CXF SSL configuration for consuming SOAP webservice

apache ssl soap cxf p12
saeedj picture saeedj · Sep 9, 2016 · Viewed 7.3k times · Source

Overview I am going to set SSL configuration for calling a SOAP webservice.

Certificate info:

  • Certificate file: sureft.p12
  • Password: sureft

CXF configuration file (cxf.xml): 

<beans xmlns="http://www.springframework.org/schema/beans"
       xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
       xmlns:sec="http://cxf.apache.org/configuration/security"
       xmlns:http="http://cxf.apache.org/transports/http/configuration"
       xmlns:jaxws="http://java.sun.com/xml/ns/jaxws" xmlns:cxf="http://www.springframework.org/schema/c"
       xsi:schemaLocation="
      http://cxf.apache.org/configuration/security
      http://cxf.apache.org/schemas/configuration/security.xsd
      http://cxf.apache.org/transports/http/configuration
      http://cxf.apache.org/schemas/configuration/http-conf.xsd
      http://www.springframework.org/schema/beans
      http://www.springframework.org/schema/beans/spring-beans-2.0.xsd">

    <http:conduit name="{http://tmr.qld.gov.au/srvc/getregistrationstatus/v2_0}GetRegistrationStatusPort.http-conduit">

<http:tlsClientParameters>
            <sec:keyManagers keyPassword="sureft">
                <sec:keyStore type="pksc12" password="sureft"
                              file="keystore/sureft.p12"/>
            </sec:keyManagers>
</http:tlsClientParameters>

<http:client AutoRedirect="true" Connection="Keep-Alive"/>

    </http:conduit>
</beans>

Issue

However, when the webservice invoked it throws 403: 

org.springframework.web.util.NestedServletException: Request processing failed; nested exception is com.sun.xml.internal.ws.client.ClientTransportException: The server sent HTTP status code 403: Forbidden

I had a look on http://cxf.apache.org/docs/client-http-transport-including-ssl-support.html but I couldn't solve the isse. Now I would be grateful if anyone can help me find solution for this problem.

Update Level 1:

I did the following changes but again 403 raised:

. Creating truststore:

  • Export Create cer file with name myCert.cer from sureft.p12
  • Create truststore certificate with name of myTruststore.jks by running: keytool -import -file myCert.cer -alias firstCA -keystore myTrustStore.jks
  • Changing cxf.xml file as follows to add truststore:

...

<http:tlsClientParameters>
        <sec:keyManagers keyPassword="sureft">
            <sec:keyStore type="pkcs12" password="sureft"
                          file="keystore/sureft.p12"/>
        </sec:keyManagers>
        <sec:trustManagers>
            <sec:keyStore type="JKS" password="123456"
                          file="keystore/myTrustStore.jks"/>
        </sec:trustManagers>
</http:tlsClientParameters>

...

Update Level 2

I changed my code as following and the 403 solved but another issue raised: 

@RequestMapping(method = RequestMethod.GET)
    public void getBillInfo2(String plateNumber) {
        QName qname = new QName("http://testURL/srvc/getregistrationstatus/v2_0/", "GetRegistrationStatusService");
        URL wsdl = getClass().getResource("wsdl/test.getregistrationstatus.v2_0.wsdl");
        GetRegistrationStatusService service = new GetRegistrationStatusService(wsdl, qname);
        GetRegistrationStatus registrationStatus = service.getPort(qname, GetRegistrationStatus.class);

        Client client = ClientProxy.getClient(registrationStatus);
        HTTPConduit http = (HTTPConduit) client.getConduit();

        HTTPClientPolicy httpClientPolicy = new HTTPClientPolicy();

        httpClientPolicy.setConnectionTimeout(36000);
        httpClientPolicy.setAllowChunking(false);
        httpClientPolicy.setReceiveTimeout(32000);
        httpClientPolicy.setContentType("application/soap+xml; charset=utf-8");

        http.setClient(httpClientPolicy);

        GetRegistrationStatusRequest request = new GetRegistrationStatusRequest();

        request.setPlateNo(plateNumber);
        GetRegistrationStatusResponse result = registrationStatus.execute(request);
        log.debug(result.toString());

    }

The Exception: 

org.springframework.web.util.NestedServletException: Request processing failed; nested exception is javax.xml.ws.soap.SOAPFaultException: Fault string, and possibly fault code, not set

    at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:980)
    at org.springframework.web.servlet.FrameworkServlet.doGet(FrameworkServlet.java:859)
    at javax.servlet.http.HttpServlet.service(HttpServlet.java:622)
    at org.springframework.web.servlet.FrameworkServlet.service(FrameworkServlet.java:844)
    at org.springframework.test.web.servlet.TestDispatcherServlet.service(TestDispatcherServlet.java:65)
    at javax.servlet.http.HttpServlet.service(HttpServlet.java:729)
    at org.springframework.mock.web.MockFilterChain$ServletFilterProxy.doFilter(MockFilterChain.java:167)
    at org.springframework.mock.web.MockFilterChain.doFilter(MockFilterChain.java:134)
    at org.springframework.web.filter.ShallowEtagHeaderFilter.doFilterInternal(ShallowEtagHeaderFilter.java:87)
    at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:107)
    at org.springframework.mock.web.MockFilterChain.doFilter(MockFilterChain.java:134)
    at org.springframework.test.web.servlet.MockMvc.perform(MockMvc.java:155)
    at com.blss.trails.registration.RegistrationSearchInvocationTest.test(RegistrationSearchInvocationTest.java:47)
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
    at java.lang.reflect.Method.invoke(Method.java:498)
    at org.junit.runners.model.FrameworkMethod$1.runReflectiveCall(FrameworkMethod.java:50)
    at org.junit.internal.runners.model.ReflectiveCallable.run(ReflectiveCallable.java:12)
    at org.junit.runners.model.FrameworkMethod.invokeExplosively(FrameworkMethod.java:47)
    at org.junit.internal.runners.statements.InvokeMethod.evaluate(InvokeMethod.java:17)
    at org.junit.internal.runners.statements.RunBefores.evaluate(RunBefores.java:26)
    at org.springframework.test.context.junit4.statements.RunBeforeTestMethodCallbacks.evaluate(RunBeforeTestMethodCallbacks.java:75)
    at org.springframework.test.context.junit4.statements.RunAfterTestMethodCallbacks.evaluate(RunAfterTestMethodCallbacks.java:86)
    at org.springframework.test.context.junit4.statements.SpringRepeat.evaluate(SpringRepeat.java:84)
    at org.junit.runners.ParentRunner.runLeaf(ParentRunner.java:325)
    at org.springframework.test.context.junit4.SpringJUnit4ClassRunner.runChild(SpringJUnit4ClassRunner.java:254)
    at org.springframework.test.context.junit4.SpringJUnit4ClassRunner.runChild(SpringJUnit4ClassRunner.java:89)
    at org.junit.runners.ParentRunner$3.run(ParentRunner.java:290)
    at org.junit.runners.ParentRunner$1.schedule(ParentRunner.java:71)
    at org.junit.runners.ParentRunner.runChildren(ParentRunner.java:288)
    at org.junit.runners.ParentRunner.access$000(ParentRunner.java:58)
    at org.junit.runners.ParentRunner$2.evaluate(ParentRunner.java:268)
    at org.springframework.test.context.junit4.statements.RunBeforeTestClassCallbacks.evaluate(RunBeforeTestClassCallbacks.java:61)
    at org.springframework.test.context.junit4.statements.RunAfterTestClassCallbacks.evaluate(RunAfterTestClassCallbacks.java:70)
    at org.junit.runners.ParentRunner.run(ParentRunner.java:363)
    at org.springframework.test.context.junit4.SpringJUnit4ClassRunner.run(SpringJUnit4ClassRunner.java:193)
    at org.junit.runner.JUnitCore.run(JUnitCore.java:137)
    at com.intellij.junit4.JUnit4IdeaTestRunner.startRunnerWithArgs(JUnit4IdeaTestRunner.java:117)
    at com.intellij.junit4.JUnit4IdeaTestRunner.startRunnerWithArgs(JUnit4IdeaTestRunner.java:42)
    at com.intellij.rt.execution.junit.JUnitStarter.prepareStreamsAndStart(JUnitStarter.java:262)
    at com.intellij.rt.execution.junit.JUnitStarter.main(JUnitStarter.java:84)
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
    at java.lang.reflect.Method.invoke(Method.java:498)
    at com.intellij.rt.execution.application.AppMain.main(AppMain.java:147)
Caused by: javax.xml.ws.soap.SOAPFaultException: Fault string, and possibly fault code, not set
    at org.apache.cxf.jaxws.JaxWsClientProxy.invoke(JaxWsClientProxy.java:161)
    at com.sun.proxy.$Proxy104.execute(Unknown Source)
    at com.blss.trails.registration.RegistrationSearchInvocation.getBillInfo2(RegistrationSearchInvocation.java:72)
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
    at java.lang.reflect.Method.invoke(Method.java:498)
    at org.springframework.web.method.support.InvocableHandlerMethod.doInvoke(InvocableHandlerMethod.java:221)
    at org.springframework.web.method.support.InvocableHandlerMethod.invokeForRequest(InvocableHandlerMethod.java:136)
    at org.springframework.web.servlet.mvc.method.annotation.ServletInvocableHandlerMethod.invokeAndHandle(ServletInvocableHandlerMethod.java:110)
    at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.invokeHandlerMethod(RequestMappingHandlerAdapter.java:817)
    at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.handleInternal(RequestMappingHandlerAdapter.java:731)
    at org.springframework.web.servlet.mvc.method.AbstractHandlerMethodAdapter.handle(AbstractHandlerMethodAdapter.java:85)
    at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:959)
    at org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:893)
    at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:968)
    ... 46 more
Caused by: java.lang.NullPointerException
    at org.apache.cxf.transport.http.URLConnectionHTTPConduit.createConnection(URLConnectionHTTPConduit.java:104)
    at org.apache.cxf.transport.http.URLConnectionHTTPConduit.setupConnection(URLConnectionHTTPConduit.java:117)
    at org.apache.cxf.transport.http.HTTPConduit.prepare(HTTPConduit.java:497)
    at org.apache.cxf.interceptor.MessageSenderInterceptor.handleMessage(MessageSenderInterceptor.java:46)
    at org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(PhaseInterceptorChain.java:308)
    at org.apache.cxf.endpoint.ClientImpl.doInvoke(ClientImpl.java:514)
    at org.apache.cxf.endpoint.ClientImpl.invoke(ClientImpl.java:423)
    at org.apache.cxf.endpoint.ClientImpl.invoke(ClientImpl.java:324)
    at org.apache.cxf.endpoint.ClientImpl.invoke(ClientImpl.java:277)
    at org.apache.cxf.frontend.ClientProxy.invokeSync(ClientProxy.java:96)
    at org.apache.cxf.jaxws.JaxWsClientProxy.invoke(JaxWsClientProxy.java:139)
    ... 61 more

Any help would be highly appreciated.

Answer

saeedj picture saeedj · Sep 13, 2016

I did the following steps and the problem solved:

  1. Exporting publickey certificate from p12 certificate
  2. Adding it as truststore to my jre cacerts (More info for importing the truststore can be fount in How to solve javax.net.ssl.SSLHandshakeException Error?):

.

keytool -import -file <the cert file> -alias <some meaningful name> keystore <path to cacerts file>

.

  1. Modifying the code as follows:

...

 @RequestMapping(method = RequestMethod.GET, path = "/billinfo")
public void getBillInfo(String plateNumber) {
    QName qname = new QName("http://tmr.qld.gov.au/srvc/getregistrationstatus/v2_0/", "GetRegistrationStatusService");
    URL wsdl = getClass().getResource("wsdl/myWSDL.wsdl");
    GetRegistrationStatusService service = new GetRegistrationStatusService(wsdl, qname);

    service.addPort(qname, SOAPBinding.SOAP12HTTP_BINDING, "https://myurl/getregistrationstatus_v2_0/");
    GetRegistrationStatus registrationStatus = service.getPort(qname, GetRegistrationStatus.class);

    Client cxfClient = ClientProxy.getClient(registrationStatus);
    cxfClient.getInInterceptors().add(new LoggingInInterceptor());
    cxfClient.getOutInterceptors().add(new LoggingOutInterceptor());
    cxfClient.getOutFaultInterceptors().add(new FaultOutInterceptor());

    HTTPConduit httpConduit = (HTTPConduit) cxfClient.getConduit();

    HTTPClientPolicy httpClientPolicy = new HTTPClientPolicy();

    httpClientPolicy.setConnectionTimeout(36000);
    httpClientPolicy.setAllowChunking(false);
    httpClientPolicy.setReceiveTimeout(32000);
    httpClientPolicy.setContentType("application/soap+xml;charset=utf-8");

    httpConduit.setClient(httpClientPolicy);

    //Keystore setting
    try {
        final TLSClientParameters tlsCP = new TLSClientParameters();
        File p12File = new File("sureft.p12");
        KeyStore.Builder builder = KeyStore.Builder.newInstance("PKCS12", null, p12File, new KeyStore.PasswordProtection("sureft".toCharArray()));
        KeyStore keyStore = builder.getKeyStore();
        String keyPassword = "sureft";
        final KeyManager[] myKeyManagers = getKeyManagers(keyStore, keyPassword);
        tlsCP.setKeyManagers(myKeyManagers);

        httpConduit.setTlsClientParameters(tlsCP);

    } catch (Exception e) {
        e.printStackTrace();
    }

    GetRegistrationStatusRequest request = new GetRegistrationStatusRequest();

    request.setPlateNo(plateNumber);
    GetRegistrationStatusResponse result = registrationStatus.execute(request);
    log.debug("Result: " + result.toString());

}

private static KeyManager[] getKeyManagers(KeyStore keyStore, String keyPassword) throws GeneralSecurityException, IOException {
        String alg = KeyManagerFactory.getDefaultAlgorithm();
        char[] keyPass = keyPassword != null ? keyPassword.toCharArray() : null;
        KeyManagerFactory fac = KeyManagerFactory.getInstance(alg);
        fac.init(keyStore, keyPass);
        return fac.getKeyManagers();
    }

...

This was my solution but I would be grateful if anyone could share their solutions here.

Related questions

ssl_error_rx_record_too_long and Apache SSL

I've got a customer trying to access one of my sites, and they keep getting this error > ssl_error_rx_record_too_long They're getting this error on all browsers, all platforms. I can't reproduce the problem at all. …

Read More
How do you redirect HTTPS to HTTP?

How do you redirect HTTPS to HTTP?. That is, the opposite of what (seemingly) everyone teaches. I have a server on HTTPS for which I paid an SSL certification for and a mirror for which I haven't and keep around …

Read More
Do I need to convert .CER to .CRT for Apache SSL certificates? If so, how?

I need to setup an Apache 2 server with SSL. I have my *.key file, but all the documentation I've found online, *.crt files are specified, and my CA only provided me with a *.cer file. Are *.cer files the same …

Read More