How to programmatically set the SSLContext of a JAX-WS client?

by

This one was a hard nut to crack, so for the record:

To solve this, it required a custom KeyManager and a SSLSocketFactory that uses this custom KeyManager to access the separated KeyStore.
I found the base code for this KeyStore and SSLFactory on this excellent blog entry:
how-to-dynamically-select-a-certificate-alias-when-invoking-web-services

Then, the specialized SSLSocketFactory needs to be inserted into the WebService context:

service = getWebServicePort(getWSDLLocation());
BindingProvider bindingProvider = (BindingProvider) service; 
bindingProvider.getRequestContext().put("com.sun.xml.internal.ws.transport.https.client.SSLSocketFactory", getCustomSocketFactory());

Where the getCustomSocketFactory() returns a SSLSocketFactory created using the method mentioned above. This would only work for JAX-WS RI from the Sun-Oracle impl built into the JDK, given that the string indicating the SSLSocketFactory property is proprietary for this implementation.

At this stage, the JAX-WS service communication is secured through SSL, but if you are loading the WSDL from the same secure server () then you’ll have a bootstrap problem, as the HTTPS request to gather the WSDL will not be using the same credentials than the Web Service. I worked around this problem by making the WSDL locally available (file:///…) and dynamically changing the web service endpoint: (a good discussion on why this is needed can be found in this forum)

bindingProvider.getRequestContext().put(BindingProvider.ENDPOINT_ADDRESS_PROPERTY, webServiceLocation);

Now the WebService gets bootstrapped and is able to communicate through SSL with the server counterpart using a named (alias) Client-Certificate and mutual authentication. ∎

More Related Contents:

  1. Trusting all certificates using HttpClient over HTTPS
  2. why doesn’t java send the client certificate during SSL handshake?
  3. How to fix the “java.security.cert.CertificateException: No subject alternative names present” error?
  4. How to ignore PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException?
  5. How to convert certificate from PEM to JKS?
  6. PKIX path building failed in Java application
  7. How do I do TLS with BouncyCastle?
  8. Can we load multiple Certificates & Keys in a Key Store?
  9. Received fatal alert: handshake_failure through SSLHandshakeException
  10. Java client certificates over HTTPS/SSL
  11. How to ignore SSL certificate errors in Apache HttpClient 4.0
  12. How to properly import a selfsigned certificate into Java keystore that is available to all Java applications by default?
  13. Import PEM into Java Key Store
  14. How to do a SOAP Web Service call from Java class?
  15. Does Java support Let’s Encrypt certificates?
  16. limiting java ssl debug logging
  17. Extended server_name (SNI Extension) not sent with jdk1.8.0 but send with jdk1.7.0
  18. How to convert .pfx file to keystore with private key?
  19. How to set TLS version on apache HttpClient
  20. Javamail Could not convert socket to TLS GMail
  21. Java and HTTPS url connection without downloading certificate
  22. Whats an easy way to totally ignore ssl with java url connections?
  23. Changing the default XML namespace prefix generated with JAXWS
  24. Java SSL connect, add server cert to keystore programmatically
  25. Using SSLContext with just a CA certificate and no keystore
  26. How to configure trustStore for javax.net.ssl.trustStore on windows?
  27. Android SSL HttpGet (No peer certificate) error OR (Connection closed by peer) error
  28. SSL “Peer Not Authenticated” error with HttpClient 4.1
  29. How to build a SSLSocketFactory from PEM certificate and key without converting to keystore?
  30. Creating .p12 truststore with openssl

Leave a Comment