Solved

Java Web service client  usage of SSL certificate for SOAP over HTTPS

Posted on 2012-03-22
2
5,246 Views
Last Modified: 2012-05-24
I have a simple java webservice client (no container) that makes a Web service call (SOAP) over HTTP.Now the server (service provider) is moving to HTTPS  . I am on a Red Hat Linux env. , I am wondering what steps I need to take to make this happen  ? Since I am not running this on a cotainer (servlet or EE) I am scared that I have to do a lot of  work on my side ?

As a developer do I have to worry about anything .Its working well with HTTP the move to HTTPS is worrying me ..as I dont have a lot of resources at my end  .
0
Comment
Question by:Shaunsmith
2 Comments
 
LVL 7

Assisted Solution

by:gudii9
gudii9 earned 250 total points
Comment Utility
Here is intersting explanation, links


When Webservices are used, a common concern is security: SOAP messages are transferred in plain text over the network, so anyone with a sniffer could intercept the SOAP message and read it. In my opinion this could happen also to binary data, but probably it requires a little bit more hacker skills. So a solution is to use HTTPS (SSL) instead of HTTP, so the communication is encrypted. To accomplish this, you need to get and install a certificate (issued by a Certificate Authority) on your webserver. In a production environment you would buy a certificate from Verisign or another well known CA, or you would install your own CA, which is a component of Windows Server. If you only want to play with HTTPS, SSL and certificates or your project is in the development phase, you can also generate a test certificate using the MakeCert.exe tool (included in the .NET Framework SDK). After that you have to add this certificate to a website in IIS, and set a port which HTTPS should use.

When you browse to a HTTPS site, you probably get a dialog window asking you if you want to trust the certificate provided by the webserver. So the responsibility of accepting the certificate is handled by the user. Let's get back to the webservice scenario, if you want to invoke a webservice located on a webserver which uses SSL and HTTPS there is a problem. When you make the call from code, there is no dialog window popping up, and asking if you trust the certificate (luckily because this would be pretty ugly in server-side scenarios); probably you'll get following exception:
An unhandled exception of type 'System.Net.WebException' occurred in system.dll

Additional information: The underlying connection was closed: Could not establish trust relationship with remote server.

But there is a solution for this problem, you can solve this in your code by creating your own CertificatePolicy class
http://www.pankaj-k.net/WSOverSSL/WSOverSSL-HOWTO.html

http://weblogs.asp.net/jan/archive/2003/12/04/41154.aspx

http://forums.instantiations.com/topic-12-2408.html

http://forums.devx.com/showthread.php?t=56937
0
 
LVL 47

Accepted Solution

by:
for_yan earned 250 total points
Comment Utility
You should not need container to use the client of web service - you should be able to handle it without container.

look here:
http://stackoverflow.com/questions/1255083/consuming-https-web-services

and the lnink inside:

http://stackoverflow.com/questions/875467/java-client-certificates-over-https-ssl
0

Featured Post

Why You Should Analyze Threat Actor TTPs

After years of analyzing threat actor behavior, it’s become clear that at any given time there are specific tactics, techniques, and procedures (TTPs) that are particularly prevalent. By analyzing and understanding these TTPs, you can dramatically enhance your security program.

Join & Write a Comment

SSH (Secure Shell) - Tips and Tricks As you all know SSH(Secure Shell) is a network protocol, which we use to access/transfer files securely between two networked devices. SSH was actually designed as a replacement for insecure protocols that sen…
In this post we will learn how to connect and configure Android Device (Smartphone etc.) with Android Studio. After that we will run a simple Hello World Program.
Viewers will learn about basic arrays, how to declare them, and how to use them. Introduction and definition: Declare an array and cover the syntax of declaring them: Initialize every index in the created array: Example/Features of a basic arr…
Connecting to an Amazon Linux EC2 Instance from Windows Using PuTTY.

743 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

18 Experts available now in Live!

Get 1:1 Help Now