
<sec:include>.*_WITH_NULL_.*</sec:include>
<sec:exclude>.*_DH_anon_.*</sec:exclude>
</sec:cipherSuitesFilter>
</http:tlsClientParameters>
</http:conduit>
</beans>
*Secondly, I tried to develop a client like this:
*
public class SSLDynamic {
public static void main(String args[]) throws Exception {
System.setProperty( "javax.net.debug", "ssl");
SpringBusFactory bf = new SpringBusFactory();
URL busFile =
SSLClient.class.getResource("SecureClient.xml");
Bus bus = bf.createBus(busFile.toString());
BusFactory.setDefaultBus(bus);
DynamicClientFactory factory =
DynamicClientFactory.newInstance();
Client client = factory.createClient("
https://localhost:443/SoapContext/SoapPort?wsdl");
Object[] res = client.invoke("greetMe", "Florin");
System.out.println(res[0] + "\n");
}
}
*When i run the code, the following error occures:
Caused by: sun.security.validator.ValidatorException: PKIX path building
failed: sun.security.provider.certpath.SunCertPathBuilderException: unable
to find valid certification path to requested target
at sun.security.validator.PKIXValidator.doBuild(Unknown Source)
at sun.security.validator.PKIXValidator.engineValidate(Unknown Source)
at sun.security.validator.Validator.validate(Unknown Source)
at sun.security.ssl.X509TrustManagerImpl.validate(Unknown Source)
at sun.security.ssl.X509TrustManagerImpl.checkTrusted(Unknown Source)
at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(Unknown
Source)
... 30 more
Caused by: sun.security.provider.certpath.SunCertPathBuilderException:
unable to find valid certification path to requested target
at
sun.security.provider.certpath.SunCertPathBuilder.engineBuild(Unknown
Source)
at java.security.cert.CertPathBuilder.build(Unknown Source)
*
*I also tried this style of client*, *and the result is similar.* *In my
opinion, the client.jks keystore is not well configured or not found. I
used the keystores from the svn for test and i think that the jks files are
correct generated.* *Can you help me please? Thanks in advance!*
public class SSLClient {
private static final QName SERVICE_NAME = new QName(
"http://pachet.ebs.com/", "SOAPService");
private static final QName PORT_NAME = new QName("http://pachet.ebs.com/
",
"GreeterPort");
private SSLClient() {
}
public static void main(String args[]) throws Exception {
//System.setProperty("http.nonProxyHosts", "localhost");
// System.setProperty( "javax.net.debug", "ssl");
SpringBusFactory bf = new SpringBusFactory();
URL busFile = SSLClient.class.getResource("SecureClient.xml");
Bus bus = bf.createBus(busFile.toString());
BusFactory.setDefaultBus(bus);
URL wsdlURL = new URL(
"https://localhost:443/SoapContext/SoapPort?wsdl");
SOAPService ss = new SOAPService(wsdlURL, SERVICE_NAME);
Greeter port = ss.getPort(PORT_NAME, Greeter.class);
System.out.println("Invoking greetMe...");
try {
String resp = port.greetMe("Florin");
System.out.println("Server responded with: " + resp);
System.out.println();
} catch (Exception e) {
System.out.println("Invocation failed with the following: "
+ e.getCause());
System.out.println();
}
System.exit(0);
}
}
Re: SSL WS-Client Configuration does not work!!
Posted by Jason Pell <ja...@pellcorp.com>.
Hi,
Using the cxf client stuff definately works as I have just finished a
fairly substantial piece of work in this area to support
both ssl and mutual ssl.
First off I would suggest simplify your conduit match to be:
<http:conduit name="*.http-conduit">
You can change it back later, but this will ensure a typo is not
preventing your http client config being applied.
Second change the file references to be Absolute initially, as you
have it working via system properties with absolute file reference.
Once you have a working cxf:client, then you can start backing out
some of your changes to get back to a relative reference.
Get rid of the Keystore block from your client xml as its only
required for Mutual SSL and may actually be part of your problems.
If you want to create your own keystore / truststore combo - I have a
linux script that makes short work of it :-) too
https://github.com/pellcorp/cxf/blob/master/JavaFirst/keytool.sh
Let me know how
Cheers
Jason
On Tue, Mar 19, 2013 at 3:08 AM, Florin Pop <po...@gmail.com> wrote:
> Thank you very much Lukasz! :D You had
> right!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
>
> I added the next two lines to my code in order to pass the server's
> certificate to the client's runtime and it WORKS!
> System.setProperty("javax.net.ssl.trustStore","D:/workspace/zzSSLTestClient/src/main/java/clientKeystore.jks");
> System.setProperty("javax.net.ssl.trustStorePassword","cspass");
>
>
> On Mon, Mar 18, 2013 at 5:11 PM, Lukasz Salwinski <lu...@mbi.ucla.edu>wrote:
>
>> On 03/18/2013 07:49 AM, Florin Pop wrote:
>>
>>> Hello everybody!
>>>
>>> *I tried to create a WS-Client that uses a secure SSL connection with CXF
>>>
>>> framework. Thus, I created a spring configuration file following the model
>>>
>>
>> [...]
>>
>> *When i run the code, the following error occures:
>>>
>>>
>>> Caused by: sun.security.validator.**ValidatorException: PKIX path
>>> building
>>> failed: sun.security.provider.**certpath.**SunCertPathBuilderException:
>>> unable
>>> to find valid certification path to requested target
>>> at sun.security.validator.**PKIXValidator.doBuild(Unknown Source)
>>> at sun.security.validator.**PKIXValidator.engineValidate(**Unknown
>>> Source)
>>> at sun.security.validator.**Validator.validate(Unknown Source)
>>> at sun.security.ssl.**X509TrustManagerImpl.validate(**Unknown
>>> Source)
>>> at sun.security.ssl.**X509TrustManagerImpl.**checkTrusted(Unknown
>>> Source)
>>> at sun.security.ssl.**X509TrustManagerImpl.**
>>> checkServerTrusted(Unknown
>>> Source)
>>> ... 30 more
>>> Caused by: sun.security.provider.**certpath.**
>>> SunCertPathBuilderException:
>>> unable to find valid certification path to requested target
>>> at
>>> sun.security.provider.**certpath.SunCertPathBuilder.**engineBuild(Unknown
>>> Source)
>>> at java.security.cert.**CertPathBuilder.build(Unknown Source)
>>>
>>
>> [...]
>>
>> Hello,
>> it looks like either client or server (or both) does not have access to
>> the
>> security certificatete - in order to get Jave SSL server/client pair talk
>> to
>> each other they both must have access to the same (server's public)
>> security
>> certificate. The somewhat complicated procedure to self-generate one and
>> use
>> when communicating over SSL is described, for example here:
>>
>> http://docs.oracle.com/javase/**6/docs/technotes/guides/**
>> security/jsse/JSSERefGuide.**html#CreateKeystore<http://docs.oracle.com/javase/6/docs/technotes/guides/security/jsse/JSSERefGuide.html#CreateKeystore>
>>
>> It boils down to:
>> * self-generating a file (say, keystore) with certificate for the server
>>
>> * passing it to the server's java runtime:
>> java -Djavax.net.ssl.keyStore=**keystore ....
>>
>> * importing the same certificate into a file (say, truststore) containing
>> info about trusted servers known to a client
>>
>> * passing it to the clients's java runtime:
>> java -Djavax.net.ssl.trustStore=**truststore ....
>>
>> hope it helps
>> lukasz
>>
>>
>> --
>> ------------------------------**------------------------------**
>> -------------
>> Lukasz Salwinski PHONE: 310-825-1402
>> UCLA-DOE Institute for Genomics & Proteomics FAX: 310-206-3914
>> UCLA, Los Angeles EMAIL: lukasz@mbi.ucla.edu
>> ------------------------------**------------------------------**
>> -------------
>>
Re: SSL WS-Client Configuration does not work!!
Posted by Florin Pop <po...@gmail.com>.
Thank you very much Lukasz! :D You had
right!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
I added the next two lines to my code in order to pass the server's
certificate to the client's runtime and it WORKS!
System.setProperty("javax.net.ssl.trustStore","D:/workspace/zzSSLTestClient/src/main/java/clientKeystore.jks");
System.setProperty("javax.net.ssl.trustStorePassword","cspass");
On Mon, Mar 18, 2013 at 5:11 PM, Lukasz Salwinski <lu...@mbi.ucla.edu>wrote:
> On 03/18/2013 07:49 AM, Florin Pop wrote:
>
>> Hello everybody!
>>
>> *I tried to create a WS-Client that uses a secure SSL connection with CXF
>>
>> framework. Thus, I created a spring configuration file following the model
>>
>
> [...]
>
> *When i run the code, the following error occures:
>>
>>
>> Caused by: sun.security.validator.**ValidatorException: PKIX path
>> building
>> failed: sun.security.provider.**certpath.**SunCertPathBuilderException:
>> unable
>> to find valid certification path to requested target
>> at sun.security.validator.**PKIXValidator.doBuild(Unknown Source)
>> at sun.security.validator.**PKIXValidator.engineValidate(**Unknown
>> Source)
>> at sun.security.validator.**Validator.validate(Unknown Source)
>> at sun.security.ssl.**X509TrustManagerImpl.validate(**Unknown
>> Source)
>> at sun.security.ssl.**X509TrustManagerImpl.**checkTrusted(Unknown
>> Source)
>> at sun.security.ssl.**X509TrustManagerImpl.**
>> checkServerTrusted(Unknown
>> Source)
>> ... 30 more
>> Caused by: sun.security.provider.**certpath.**
>> SunCertPathBuilderException:
>> unable to find valid certification path to requested target
>> at
>> sun.security.provider.**certpath.SunCertPathBuilder.**engineBuild(Unknown
>> Source)
>> at java.security.cert.**CertPathBuilder.build(Unknown Source)
>>
>
> [...]
>
> Hello,
> it looks like either client or server (or both) does not have access to
> the
> security certificatete - in order to get Jave SSL server/client pair talk
> to
> each other they both must have access to the same (server's public)
> security
> certificate. The somewhat complicated procedure to self-generate one and
> use
> when communicating over SSL is described, for example here:
>
> http://docs.oracle.com/javase/**6/docs/technotes/guides/**
> security/jsse/JSSERefGuide.**html#CreateKeystore<http://docs.oracle.com/javase/6/docs/technotes/guides/security/jsse/JSSERefGuide.html#CreateKeystore>
>
> It boils down to:
> * self-generating a file (say, keystore) with certificate for the server
>
> * passing it to the server's java runtime:
> java -Djavax.net.ssl.keyStore=**keystore ....
>
> * importing the same certificate into a file (say, truststore) containing
> info about trusted servers known to a client
>
> * passing it to the clients's java runtime:
> java -Djavax.net.ssl.trustStore=**truststore ....
>
> hope it helps
> lukasz
>
>
> --
> ------------------------------**------------------------------**
> -------------
> Lukasz Salwinski PHONE: 310-825-1402
> UCLA-DOE Institute for Genomics & Proteomics FAX: 310-206-3914
> UCLA, Los Angeles EMAIL: lukasz@mbi.ucla.edu
> ------------------------------**------------------------------**
> -------------
>
Re: SSL WS-Client Configuration does not work!!
Posted by Lukasz Salwinski <lu...@mbi.ucla.edu>.
On 03/18/2013 07:49 AM, Florin Pop wrote:
> Hello everybody!
>
> *I tried to create a WS-Client that uses a secure SSL connection with CXF
> framework. Thus, I created a spring configuration file following the model
[...]
> *When i run the code, the following error occures:
>
> Caused by: sun.security.validator.ValidatorException: PKIX path building
> failed: sun.security.provider.certpath.SunCertPathBuilderException: unable
> to find valid certification path to requested target
> at sun.security.validator.PKIXValidator.doBuild(Unknown Source)
> at sun.security.validator.PKIXValidator.engineValidate(Unknown Source)
> at sun.security.validator.Validator.validate(Unknown Source)
> at sun.security.ssl.X509TrustManagerImpl.validate(Unknown Source)
> at sun.security.ssl.X509TrustManagerImpl.checkTrusted(Unknown Source)
> at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(Unknown
> Source)
> ... 30 more
> Caused by: sun.security.provider.certpath.SunCertPathBuilderException:
> unable to find valid certification path to requested target
> at
> sun.security.provider.certpath.SunCertPathBuilder.engineBuild(Unknown
> Source)
> at java.security.cert.CertPathBuilder.build(Unknown Source)
[...]
Hello,
it looks like either client or server (or both) does not have access to the
security certificatete - in order to get Jave SSL server/client pair talk to
each other they both must have access to the same (server's public) security
certificate. The somewhat complicated procedure to self-generate one and use
when communicating over SSL is described, for example here:
http://docs.oracle.com/javase/6/docs/technotes/guides/security/jsse/JSSERefGuide.html#CreateKeystore
It boils down to:
* self-generating a file (say, keystore) with certificate for the server
* passing it to the server's java runtime:
java -Djavax.net.ssl.keyStore=keystore ....
* importing the same certificate into a file (say, truststore) containing
info about trusted servers known to a client
* passing it to the clients's java runtime:
java -Djavax.net.ssl.trustStore=truststore ....
hope it helps
lukasz
--
-------------------------------------------------------------------------
Lukasz Salwinski PHONE: 310-825-1402
UCLA-DOE Institute for Genomics & Proteomics FAX: 310-206-3914
UCLA, Los Angeles EMAIL: lukasz@mbi.ucla.edu
-------------------------------------------------------------------------