http client cert verification

[JoeR <re...@yahoo.com>]

Could someone point me to an example or provide some guidance on what I
should do if I want to validate the cert returned from the server when I
make the https connection.

I have keystore and a truststore, but I am not sure how I tie them to the
https connection.  

Thanks in advance.

 <context:property-placeholder location="file:etc/my.cfg" />

  <cxf:cxfEndpoint id="example-WS"
                   address="${service.serviceMixexampleLocation}"
                   endpointName="s:BasicHttpBinding_example_WF"
                   serviceName="s:example_WF"
                   wsdlURL="etc/exampleService.wsdl"
                   xmlns:s="http://example.Service/example_WF">
  </cxf:cxfEndpoint>

  <camelContext id="example" xmlns="http://camel.apache.org/schema/spring">
    <route>
      <from uri="cxf:bean:example-WS"/>
 
      <to uri= "https://abc.def.net/ExampleService/WF_Service.svc"/>  
    </route>
  </camelContext>


--
View this message in context: http://camel.465427.n5.nabble.com/http-client-cert-verification-tp5542079p5542079.html
Sent from the Camel - Users mailing list archive at Nabble.com.

Re: http client cert verification

[ychawla <pr...@yahoo.com>]

On your client, you can add a HTTP conduit:

	<http:conduit
		name="*.http-conduit">
		<http:tlsClientParameters disableCNCheck="true">
			<sec:keyManagers keyPassword="password">
				<sec:keyStore type="JKS"
					password="password"
					file="my.jks" />
			</sec:keyManagers>
			<sec:trustManagers>
				<sec:keyStore type="JKS"
					password="password"
					file="truststore.ts" />
			</sec:trustManagers>
			<sec:cipherSuitesFilter>
				
				<sec:include>.*_EXPORT_.*</sec:include>
				<sec:include>.*_EXPORT1024_.*</sec:include>
				<sec:include>.*_WITH_DES_.*</sec:include>
				<sec:include>.*_WITH_NULL_.*</sec:include>
				<sec:exclude>.*_DH_anon_.*</sec:exclude>
			</sec:cipherSuitesFilter>
		</http:tlsClientParameters>
		<http:client AutoRedirect="true" Connection="Keep-Alive" />
	</http:conduit>

On the server, you can set it up to require client auth:

    <http:destination name="{http://namespace}My-Service.http-destination"/>    

  <httpj:engine-factory bus="cxf">
         
	 <httpj:engine port="18052">
	     <httpj:tlsServerParameters>
	       <sec:keyManagers keyPassword="password">
	          <sec:keyStore type="JKS" password="password" 
	               file="keystore.jks"/>
	      </sec:keyManagers>
	      <sec:trustManagers>
	          <sec:keyStore type="JKS" password="password"   
	               file="truststore.ts"/>
	      </sec:trustManagers>
	      <sec:cipherSuitesFilter>
	        
	        <sec:include>.*_EXPORT_.*</sec:include>
	        <sec:include>.*_EXPORT1024_.*</sec:include>
	        <sec:include>.*_WITH_DES_.*</sec:include>
	        <sec:include>.*_WITH_NULL_.*</sec:include>
	        <sec:exclude>.*_DH_anon_.*</sec:exclude>
	      </sec:cipherSuitesFilter>
	      <sec:clientAuthentication want="true" required="true"/>
	    </httpj:tlsServerParameters>
	  </httpj:engine>
   </httpj:engine-factory>

Check here for CXF configuration:

http://cxf.apache.org/docs/jetty-configuration.html

Thanks,
Yogesh

--
View this message in context: http://camel.465427.n5.nabble.com/http-client-cert-verification-tp5542079p5542552.html
Sent from the Camel - Users mailing list archive at Nabble.com.