Improve company productivity with a Business Account.Sign Up

x
  • Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 9141
  • Last Modified:

Java Web service client usage of SSL certificate for SOAP over HTTPS

I have a simple java webservice client (no container) that makes a Web service call (SOAP) over HTTP.Now the server (service provider) is moving to HTTPS  . I am on a Red Hat Linux env. , I am wondering what steps I need to take to make this happen  ? Since I am not running this on a cotainer (servlet or EE) I am scared that I have to do a lot of  work on my side ?

As a developer do I have to worry about anything .Its working well with HTTP the move to HTTPS is worrying me ..as I dont have a lot of resources at my end  .
0
Shaunsmith
Asked:
Shaunsmith
2 Solutions
 
gudii9Commented:
Here is intersting explanation, links


When Webservices are used, a common concern is security: SOAP messages are transferred in plain text over the network, so anyone with a sniffer could intercept the SOAP message and read it. In my opinion this could happen also to binary data, but probably it requires a little bit more hacker skills. So a solution is to use HTTPS (SSL) instead of HTTP, so the communication is encrypted. To accomplish this, you need to get and install a certificate (issued by a Certificate Authority) on your webserver. In a production environment you would buy a certificate from Verisign or another well known CA, or you would install your own CA, which is a component of Windows Server. If you only want to play with HTTPS, SSL and certificates or your project is in the development phase, you can also generate a test certificate using the MakeCert.exe tool (included in the .NET Framework SDK). After that you have to add this certificate to a website in IIS, and set a port which HTTPS should use.

When you browse to a HTTPS site, you probably get a dialog window asking you if you want to trust the certificate provided by the webserver. So the responsibility of accepting the certificate is handled by the user. Let's get back to the webservice scenario, if you want to invoke a webservice located on a webserver which uses SSL and HTTPS there is a problem. When you make the call from code, there is no dialog window popping up, and asking if you trust the certificate (luckily because this would be pretty ugly in server-side scenarios); probably you'll get following exception:
An unhandled exception of type 'System.Net.WebException' occurred in system.dll

Additional information: The underlying connection was closed: Could not establish trust relationship with remote server.

But there is a solution for this problem, you can solve this in your code by creating your own CertificatePolicy class
http://www.pankaj-k.net/WSOverSSL/WSOverSSL-HOWTO.html

http://weblogs.asp.net/jan/archive/2003/12/04/41154.aspx

http://forums.instantiations.com/topic-12-2408.html

http://forums.devx.com/showthread.php?t=56937
0
 
for_yanCommented:
You should not need container to use the client of web service - you should be able to handle it without container.

look here:
http://stackoverflow.com/questions/1255083/consuming-https-web-services

and the lnink inside:

http://stackoverflow.com/questions/875467/java-client-certificates-over-https-ssl
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

NEW Internet Security Report Now Available!

WatchGuard’s Threat Lab is a group of dedicated threat researchers committed to helping you stay ahead of the bad guys by providing in-depth analysis of the top security threats to your network.  Check out this quarters report on the threats that shook the industry in Q4 2017.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now