You are viewing a plain text version of this content. The canonical link for it is here.
Posted to java-user@axis.apache.org by Nuria Rodríguez García <nu...@gmail.com> on 2008/03/03 15:44:27 UTC
[Axis2] SSL server certificate
Hello:
I'm using Axis2 and I need to use SSL to connect to a WS.
In server side I do the following:
I configure the server.xml file in tomcat. I have:
<Connector port="8443"
maxThreads="150" minSpareThreads="25" maxSpareThreads="75"
enableLookups="false" disableUploadTimeout="true"
acceptCount="100" debug="0" scheme="https" secure="true"
clientAuth="false" sslProtocol="TLS" />
Then I generate a server certificate doing the following:
keytool -genkey -alias tomcat -keyalg RSA
keytool -export -alias tomcat -storepass changeit
-file server.cer
keytool -import -v -trustcacerts -alias tomcat -file
server.cer -keystore %JAVA_HOME%/jre/lib/security/cacerts -keypass changeit
-storepass changeit
I start-up tomcat and when I call the service using the EPR
"https://mymachine:8443/ ...." I receive the following exception:
I/O exception (org.apache.axis2.AxisFault) caught
when processing request: *sun.security.validator.ValidatorException*: PKIX
path building failed: *
sun.security.provider.certpath.SunCertPathBuilderException*: unable to find
valid certification path to requested target
I don't know if I need to indicate something from the client side.
Thanks,
Nuria
Re: [Axis2] SSL server certificate
Posted by Jinyuan Zhou <zh...@gmail.com>.
Bill,
Yes, I totally agree with you.
Jack
On Mon, Mar 3, 2008 at 8:02 AM, Vassilis Virvilis <v....@biovista.com>
wrote:
> On Monday 03 March 2008, Jinyuan Zhou wrote:
> > It appears to me that XTrustProvider.install() allows you to bypass the
> > validation. Just make sure this is want you wanted, especially if your
> > webservice client is running inside big JEE app.
> > Cheers,
> > Jack
>
> Hi Jinyuan,
>
> Thanks for the heads up.
>
> I understand that this is essentially a hack to make java to work with
> self
> signed servers. If there is really a security concern or any probability
> for
> a man in the middle attack for sure this advice is not applicable.
>
> My understanding is:
> --------------------
>
> If someone is interested in a serious JEE application then he should buy
> the
> appropriate certificate.
>
> If someone is just evaluating or playing with non critical or confidential
> data he can lax the security validation a bit...
>
>
> bill
>
>
>
>
--
Some people lived like they will never die
and died like they have never lived
Re: [Axis2] SSL server certificate
Posted by Vassilis Virvilis <v....@biovista.com>.
On Monday 03 March 2008, Jinyuan Zhou wrote:
> It appears to me that XTrustProvider.install() allows you to bypass the
> validation. Just make sure this is want you wanted, especially if your
> webservice client is running inside big JEE app.
> Cheers,
> Jack
Hi Jinyuan,
Thanks for the heads up.
I understand that this is essentially a hack to make java to work with self
signed servers. If there is really a security concern or any probability for
a man in the middle attack for sure this advice is not applicable.
My understanding is:
--------------------
If someone is interested in a serious JEE application then he should buy the
appropriate certificate.
If someone is just evaluating or playing with non critical or confidential
data he can lax the security validation a bit...
bill
---------------------------------------------------------------------
To unsubscribe, e-mail: axis-user-unsubscribe@ws.apache.org
For additional commands, e-mail: axis-user-help@ws.apache.org
Re: [Axis2] SSL server certificate
Posted by Jinyuan Zhou <zh...@gmail.com>.
It appears to me that XTrustProvider.install() allows you to bypass the
validation. Just make sure this is want you wanted, especially if your
webservice client is running inside big JEE app.
Cheers,
Jack
On Mon, Mar 3, 2008 at 7:22 AM, Vassilis Virvilis <v....@biovista.com>
wrote:
> On Monday 03 March 2008, Nandana Mihindukulasooriya wrote:
> > Hi Nuria,
> > yes, you need to set a system property in the client side to
> > add that key store containing that cert as a trusted key store. This
> > can be simply done using
> >
> > System.setProperty("javax.net.ssl.trustStore",
> "path/to/keystore.jks");
> > System.setProperty("javax.net.ssl.trustStorePassword",
> "password");
> >
> > in the client side.
> >
> > thanks,
> > nandana
> >
> Hi everybody,
>
> When I was researching the issue this trick didn't work for me due to
> "unconnected sockets". Anyway I found a solution in devcentral.f5
>
> If the following link does not work
> http://devcentral.f5.com/weblogs/joe/archive/2005/07/06/1345.aspx
>
> just go to http://devcentral.f5.com/ and search for XTrustProvider
>
> Then all you have to do before actually connect to the axis
> webservice is XTrustProvider.install().
>
> Slick indeed.
>
> .bill
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: axis-user-unsubscribe@ws.apache.org
> For additional commands, e-mail: axis-user-help@ws.apache.org
>
>
--
Some people lived like they will never die
and died like they have never lived
Re: [Axis2] SSL server certificate
Posted by Vassilis Virvilis <v....@biovista.com>.
On Monday 03 March 2008, Nandana Mihindukulasooriya wrote:
> Hi Nuria,
> yes, you need to set a system property in the client side to
> add that key store containing that cert as a trusted key store. This
> can be simply done using
>
> System.setProperty("javax.net.ssl.trustStore", "path/to/keystore.jks");
> System.setProperty("javax.net.ssl.trustStorePassword", "password");
>
> in the client side.
>
> thanks,
> nandana
>
Hi everybody,
When I was researching the issue this trick didn't work for me due to
"unconnected sockets". Anyway I found a solution in devcentral.f5
If the following link does not work
http://devcentral.f5.com/weblogs/joe/archive/2005/07/06/1345.aspx
just go to http://devcentral.f5.com/ and search for XTrustProvider
Then all you have to do before actually connect to the axis
webservice is XTrustProvider.install().
Slick indeed.
.bill
---------------------------------------------------------------------
To unsubscribe, e-mail: axis-user-unsubscribe@ws.apache.org
For additional commands, e-mail: axis-user-help@ws.apache.org
Re: [Axis2] SSL server certificate
Posted by Nandana Mihindukulasooriya <na...@gmail.com>.
Hi Joe,
> Thanks for your comments. I'm wondering whether we should import
> certificates to the default Java trusted store
> (jre/lib/security/cacertificates) or to have a separate trusted key store
> file for our application and import certificate to it? Which one is a better
> solution from the security point of view?
I think if we maintain a key store for a application rather than
adding to the default java trust store , it will be easy to manage.
For example, if you have multiple applications with different trust
relationships then we will have to anyway maintain a key store for
each application.
> The other question how can we show certificate to the user and then import
> it programmatically the same way web-browsers do?
Right now, Axis2 + Rampart doesn't show certificate information in the
WSDL. At the moment, clients have to have the servers certificate and
they can use the java keytool import it to a key store. But we can use
XKMS to do the key management programaticaly. But right now Rampart
doesn't support XKMS either. Take a look at the XKMS sample - [1]
which comes with the WSO2 WSAS distribution.
thanks,
/nandana
[1] - http://www.ibm.com/developerworks/xml/library/x-seclay3/
[2] - http://wso2.org/project/wsas/java/2.2.1/docs/xkms_sample_guide.html
> Joe
>
>
>
> On Mon, Mar 3, 2008 at 10:09 AM, Nandana Mihindukulasooriya
> <na...@gmail.com> wrote:
> >
> >
> >
> > Hi Nuria,
> > yes, you need to set a system property in the client side to
> > add that key store containing that cert as a trusted key store. This
> > can be simply done using
> >
> > System.setProperty("javax.net.ssl.trustStore",
> "path/to/keystore.jks");
> > System.setProperty("javax.net.ssl.trustStorePassword", "password");
> >
> > in the client side.
> >
> > thanks,
> > nandana
> >
> > On Mon, Mar 3, 2008 at 8:14 PM, Nuria Rodríguez García
> >
> > <nu...@gmail.com> wrote:
> > >
> > >
> >
> >
> >
> > > Hello:
> > >
> > >
> > >
> > > I'm using Axis2 and I need to use SSL to connect to a WS.
> > >
> > > In server side I do the following:
> > >
> > >
> > >
> > > I configure the server.xml file in tomcat. I have:
> > >
> > > <Connector port="8443"
> > >
> > > maxThreads="150" minSpareThreads="25"
> maxSpareThreads="75"
> > >
> > > enableLookups="false" disableUploadTimeout="true"
> > >
> > > acceptCount="100" debug="0" scheme="https" secure="true"
> > >
> > > clientAuth="false" sslProtocol="TLS" />
> > >
> > >
> > >
> > > Then I generate a server certificate doing the following:
> > >
> > > keytool -genkey -alias tomcat -keyalg RSA
> > >
> > > keytool -export -alias tomcat -storepass
> changeit
> > > -file server.cer
> > >
> > > keytool -import -v -trustcacerts -alias tomcat
> -file
> > > server.cer -keystore %JAVA_HOME%/jre/lib/security/cacerts -keypass
> changeit
> > > -storepass changeit
> > >
> > >
> > >
> > > I start-up tomcat and when I call the service using the EPR
> > > "https://mymachine:8443/ ...." I receive the following exception:
> > >
> > >
> > >
> > > I/O exception (org.apache.axis2.AxisFault)
> caught
> > > when processing request: sun.security.validator.ValidatorException: PKIX
> > > path building failed:
> > > sun.security.provider.certpath.SunCertPathBuilderException: unable to
> find
> > > valid certification path to requested target
> > >
> > >
> > >
> > > I don't know if I need to indicate something from the client side.
> > >
> > >
> > >
> > > Thanks,
> > >
> > > Nuria
> >
> > http://nandana83.blogspot.com/
> > http://nandanasm.wordpress.com/
> >
> >
> > ---------------------------------------------------------------------
> > To unsubscribe, e-mail: axis-user-unsubscribe@ws.apache.org
> > For additional commands, e-mail: axis-user-help@ws.apache.org
> >
> >
>
>
---------------------------------------------------------------------
To unsubscribe, e-mail: axis-user-unsubscribe@ws.apache.org
For additional commands, e-mail: axis-user-help@ws.apache.org
Re: [Axis2] SSL server certificate
Posted by Joe Smithian <jo...@gmail.com>.
Hi Nandana,
Thanks for your comments. I'm wondering whether we should import
certificates to the default Java trusted store
(jre/lib/security/cacertificates) or to have a separate trusted key store
file for our application and import certificate to it? Which one is a better
solution from the security point of view?
The other question how can we show certificate to the user and then import
it programmatically the same way web-browsers do?
Thanks
Joe
On Mon, Mar 3, 2008 at 10:09 AM, Nandana Mihindukulasooriya <
nandana.cse@gmail.com> wrote:
> Hi Nuria,
> yes, you need to set a system property in the client side to
> add that key store containing that cert as a trusted key store. This
> can be simply done using
>
> System.setProperty("javax.net.ssl.trustStore",
> "path/to/keystore.jks");
> System.setProperty("javax.net.ssl.trustStorePassword", "password");
>
> in the client side.
>
> thanks,
> nandana
>
> On Mon, Mar 3, 2008 at 8:14 PM, Nuria Rodríguez García
> <nu...@gmail.com> wrote:
> >
> >
> > Hello:
> >
> >
> >
> > I'm using Axis2 and I need to use SSL to connect to a WS.
> >
> > In server side I do the following:
> >
> >
> >
> > I configure the server.xml file in tomcat. I have:
> >
> > <Connector port="8443"
> >
> > maxThreads="150" minSpareThreads="25"
> maxSpareThreads="75"
> >
> > enableLookups="false" disableUploadTimeout="true"
> >
> > acceptCount="100" debug="0" scheme="https" secure="true"
> >
> > clientAuth="false" sslProtocol="TLS" />
> >
> >
> >
> > Then I generate a server certificate doing the following:
> >
> > keytool -genkey -alias tomcat -keyalg RSA
> >
> > keytool -export -alias tomcat -storepass
> changeit
> > -file server.cer
> >
> > keytool -import -v -trustcacerts -alias tomcat
> -file
> > server.cer -keystore %JAVA_HOME%/jre/lib/security/cacerts -keypass
> changeit
> > -storepass changeit
> >
> >
> >
> > I start-up tomcat and when I call the service using the EPR
> > "https://mymachine:8443/ ...." I receive the following exception:
> >
> >
> >
> > I/O exception (org.apache.axis2.AxisFault)
> caught
> > when processing request: sun.security.validator.ValidatorException: PKIX
> > path building failed:
> > sun.security.provider.certpath.SunCertPathBuilderException: unable to
> find
> > valid certification path to requested target
> >
> >
> >
> > I don't know if I need to indicate something from the client side.
> >
> >
> >
> > Thanks,
> >
> > Nuria
>
> http://nandana83.blogspot.com/
> http://nandanasm.wordpress.com/
>
> ---------------------------------------------------------------------
> To unsubscribe, e-mail: axis-user-unsubscribe@ws.apache.org
> For additional commands, e-mail: axis-user-help@ws.apache.org
>
>
Re: [Axis2] SSL server certificate
Posted by Nandana Mihindukulasooriya <na...@gmail.com>.
Hi Nuria,
yes, you need to set a system property in the client side to
add that key store containing that cert as a trusted key store. This
can be simply done using
System.setProperty("javax.net.ssl.trustStore", "path/to/keystore.jks");
System.setProperty("javax.net.ssl.trustStorePassword", "password");
in the client side.
thanks,
nandana
On Mon, Mar 3, 2008 at 8:14 PM, Nuria Rodríguez García
<nu...@gmail.com> wrote:
>
>
> Hello:
>
>
>
> I'm using Axis2 and I need to use SSL to connect to a WS.
>
> In server side I do the following:
>
>
>
> I configure the server.xml file in tomcat. I have:
>
> <Connector port="8443"
>
> maxThreads="150" minSpareThreads="25" maxSpareThreads="75"
>
> enableLookups="false" disableUploadTimeout="true"
>
> acceptCount="100" debug="0" scheme="https" secure="true"
>
> clientAuth="false" sslProtocol="TLS" />
>
>
>
> Then I generate a server certificate doing the following:
>
> keytool -genkey -alias tomcat -keyalg RSA
>
> keytool -export -alias tomcat -storepass changeit
> -file server.cer
>
> keytool -import -v -trustcacerts -alias tomcat -file
> server.cer -keystore %JAVA_HOME%/jre/lib/security/cacerts -keypass changeit
> -storepass changeit
>
>
>
> I start-up tomcat and when I call the service using the EPR
> "https://mymachine:8443/ ...." I receive the following exception:
>
>
>
> I/O exception (org.apache.axis2.AxisFault) caught
> when processing request: sun.security.validator.ValidatorException: PKIX
> path building failed:
> sun.security.provider.certpath.SunCertPathBuilderException: unable to find
> valid certification path to requested target
>
>
>
> I don't know if I need to indicate something from the client side.
>
>
>
> Thanks,
>
> Nuria
http://nandana83.blogspot.com/
http://nandanasm.wordpress.com/
---------------------------------------------------------------------
To unsubscribe, e-mail: axis-user-unsubscribe@ws.apache.org
For additional commands, e-mail: axis-user-help@ws.apache.org
Re: [Axis2] SSL server certificate
Posted by Jinyuan Zhou <zh...@gmail.com>.
Nuria,
Yes, when your client call a an EPR with https, your client need to able to
trust the certificate from that site. Basically you need to put the
certificate into a key store for your client side code to use. I am new to
Axis 2 too, I don't know if Axis2 client support the configuration
of keys store. It is similar to the what web browser acts when you firste
time visit an https site. It alert you if you want to trust the site
and/or install the certificate from site. If you bowser end up installing
the certificate, then next time you visit the site, the alert won't come up.
I don't remember all the details about validating a cerfiteicate agains a
key store. But you can simpley goolge it.
Regards,
Jack
On 3/3/08, Nuria Rodríguez García <nu...@gmail.com> wrote:
>
> Hello:
>
>
>
> I'm using Axis2 and I need to use SSL to connect to a WS.
>
> In server side I do the following:
>
>
>
> I configure the server.xml file in tomcat. I have:
>
> <Connector port="8443"
>
> maxThreads="150" minSpareThreads="25" maxSpareThreads="75"
>
> enableLookups="false" disableUploadTimeout="true"
>
> acceptCount="100" debug="0" scheme="https" secure="true"
>
> clientAuth="false" sslProtocol="TLS" />
>
>
>
> Then I generate a server certificate doing the following:
>
> keytool -genkey -alias tomcat -keyalg RSA
>
> keytool -export -alias tomcat -storepass changeit
> -file server.cer
>
> keytool -import -v -trustcacerts -alias tomcat
> -file server.cer -keystore %JAVA_HOME%/jre/lib/security/cacerts -keypass
> changeit -storepass changeit
>
>
>
> I start-up tomcat and when I call the service using the EPR "
> https://mymachine:8443/ ...." I receive the following exception:
>
>
>
> I/O exception (org.apache.axis2.AxisFault) caught
> when processing request: *sun.security.validator.ValidatorException*: PKIX
> path building failed: *
> sun.security.provider.certpath.SunCertPathBuilderException*: unable to
> find valid certification path to requested target
>
>
>
> I don't know if I need to indicate something from the client side.
>
>
>
> Thanks,
>
> Nuria
>
--
Some people lived like they will never die
and died like they have never lived