You are viewing a plain text version of this content. The canonical link for it is here.
Posted to users@cxf.apache.org by dkundo <dk...@yahoo.com> on 2016/12/20 15:56:06 UTC
How CXF SOAP server can present a different certificate to
different clients?
Hi,
my server is listening on multiple IP addresses, and according to the IP
client has opened a connection to, a different server certificate should be
presented (it's a multi-tenant application where each tenant connects to its
own IP address).
If I understand correctly I need to implement my own KeyManager, holding
multiple certificates and choosing the right one based on the connections'
destination IP, but I'd appreciate a confirmation that this is the right
thing to do, and also get some code examples / instructions.
it's a stand-alone application.
Using CXF 3.1.0
The CXF configuration is done with Spring.
Thanks you
--
View this message in context: http://cxf.547215.n5.nabble.com/How-CXF-SOAP-server-can-present-a-different-certificate-to-different-clients-tp5775940.html
Sent from the cxf-user mailing list archive at Nabble.com.
Re: How CXF SOAP server can present a different certificate to
different clients?
Posted by Jose María Zaragoza <de...@gmail.com>.
2016-12-20 17:09 GMT+01:00 Gregory Orciuch <g....@gmail.com>:
> Hi,
>
> we have been solving this kind of issues placing a SSL terminating
> load-balancer before CXF instances;
> Also we considered in-app SSL certficates as not good idea because of
> managing troubles and revocation troubles, and validity checking troubles;
>
> Cheers,
> Gregory
>
> 2016-12-20 16:56 GMT+01:00 dkundo <dk...@yahoo.com>:
>
>> Hi,
>> my server is listening on multiple IP addresses, and according to the IP
>> client has opened a connection to, a different server certificate should be
>> presented (it's a multi-tenant application where each tenant connects to
>> its
>> own IP address).
>> If I understand correctly I need to implement my own KeyManager, holding
>> multiple certificates and choosing the right one based on the connections'
>> destination IP, but I'd appreciate a confirmation that this is the right
>> thing to do, and also get some code examples / instructions.
>>
I'd use a server with SNI support + virtual hosts
I think Tomcat 8+ do it
Or you could use a frontend with SNI support, like HAProxy , and to
terminate SSL connection here ( like the latter answer )
>> it's a stand-alone application.
>> Using CXF 3.1.0
>> The CXF configuration is done with Spring.
>>
>> Thanks you
>>
>>
>>
>>
>>
>>
>> --
>> View this message in context: http://cxf.547215.n5.nabble.
>> com/How-CXF-SOAP-server-can-present-a-different-certificate-to-different-
>> clients-tp5775940.html
>> Sent from the cxf-user mailing list archive at Nabble.com.
>>
Re: How CXF SOAP server can present a different certificate to
different clients?
Posted by "Vjacheslav V. Borisov" <sl...@gmail.com>.
Hi!
apache mod_proxy_ajp + tomcat AJP connector could be used
in this config different apache vhosts could have own authorisation
configuration,
all connected to one tomcat AJP connector
2016-12-20 20:09 GMT+04:00 Gregory Orciuch <g....@gmail.com>:
> Hi,
>
> we have been solving this kind of issues placing a SSL terminating
> load-balancer before CXF instances;
> Also we considered in-app SSL certficates as not good idea because of
> managing troubles and revocation troubles, and validity checking troubles;
>
> Cheers,
> Gregory
>
> 2016-12-20 16:56 GMT+01:00 dkundo <dk...@yahoo.com>:
>
> > Hi,
> > my server is listening on multiple IP addresses, and according to the IP
> > client has opened a connection to, a different server certificate should
> be
> > presented (it's a multi-tenant application where each tenant connects to
> > its
> > own IP address).
> > If I understand correctly I need to implement my own KeyManager, holding
> > multiple certificates and choosing the right one based on the
> connections'
> > destination IP, but I'd appreciate a confirmation that this is the right
> > thing to do, and also get some code examples / instructions.
> >
> > it's a stand-alone application.
> > Using CXF 3.1.0
> > The CXF configuration is done with Spring.
> >
> > Thanks you
> >
> >
> >
> >
> >
> >
> > --
> > View this message in context: http://cxf.547215.n5.nabble.
> > com/How-CXF-SOAP-server-can-present-a-different-
> certificate-to-different-
> > clients-tp5775940.html
> > Sent from the cxf-user mailing list archive at Nabble.com.
> >
>
Re: How CXF SOAP server can present a different certificate to
different clients?
Posted by Gregory Orciuch <g....@gmail.com>.
Hi,
we have been solving this kind of issues placing a SSL terminating
load-balancer before CXF instances;
Also we considered in-app SSL certficates as not good idea because of
managing troubles and revocation troubles, and validity checking troubles;
Cheers,
Gregory
2016-12-20 16:56 GMT+01:00 dkundo <dk...@yahoo.com>:
> Hi,
> my server is listening on multiple IP addresses, and according to the IP
> client has opened a connection to, a different server certificate should be
> presented (it's a multi-tenant application where each tenant connects to
> its
> own IP address).
> If I understand correctly I need to implement my own KeyManager, holding
> multiple certificates and choosing the right one based on the connections'
> destination IP, but I'd appreciate a confirmation that this is the right
> thing to do, and also get some code examples / instructions.
>
> it's a stand-alone application.
> Using CXF 3.1.0
> The CXF configuration is done with Spring.
>
> Thanks you
>
>
>
>
>
>
> --
> View this message in context: http://cxf.547215.n5.nabble.
> com/How-CXF-SOAP-server-can-present-a-different-certificate-to-different-
> clients-tp5775940.html
> Sent from the cxf-user mailing list archive at Nabble.com.
>