You are viewing a plain text version of this content. The canonical link for it is here.
Posted to soap-user@xml.apache.org by Sean McCauliff <sm...@jareva.com> on 2003/01/01 00:41:19 UTC
Using SOAP + HTTP as a client within tomcat.
I get the following error message:
SOAPException: faultCode=SOAP-ENV:Cl
ient; msg=Error opening socket: javax.net.ssl.SSLHandshakeException:
java.security.cert.
CertificateException: Couldn&apos;t find trusted certificate;
targetException=java.l
ang.IllegalArgumentException: Error opening socket:
javax.net.ssl.SSLHandshakeException:
java.security.cert.CertificateException: Couldn't find trusted
certificate
I have added the server's public key to /root/.keystore and to
tomcat/conf/keystore and this still happens. Any ideas?
Thanks,
Sean
--
To unsubscribe, e-mail: <ma...@xml.apache.org>
For additional commands, e-mail: <ma...@xml.apache.org>
Re: Using SOAP + HTTP as a client within tomcat.
Posted by Jack Byrne <jb...@aol.com>.
Hello,
I had the same problem in connecting a SOAP Client (over SSL) to a SOAP
(Tomcat/Axis) Server. I created my Client using JDK 1.4 (which has SSL
packaged).
Here are some notes I wrote up about the subject. Let me know if it helps
*Configuring SOAP SSL*
Secure Socket Layer (SSL) is a technology that allows Web Clients
(Browsers, SOAP Clients, etc etc) and Web Servers to communicate over a
secured connection. In this secure connection, the data that is being
sent is encrypted before being sent, then decrypted upon receipt and
prior to processing. Both the client and the server encrypt all traffic
before sending any data.
When a Web Client makes a request via HTTPS to a Web Server, it requires
the Public Key of that Web Service (there may be a different Certificate
for each Web Service on the Web Server) in order to encrypt the request.
The security package in JDK (comes with JDK 1.4) manages the encryption
and searches for the Public Key of the remote service in the JDK
security database called *cacerts *(CA Certificates). Therefore, if you
wish to communicate with a Web Service, you first need to get the Web
Service certificate and import it into your *cacerts *database. A tool
called /*keytool*/ is available on JDK 1.4 for certificate handling.
All /*keytool*/ operations require SuperUser access as JDK is installed
under root.
All certificates and the *cacerts *database are located in
*/usr/java/j2sdk1.4.1_01/jre/lib/security*
When JDK 1.4 is installed, there is a base set of default certificates
available. To see what is in the *cacerts *database, perform the following:
keytool -list -keystore cacerts
Enter keystore password: changeit
Keystore type: jks
Keystore provider: SUN
Your keystore contains 2 entries
serverca, Jan 2, 2003, trustedCertEntry,
Certificate fingerprint (MD5):
20:D8:1E:2D:8F:BA:28:62:0F:25:52:90:36:1C:37:7B
j2eeca, Jan 2, 2003, trustedCertEntry,
Certificate fingerprint (MD5):
10:AF:DC:59:30:62:3A:F1:4A:B3:FB:0A:1F:05:61:E7
The following operations are required:
* Create a Server Certificate for the *"myService" *service as follows:
cd */usr/java/j2sdk1.4.1_01/jre/lib/security*
keytool -genkey -keyalg RSA -alias myService -keystore myService.jks
Enter keystore password: changeit
What is your first and last name?
[Unknown]: *yourHost.yourDomain*
What is the name of your organizational unit?
[Unknown]: *yourGroupName*
What is the name of your organization?
[Unknown]: *yourCompany*
What is the name of your City or Locality?
[Unknown]: *yourLocation*
What is the name of your State or Province?
[Unknown]: *yourCity*
What is the two-letter country code for this unit?
[Unknown]: *yourCountry*
Is CN=yourHost.yourDomain, OU=yourGroupName, O=yourCompany,
L=yourLocation, ST=yourCity, C=yourCountry correct?
[no]: yes
Enter key password for <myService>
(RETURN if same as keystore password):
This operation creates a file called myService.jks which contains a
*self-signed certificate*.
* *If you are providing the Server side of the service* then enable
SSL on the WEB Server and indicate which certificate (ie.,
myService.jks) is to be used for HTTPS
Edit the file $CATALINA_HOME/conf/server.xml
Uncomment the entry that looks like
<!-- Define an SSL HTTP/1.1 Connector on port 8443 -->
<Connector
className="org.apache.catalina.connector.http.HttpConnector"
port="8443" minProcessors="5" maxProcessors="75"
enableLookups="true"
acceptCount="10" debug="0" scheme="https" secure="true">
<Factory
className="org.apache.catalina.net.SSLServerSocketFactory"
keystoreFile="*/usr/java/j2sdk1.4.1_01/jre/lib/security/myService.jks*"
clientAuth="false" protocol="TLS"/>
</Connector>
Enter the fully qualified pathname of the certificate that will be
used for HTTPS. This means that when a request is made to this WEB
Server, the certificate *myService.jks* will be sent to the Web
Client. The Web Client will use the Public Key of the certificate to
encrypt the HTTP requests to this Server.
For the configuration change to take effect, Tomcat needs to be
stopped ($CATALINA_HOME/bin/shutdown.sh) and restarted
($CATALINA_HOME/bin/startup.sh).
If a Web Client request is made to the Web Server, the following
Exception will occur
AxisFault
faultCode: {http://xml.apache.org/axis/}Server.userException
faultString: javax.net.ssl.SSLHandshakeException:
java.security.cert.CertificateException: Couldn't find trusted
certificate
*The reason for this is that your Client does not know anything
about the certificate it receives back from the Web server when u
make this HTTPS request*
* In order for a Web Client to communicate with myService over
HTTPS, it requires the above certificate. Export the certificate
to a file so that it can be imported as a trusted Certificate into
the JDK 1.4 *cacerts *database
keytool -export -alias myService -file myService.cer -keystore
myService.jks
Enter keystore password: changeit
Certificate stored in file <myService.cer>
* Import the myService.cer certificate into the JDK 1.4 *cacerts
*database
keytool -import -v -trustcacerts -alias myService -file
myService.cer -keystore cacerts
Enter keystore password: changeit
Owner: CN=yourHost.yourDomain, OU=yourGroup, O=yourCompany,
L=yourLocation, ST=yourCity, C=yourCountry
Issuer: CN=yourHost.yourDomain, OU=yourGroup, O=yourCompany,
L=yourLocation, ST=yourCity, C=yourCountry
Serial number: 3a15704c
Valid from: Fri Jan 03 11:13:16 GMT 2003 until: Thu Apr 03 12:13:16
IST 2003
Certificate fingerprints:
MD5: 04:98:7C:07:F9:54:7E:67:DE:AF:D2:68:F5:E5:3B:DA
SHA1: D1:5C:C9:79:D9:F7:E7:19:7E:71:31:C0:48:11:D3:C0:61:2F:60:F7
Trust this certificate? [no]: yes
Certificate was added to keystore
[Saving cacerts]
The above indicates who owns the Certificate and who issued the
Certificate. Normally a trusted Third Party (called a Certification
Authority) issues the certificates or actually signes the
certificate we generated. For testing purposes, I am usign a self
signed certificate and I am asking the Client to trust this certificate.
The *cacerts *databse now has an extra entry, namely the imported
myService certificate
keytool -list -keystore cacerts
Enter keystore password: changeit
Keystore type: jks
Keystore provider: SUN
Your keystore contains 3 entries
serverca, Jan 2, 2003, trustedCertEntry,
Certificate fingerprint (MD5):
20:D8:1E:2D:8F:BA:28:62:0F:25:52:90:36:1C:37:7B
*myservice, Jan 3, 2003, trustedCertEntry,
Certificate fingerprint (MD5):
04:98:7C:07:F9:54:7E:67:DE:AF:D2:68:F5:E5:3B:DA*
j2eeca, Jan 2, 2003, trustedCertEntry,
Certificate fingerprint (MD5):
10:AF:DC:59:30:62:3A:F1:4A:B3:FB:0A:1F:05:61:E7
At this point, a Web Client can now communicate with the myService
Service over HTTPS.
Now, when the Web Client makes a HTTPS request to the Web Service,
the Web Service certificate is returned, the Web Client checks in
its *cacerts *databse to determine if it can trust this certificate.
If the certificate is there and can be trusted, it will use the
Public Key to encrypt the HTTPS request.
Hope this helps
Jack
Sean McCauliff wrote:
> I get the following error message:
>
>
> SOAPException: faultCode=SOAP-ENV:Cl
> ient; msg=Error opening socket: javax.net.ssl.SSLHandshakeException:
> java.security.cert.
> CertificateException: Couldn't find trusted certificate;
> targetException=java.l
> ang.IllegalArgumentException: Error opening socket:
> javax.net.ssl.SSLHandshakeException:
> java.security.cert.CertificateException: Couldn't find trusted
> certificate
>
> I have added the server's public key to /root/.keystore and to
> tomcat/conf/keystore and this still happens. Any ideas?
>
> Thanks,
> Sean
>
>
>
>
> --
> To unsubscribe, e-mail: <ma...@xml.apache.org>
> For additional commands, e-mail: <ma...@xml.apache.org>
>
>
Re: Using SOAP + HTTP as a client within tomcat.
Posted by Jack Byrne <jb...@aol.com>.
Hello,
I had the same problem in connecting a SOAP Client (over SSL) to a SOAP
(Tomcat/Axis) Server. I created my Client using JDK 1.4 (which has SSL
packaged).
Here are some notes I wrote up about the subject. Let me know if it helps
*Configuring SOAP SSL*
Secure Socket Layer (SSL) is a technology that allows Web Clients
(Browsers, SOAP Clients, etc etc) and Web Servers to communicate over a
secured connection. In this secure connection, the data that is being
sent is encrypted before being sent, then decrypted upon receipt and
prior to processing. Both the client and the server encrypt all traffic
before sending any data.
When a Web Client makes a request via HTTPS to a Web Server, it requires
the Public Key of that Web Service (there may be a different Certificate
for each Web Service on the Web Server) in order to encrypt the request.
The security package in JDK (comes with JDK 1.4) manages the encryption
and searches for the Public Key of the remote service in the JDK
security database called *cacerts *(CA Certificates). Therefore, if you
wish to communicate with a Web Service, you first need to get the Web
Service certificate and import it into your *cacerts *database. A tool
called /*keytool*/ is available on JDK 1.4 for certificate handling.
All /*keytool*/ operations require SuperUser access as JDK is installed
under root.
All certificates and the *cacerts *database are located in
*/usr/java/j2sdk1.4.1_01/jre/lib/security*
When JDK 1.4 is installed, there is a base set of default certificates
available. To see what is in the *cacerts *database, perform the following:
keytool -list -keystore cacerts
Enter keystore password: changeit
Keystore type: jks
Keystore provider: SUN
Your keystore contains 2 entries
serverca, Jan 2, 2003, trustedCertEntry,
Certificate fingerprint (MD5):
20:D8:1E:2D:8F:BA:28:62:0F:25:52:90:36:1C:37:7B
j2eeca, Jan 2, 2003, trustedCertEntry,
Certificate fingerprint (MD5):
10:AF:DC:59:30:62:3A:F1:4A:B3:FB:0A:1F:05:61:E7
The following operations are required:
* Create a Server Certificate for the *"myService" *service as follows:
cd */usr/java/j2sdk1.4.1_01/jre/lib/security*
keytool -genkey -keyalg RSA -alias myService -keystore myService.jks
Enter keystore password: changeit
What is your first and last name?
[Unknown]: *yourHost.yourDomain*
What is the name of your organizational unit?
[Unknown]: *yourGroupName*
What is the name of your organization?
[Unknown]: *yourCompany*
What is the name of your City or Locality?
[Unknown]: *yourLocation*
What is the name of your State or Province?
[Unknown]: *yourCity*
What is the two-letter country code for this unit?
[Unknown]: *yourCountry*
Is CN=yourHost.yourDomain, OU=yourGroupName, O=yourCompany,
L=yourLocation, ST=yourCity, C=yourCountry correct?
[no]: yes
Enter key password for <myService>
(RETURN if same as keystore password):
This operation creates a file called myService.jks which contains a
*self-signed certificate*.
* *If you are providing the Server side of the service* then enable
SSL on the WEB Server and indicate which certificate (ie.,
myService.jks) is to be used for HTTPS
Edit the file $CATALINA_HOME/conf/server.xml
Uncomment the entry that looks like
<!-- Define an SSL HTTP/1.1 Connector on port 8443 -->
<Connector
className="org.apache.catalina.connector.http.HttpConnector"
port="8443" minProcessors="5" maxProcessors="75"
enableLookups="true"
acceptCount="10" debug="0" scheme="https" secure="true">
<Factory
className="org.apache.catalina.net.SSLServerSocketFactory"
keystoreFile="*/usr/java/j2sdk1.4.1_01/jre/lib/security/myService.jks*"
clientAuth="false" protocol="TLS"/>
</Connector>
Enter the fully qualified pathname of the certificate that will be
used for HTTPS. This means that when a request is made to this WEB
Server, the certificate *myService.jks* will be sent to the Web
Client. The Web Client will use the Public Key of the certificate to
encrypt the HTTP requests to this Server.
For the configuration change to take effect, Tomcat needs to be
stopped ($CATALINA_HOME/bin/shutdown.sh) and restarted
($CATALINA_HOME/bin/startup.sh).
If a Web Client request is made to the Web Server, the following
Exception will occur
AxisFault
faultCode: {http://xml.apache.org/axis/}Server.userException
faultString: javax.net.ssl.SSLHandshakeException:
java.security.cert.CertificateException: Couldn't find trusted
certificate
*The reason for this is that your Client does not know anything
about the certificate it receives back from the Web server when u
make this HTTPS request*
* In order for a Web Client to communicate with myService over
HTTPS, it requires the above certificate. Export the certificate
to a file so that it can be imported as a trusted Certificate into
the JDK 1.4 *cacerts *database
keytool -export -alias myService -file myService.cer -keystore
myService.jks
Enter keystore password: changeit
Certificate stored in file <myService.cer>
* Import the myService.cer certificate into the JDK 1.4 *cacerts
*database
keytool -import -v -trustcacerts -alias myService -file
myService.cer -keystore cacerts
Enter keystore password: changeit
Owner: CN=yourHost.yourDomain, OU=yourGroup, O=yourCompany,
L=yourLocation, ST=yourCity, C=yourCountry
Issuer: CN=yourHost.yourDomain, OU=yourGroup, O=yourCompany,
L=yourLocation, ST=yourCity, C=yourCountry
Serial number: 3a15704c
Valid from: Fri Jan 03 11:13:16 GMT 2003 until: Thu Apr 03 12:13:16
IST 2003
Certificate fingerprints:
MD5: 04:98:7C:07:F9:54:7E:67:DE:AF:D2:68:F5:E5:3B:DA
SHA1: D1:5C:C9:79:D9:F7:E7:19:7E:71:31:C0:48:11:D3:C0:61:2F:60:F7
Trust this certificate? [no]: yes
Certificate was added to keystore
[Saving cacerts]
The above indicates who owns the Certificate and who issued the
Certificate. Normally a trusted Third Party (called a Certification
Authority) issues the certificates or actually signes the
certificate we generated. For testing purposes, I am usign a self
signed certificate and I am asking the Client to trust this certificate.
The *cacerts *databse now has an extra entry, namely the imported
myService certificate
keytool -list -keystore cacerts
Enter keystore password: changeit
Keystore type: jks
Keystore provider: SUN
Your keystore contains 3 entries
serverca, Jan 2, 2003, trustedCertEntry,
Certificate fingerprint (MD5):
20:D8:1E:2D:8F:BA:28:62:0F:25:52:90:36:1C:37:7B
*myservice, Jan 3, 2003, trustedCertEntry,
Certificate fingerprint (MD5):
04:98:7C:07:F9:54:7E:67:DE:AF:D2:68:F5:E5:3B:DA*
j2eeca, Jan 2, 2003, trustedCertEntry,
Certificate fingerprint (MD5):
10:AF:DC:59:30:62:3A:F1:4A:B3:FB:0A:1F:05:61:E7
At this point, a Web Client can now communicate with the myService
Service over HTTPS.
Now, when the Web Client makes a HTTPS request to the Web Service,
the Web Service certificate is returned, the Web Client checks in
its *cacerts *databse to determine if it can trust this certificate.
If the certificate is there and can be trusted, it will use the
Public Key to encrypt the HTTPS request.
Hope this helps
Jack
Sean McCauliff wrote:
> I get the following error message:
>
>
> SOAPException: faultCode=SOAP-ENV:Cl
> ient; msg=Error opening socket: javax.net.ssl.SSLHandshakeException:
> java.security.cert.
> CertificateException: Couldn't find trusted certificate;
> targetException=java.l
> ang.IllegalArgumentException: Error opening socket:
> javax.net.ssl.SSLHandshakeException:
> java.security.cert.CertificateException: Couldn't find trusted
> certificate
>
> I have added the server's public key to /root/.keystore and to
> tomcat/conf/keystore and this still happens. Any ideas?
>
> Thanks,
> Sean
>
>
>
>
> --
> To unsubscribe, e-mail: <ma...@xml.apache.org>
> For additional commands, e-mail: <ma...@xml.apache.org>
>
>
Re: Using SOAP + HTTP as a client within tomcat.
Posted by Sean McCauliff <sm...@jareva.com>.
There is definately some problem that relates to the tomcat
configuration. When I ran it outside tomcat
it works just fine. I tried adding the server certificates to the keystore.
My solution was to write my own https transport that uses a custom
SSLSocketFactory.
Thanks for your help,
-Sean
Scott Nichol wrote:
>I have barely used SSL with Apache SOAP, but since no one else seems to
>be chiming in, I'll throw in a couple of thoughts.
>
>First, the SSL docs distributed with Apache SOAP are specifically form
>Tomcat at
>http://cvs.apache.org/viewcvs.cgi/*checkout*/xml-soap/java/docs/install/
>FAQ_Tomcat_SOAP_SSL.html?rev=HEAD&content-type=text/html.
>Unfortunately, this is old and may be out of date in some important
>places.
>
>Second, since you are using SSL for SOAP client within Tomcat, it is not
>totally clear whether you should care about the Tomcat or client
>configuration. My best guess would be that you can ignore the Tomcat
>SSL configuration and concentrate on the SOAP client configuration.
>
>Third, the docs talk about importing a certificate, not a public key.
>This is an area in which I have no detailed understanding, but it is
>certainly a difference between your description and the docs, and your
>stack dump specifically says the certificate is not found. When I boil
>down the docs, it seems to me like you want to import the certificate
>into a keystore, then be certain that the keystore in question is the
>one used by your code (by setting the system property
>javax.net.ssl.trustStore). With that accomplished, I would not expect
>you to get the error you are getting.
>
>Good luck, and when you resolve this, it would be great if you could
>post the resolution to this list so the next poor soul in your situation
>can benefit from your pain.
>
>Scott Nichol
>
>----- Original Message -----
>From: "Sean McCauliff" <sm...@jareva.com>
>To: <so...@xml.apache.org>
>Sent: Tuesday, December 31, 2002 6:41 PM
>Subject: Using SOAP + HTTP as a client within tomcat.
>
>
>
>
>>I get the following error message:
>>
>>
>>SOAPException: faultCode=SOAP-ENV:Cl
>>ient; msg=Error opening socket: javax.net.ssl.SSLHandshakeException:
>>java.security.cert.
>>CertificateException: Couldn&apos;t find trusted certificate;
>>targetException=java.l
>>ang.IllegalArgumentException: Error opening socket:
>>javax.net.ssl.SSLHandshakeException:
>> java.security.cert.CertificateException: Couldn't find trusted
>>certificate
>>
>>I have added the server's public key to /root/.keystore and to
>>tomcat/conf/keystore and this still happens. Any ideas?
>>
>>Thanks,
>>Sean
>>
>>
>>
>>
>>--
>>To unsubscribe, e-mail:
>>
>>
><ma...@xml.apache.org>
>
>
>>For additional commands, e-mail:
>>
>>
><ma...@xml.apache.org>
>
>
>>
>>
>
>
>--
>To unsubscribe, e-mail: <ma...@xml.apache.org>
>For additional commands, e-mail: <ma...@xml.apache.org>
>
>
--
Sean
Re: Using SOAP + HTTP as a client within tomcat.
Posted by Sean McCauliff <sm...@jareva.com>.
There is definately some problem that relates to the tomcat
configuration. When I ran it outside tomcat
it works just fine. I tried adding the server certificates to the keystore.
My solution was to write my own https transport that uses a custom
SSLSocketFactory.
Thanks for your help,
-Sean
Scott Nichol wrote:
>I have barely used SSL with Apache SOAP, but since no one else seems to
>be chiming in, I'll throw in a couple of thoughts.
>
>First, the SSL docs distributed with Apache SOAP are specifically form
>Tomcat at
>http://cvs.apache.org/viewcvs.cgi/*checkout*/xml-soap/java/docs/install/
>FAQ_Tomcat_SOAP_SSL.html?rev=HEAD&content-type=text/html.
>Unfortunately, this is old and may be out of date in some important
>places.
>
>Second, since you are using SSL for SOAP client within Tomcat, it is not
>totally clear whether you should care about the Tomcat or client
>configuration. My best guess would be that you can ignore the Tomcat
>SSL configuration and concentrate on the SOAP client configuration.
>
>Third, the docs talk about importing a certificate, not a public key.
>This is an area in which I have no detailed understanding, but it is
>certainly a difference between your description and the docs, and your
>stack dump specifically says the certificate is not found. When I boil
>down the docs, it seems to me like you want to import the certificate
>into a keystore, then be certain that the keystore in question is the
>one used by your code (by setting the system property
>javax.net.ssl.trustStore). With that accomplished, I would not expect
>you to get the error you are getting.
>
>Good luck, and when you resolve this, it would be great if you could
>post the resolution to this list so the next poor soul in your situation
>can benefit from your pain.
>
>Scott Nichol
>
>----- Original Message -----
>From: "Sean McCauliff" <sm...@jareva.com>
>To: <so...@xml.apache.org>
>Sent: Tuesday, December 31, 2002 6:41 PM
>Subject: Using SOAP + HTTP as a client within tomcat.
>
>
>
>
>>I get the following error message:
>>
>>
>>SOAPException: faultCode=SOAP-ENV:Cl
>>ient; msg=Error opening socket: javax.net.ssl.SSLHandshakeException:
>>java.security.cert.
>>CertificateException: Couldn&apos;t find trusted certificate;
>>targetException=java.l
>>ang.IllegalArgumentException: Error opening socket:
>>javax.net.ssl.SSLHandshakeException:
>> java.security.cert.CertificateException: Couldn't find trusted
>>certificate
>>
>>I have added the server's public key to /root/.keystore and to
>>tomcat/conf/keystore and this still happens. Any ideas?
>>
>>Thanks,
>>Sean
>>
>>
>>
>>
>>--
>>To unsubscribe, e-mail:
>>
>>
><ma...@xml.apache.org>
>
>
>>For additional commands, e-mail:
>>
>>
><ma...@xml.apache.org>
>
>
>>
>>
>
>
>--
>To unsubscribe, e-mail: <ma...@xml.apache.org>
>For additional commands, e-mail: <ma...@xml.apache.org>
>
>
--
Sean
--
To unsubscribe, e-mail: <ma...@xml.apache.org>
For additional commands, e-mail: <ma...@xml.apache.org>
Tomcat, Axis and SSL (was: Using SOAP + HTTP as a client within tomcat.)
Posted by "Michael D. Spence" <sp...@panix.com>.
> -----Original Message-----
> From: Scott Nichol [mailto:snicholnews@scottnichol.com]
> Sent: Thursday, January 02, 2003 12:06 PM
> To: soap-user@xml.apache.org
> Subject: Re: Using SOAP + HTTP as a client within tomcat.
>
>
> Good luck, and when you resolve this, it would be great if you could
> post the resolution to this list so the next poor soul in
> your situation
> can benefit from your pain.
>
I just spent a (painful) day or two getting SSL to work. Here's what
worked for me. Remember, this isn't necessarily the appropriate
setup for production use -- I just wanted the SSL stuff to work so
I could proceed with development. You might want real certificates
issued by a real CA for production.
1) Using keytool, create a self-signed certificate:
keytool -genkey -alias server -keyalg RSA –keystore servercerts.ks
Answer the question appropriately. (Hint: use the same password
for the key and the keystore.)
2) Copy servercerts.ks (which was generated into your working
directory above) to %CATALINA_HOME%
3) Modify %CATALINA_HOME%\conf\serve.xml to enable a secure port.
Locate the Connecter element for port 8443 and uncomment it. Embedded
in the Connecter is a <Factory> element. Add two new attributes:
<Factory className="org.apache.coyote.tomcat4.CoyoteServerSocketFactory"
keystoreFile="servercerts.ks" <-- (Add this line)
keystorePass="<pasword you used>" <-- (Add this line)
clientAuth="false" protocol="TLS" />
This will be effective the next time you restart Tomcat.
4) Export the server certificate:
keytool -export -rfc -alias server -keystore foo.ks -file server.cert
Enter keystore password: <your password here>
Certificate stored in file <server.cert>
5) Using any precautions that you think are appropriate, move server.cert
to the system where the client will run (in other words, if you're just
setting this up for development, like I was, then copying it to another
system over your LAN is probably ok. If, on the other hand, you're really
going to rely on this authentication then you should take steps to make
sure that server.cert isn't compromised or viewed by others.
6) Import the certificate into the client's keystore:
keytool -import -file sever.cert -keystore client.ks
Enter keystore password: <your password here>
keytool will show you the issuer and owner data, and also some hashes.
You could use this opportunity to reach out to the sender over
the phone and compare the hashes to make sure the file wasn't tampered with.
Or not.
keytool can create a keystore if you don't have one. In your client,
set the following system properties:
System.setProperty("javax.net.ssl.trustStore","<path to your client
keystore");
System.setProperty("javax.net.ssl.trustStorePassword","<your password>");
Set these if you want to have the server authenticate the client.
System.setProperty("javax.net.ssl.keyStore","<path to your client
keystore");
System.setProperty("javax.net.ssl.keyStorePassword","<your password>");
If you do this you'll have to set clientAuth="true" in the <Factory> element
in server.xml. And you'll also have to export the client's certificate
from the client's keystore and import it into the server's truststore.
Finally, this is useful for debugging, although it can produce a ton of
output:
System.setProperty("javax.net.debug","ssl:handshake");
You can set it on the Tomcat side by using -Djavax.net.debug="ssl:handshake"
on the
command line you use to start Tomcat.
--
To unsubscribe, e-mail: <ma...@xml.apache.org>
For additional commands, e-mail: <ma...@xml.apache.org>
Tomcat, Axis and SSL (was: Using SOAP + HTTP as a client within tomcat.)
Posted by "Michael D. Spence" <sp...@panix.com>.
> -----Original Message-----
> From: Scott Nichol [mailto:snicholnews@scottnichol.com]
> Sent: Thursday, January 02, 2003 12:06 PM
> To: soap-user@xml.apache.org
> Subject: Re: Using SOAP + HTTP as a client within tomcat.
>
>
> Good luck, and when you resolve this, it would be great if you could
> post the resolution to this list so the next poor soul in
> your situation
> can benefit from your pain.
>
I just spent a (painful) day or two getting SSL to work. Here's what
worked for me. Remember, this isn't necessarily the appropriate
setup for production use -- I just wanted the SSL stuff to work so
I could proceed with development. You might want real certificates
issued by a real CA for production.
1) Using keytool, create a self-signed certificate:
keytool -genkey -alias server -keyalg RSA –keystore servercerts.ks
Answer the question appropriately. (Hint: use the same password
for the key and the keystore.)
2) Copy servercerts.ks (which was generated into your working
directory above) to %CATALINA_HOME%
3) Modify %CATALINA_HOME%\conf\serve.xml to enable a secure port.
Locate the Connecter element for port 8443 and uncomment it. Embedded
in the Connecter is a <Factory> element. Add two new attributes:
<Factory className="org.apache.coyote.tomcat4.CoyoteServerSocketFactory"
keystoreFile="servercerts.ks" <-- (Add this line)
keystorePass="<pasword you used>" <-- (Add this line)
clientAuth="false" protocol="TLS" />
This will be effective the next time you restart Tomcat.
4) Export the server certificate:
keytool -export -rfc -alias server -keystore foo.ks -file server.cert
Enter keystore password: <your password here>
Certificate stored in file <server.cert>
5) Using any precautions that you think are appropriate, move server.cert
to the system where the client will run (in other words, if you're just
setting this up for development, like I was, then copying it to another
system over your LAN is probably ok. If, on the other hand, you're really
going to rely on this authentication then you should take steps to make
sure that server.cert isn't compromised or viewed by others.
6) Import the certificate into the client's keystore:
keytool -import -file sever.cert -keystore client.ks
Enter keystore password: <your password here>
keytool will show you the issuer and owner data, and also some hashes.
You could use this opportunity to reach out to the sender over
the phone and compare the hashes to make sure the file wasn't tampered with.
Or not.
keytool can create a keystore if you don't have one. In your client,
set the following system properties:
System.setProperty("javax.net.ssl.trustStore","<path to your client
keystore");
System.setProperty("javax.net.ssl.trustStorePassword","<your password>");
Set these if you want to have the server authenticate the client.
System.setProperty("javax.net.ssl.keyStore","<path to your client
keystore");
System.setProperty("javax.net.ssl.keyStorePassword","<your password>");
If you do this you'll have to set clientAuth="true" in the <Factory> element
in server.xml. And you'll also have to export the client's certificate
from the client's keystore and import it into the server's truststore.
Finally, this is useful for debugging, although it can produce a ton of
output:
System.setProperty("javax.net.debug","ssl:handshake");
You can set it on the Tomcat side by using -Djavax.net.debug="ssl:handshake"
on the
command line you use to start Tomcat.
Re: Using SOAP + HTTP as a client within tomcat.
Posted by Scott Nichol <sn...@scottnichol.com>.
I have barely used SSL with Apache SOAP, but since no one else seems to
be chiming in, I'll throw in a couple of thoughts.
First, the SSL docs distributed with Apache SOAP are specifically form
Tomcat at
http://cvs.apache.org/viewcvs.cgi/*checkout*/xml-soap/java/docs/install/
FAQ_Tomcat_SOAP_SSL.html?rev=HEAD&content-type=text/html.
Unfortunately, this is old and may be out of date in some important
places.
Second, since you are using SSL for SOAP client within Tomcat, it is not
totally clear whether you should care about the Tomcat or client
configuration. My best guess would be that you can ignore the Tomcat
SSL configuration and concentrate on the SOAP client configuration.
Third, the docs talk about importing a certificate, not a public key.
This is an area in which I have no detailed understanding, but it is
certainly a difference between your description and the docs, and your
stack dump specifically says the certificate is not found. When I boil
down the docs, it seems to me like you want to import the certificate
into a keystore, then be certain that the keystore in question is the
one used by your code (by setting the system property
javax.net.ssl.trustStore). With that accomplished, I would not expect
you to get the error you are getting.
Good luck, and when you resolve this, it would be great if you could
post the resolution to this list so the next poor soul in your situation
can benefit from your pain.
Scott Nichol
----- Original Message -----
From: "Sean McCauliff" <sm...@jareva.com>
To: <so...@xml.apache.org>
Sent: Tuesday, December 31, 2002 6:41 PM
Subject: Using SOAP + HTTP as a client within tomcat.
> I get the following error message:
>
>
> SOAPException: faultCode=SOAP-ENV:Cl
> ient; msg=Error opening socket: javax.net.ssl.SSLHandshakeException:
> java.security.cert.
> CertificateException: Couldn&apos;t find trusted certificate;
> targetException=java.l
> ang.IllegalArgumentException: Error opening socket:
> javax.net.ssl.SSLHandshakeException:
> java.security.cert.CertificateException: Couldn't find trusted
> certificate
>
> I have added the server's public key to /root/.keystore and to
> tomcat/conf/keystore and this still happens. Any ideas?
>
> Thanks,
> Sean
>
>
>
>
> --
> To unsubscribe, e-mail:
<ma...@xml.apache.org>
> For additional commands, e-mail:
<ma...@xml.apache.org>
>
>
--
To unsubscribe, e-mail: <ma...@xml.apache.org>
For additional commands, e-mail: <ma...@xml.apache.org>
Re: Using SOAP + HTTP as a client within tomcat.
Posted by Scott Nichol <sn...@scottnichol.com>.
I have barely used SSL with Apache SOAP, but since no one else seems to
be chiming in, I'll throw in a couple of thoughts.
First, the SSL docs distributed with Apache SOAP are specifically form
Tomcat at
http://cvs.apache.org/viewcvs.cgi/*checkout*/xml-soap/java/docs/install/
FAQ_Tomcat_SOAP_SSL.html?rev=HEAD&content-type=text/html.
Unfortunately, this is old and may be out of date in some important
places.
Second, since you are using SSL for SOAP client within Tomcat, it is not
totally clear whether you should care about the Tomcat or client
configuration. My best guess would be that you can ignore the Tomcat
SSL configuration and concentrate on the SOAP client configuration.
Third, the docs talk about importing a certificate, not a public key.
This is an area in which I have no detailed understanding, but it is
certainly a difference between your description and the docs, and your
stack dump specifically says the certificate is not found. When I boil
down the docs, it seems to me like you want to import the certificate
into a keystore, then be certain that the keystore in question is the
one used by your code (by setting the system property
javax.net.ssl.trustStore). With that accomplished, I would not expect
you to get the error you are getting.
Good luck, and when you resolve this, it would be great if you could
post the resolution to this list so the next poor soul in your situation
can benefit from your pain.
Scott Nichol
----- Original Message -----
From: "Sean McCauliff" <sm...@jareva.com>
To: <so...@xml.apache.org>
Sent: Tuesday, December 31, 2002 6:41 PM
Subject: Using SOAP + HTTP as a client within tomcat.
> I get the following error message:
>
>
> SOAPException: faultCode=SOAP-ENV:Cl
> ient; msg=Error opening socket: javax.net.ssl.SSLHandshakeException:
> java.security.cert.
> CertificateException: Couldn&apos;t find trusted certificate;
> targetException=java.l
> ang.IllegalArgumentException: Error opening socket:
> javax.net.ssl.SSLHandshakeException:
> java.security.cert.CertificateException: Couldn't find trusted
> certificate
>
> I have added the server's public key to /root/.keystore and to
> tomcat/conf/keystore and this still happens. Any ideas?
>
> Thanks,
> Sean
>
>
>
>
> --
> To unsubscribe, e-mail:
<ma...@xml.apache.org>
> For additional commands, e-mail:
<ma...@xml.apache.org>
>
>