Solved

Java Web service client  usage of SSL certificate for SOAP over HTTPS

Posted on 2012-03-22
2
5,952 Views
Last Modified: 2012-05-24
I have a simple java webservice client (no container) that makes a Web service call (SOAP) over HTTP.Now the server (service provider) is moving to HTTPS  . I am on a Red Hat Linux env. , I am wondering what steps I need to take to make this happen  ? Since I am not running this on a cotainer (servlet or EE) I am scared that I have to do a lot of  work on my side ?

As a developer do I have to worry about anything .Its working well with HTTP the move to HTTPS is worrying me ..as I dont have a lot of resources at my end  .
0
Comment
Question by:Shaunsmith
2 Comments
 
LVL 7

Assisted Solution

by:gudii9
gudii9 earned 250 total points
ID: 37754361
Here is intersting explanation, links


When Webservices are used, a common concern is security: SOAP messages are transferred in plain text over the network, so anyone with a sniffer could intercept the SOAP message and read it. In my opinion this could happen also to binary data, but probably it requires a little bit more hacker skills. So a solution is to use HTTPS (SSL) instead of HTTP, so the communication is encrypted. To accomplish this, you need to get and install a certificate (issued by a Certificate Authority) on your webserver. In a production environment you would buy a certificate from Verisign or another well known CA, or you would install your own CA, which is a component of Windows Server. If you only want to play with HTTPS, SSL and certificates or your project is in the development phase, you can also generate a test certificate using the MakeCert.exe tool (included in the .NET Framework SDK). After that you have to add this certificate to a website in IIS, and set a port which HTTPS should use.

When you browse to a HTTPS site, you probably get a dialog window asking you if you want to trust the certificate provided by the webserver. So the responsibility of accepting the certificate is handled by the user. Let's get back to the webservice scenario, if you want to invoke a webservice located on a webserver which uses SSL and HTTPS there is a problem. When you make the call from code, there is no dialog window popping up, and asking if you trust the certificate (luckily because this would be pretty ugly in server-side scenarios); probably you'll get following exception:
An unhandled exception of type 'System.Net.WebException' occurred in system.dll

Additional information: The underlying connection was closed: Could not establish trust relationship with remote server.

But there is a solution for this problem, you can solve this in your code by creating your own CertificatePolicy class
http://www.pankaj-k.net/WSOverSSL/WSOverSSL-HOWTO.html

http://weblogs.asp.net/jan/archive/2003/12/04/41154.aspx

http://forums.instantiations.com/topic-12-2408.html

http://forums.devx.com/showthread.php?t=56937
0
 
LVL 47

Accepted Solution

by:
for_yan earned 250 total points
ID: 37754372
You should not need container to use the client of web service - you should be able to handle it without container.

look here:
http://stackoverflow.com/questions/1255083/consuming-https-web-services

and the lnink inside:

http://stackoverflow.com/questions/875467/java-client-certificates-over-https-ssl
0

Featured Post

Microsoft Certification Exam 74-409

Veeam® is happy to provide the Microsoft community with a study guide prepared by MVP and MCT, Orin Thomas. This guide will take you through each of the exam objectives, helping you to prepare for and pass the examination.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
lunix and unix command 21 86
centos commands 6 68
Review of a VPN cert policy 4 43
Linux FTP Error 5 33
Go is an acronym of golang, is a programming language developed Google in 2007. Go is a new language that is mostly in the C family, with significant input from Pascal/Modula/Oberon family. Hence Go arisen as low-level language with fast compilation…
Introduction This article is the first of three articles that explain why and how the Experts Exchange QA Team does test automation for our web site. This article explains our test automation goals. Then rationale is given for the tools we use to a…
Video by: Michael
Viewers learn about how to reduce the potential repetitiveness of coding in main by developing methods to perform specific tasks for their program. Additionally, objects are introduced for the purpose of learning how to call methods in Java. Define …
Viewers will learn how to properly install Eclipse with the necessary JDK, and will take a look at an introductory Java program. Download Eclipse installation zip file: Extract files from zip file: Download and install JDK 8: Open Eclipse and …

856 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question