Ik heb dus een probleem, wat ik op het JCD forum heb gepost. Ik post het ook hier, in de hoop dat er een mede-webservicedeveloper-tweaker een oplossing heeft:
This is my situation:
I'm developing a webservice using:
- JDK 1.4.1
- JWSDP 1.1
- Axis 1.1
I want to authenticate all clients using the webservice, so no unauthorized clients may can use it. Therefore, I want to implement SSL mutual authentication (if anyone knows a better method, please let me know).
Now I've got the server-side authentication running, with help from the Java Web Services Tutorial:
http://java.sun.com/webse...AppSecurity6.html#wp83632
However, I find it strange they call it "server-side authentication", because it is actually the client that authenticates the server. (client needs to trust the server certificate, not the other way around).
I've configured my webapps as follows:
Webservice:
Runs in JWSDP - Axis, Tomcat server.xml SSL connectorfactory set to clientAuth=true.
server.keystore contains client certificate
cacerts contains client certificate and server certificate
Client:
Runs in JWSDP (different webapp)
I've set the keystore and password:
System.setProperty("javax.net.ssl.trustStore", "client.keystore");
System.setProperty("javax.net.ssl.trustStorePassword", "changeit");
client.keystore containts server certificate
I also set the auth-method property in the client deployment descriptor:
<login-config>
<auth-method>CLIENT-CERT</auth-method>
</login-config>
However, it is unclear to me (from the tutorial) whether I should set this in the webservices' web.xml or the clients' web.xml. I tried both, neither works.
When I enable clientAuth in the tomcat server.xml, I get the following exception in my launcher.server.log:
PoolTcpEndpoint: Handshake failed
javax.net.ssl.SSLHandshakeException: null cert chain
Now I've searched this forum and the web for a solution, but I was unable to find one.
Thanks in advance to anyone who has a solution!
This is my situation:
I'm developing a webservice using:
- JDK 1.4.1
- JWSDP 1.1
- Axis 1.1
I want to authenticate all clients using the webservice, so no unauthorized clients may can use it. Therefore, I want to implement SSL mutual authentication (if anyone knows a better method, please let me know).
Now I've got the server-side authentication running, with help from the Java Web Services Tutorial:
http://java.sun.com/webse...AppSecurity6.html#wp83632
However, I find it strange they call it "server-side authentication", because it is actually the client that authenticates the server. (client needs to trust the server certificate, not the other way around).
I've configured my webapps as follows:
Webservice:
Runs in JWSDP - Axis, Tomcat server.xml SSL connectorfactory set to clientAuth=true.
server.keystore contains client certificate
cacerts contains client certificate and server certificate
Client:
Runs in JWSDP (different webapp)
I've set the keystore and password:
System.setProperty("javax.net.ssl.trustStore", "client.keystore");
System.setProperty("javax.net.ssl.trustStorePassword", "changeit");
client.keystore containts server certificate
I also set the auth-method property in the client deployment descriptor:
<login-config>
<auth-method>CLIENT-CERT</auth-method>
</login-config>
However, it is unclear to me (from the tutorial) whether I should set this in the webservices' web.xml or the clients' web.xml. I tried both, neither works.
When I enable clientAuth in the tomcat server.xml, I get the following exception in my launcher.server.log:
PoolTcpEndpoint: Handshake failed
javax.net.ssl.SSLHandshakeException: null cert chain
Now I've searched this forum and the web for a solution, but I was unable to find one.
Thanks in advance to anyone who has a solution!