如何为SSL配置非自签名证书X509的SoapUI模拟服务

Question

I have no problem to set up SoapUI mock service with self signed certificate by following the steps at

http://www.soapui.org/Service-Mocking/securing-mockservices-with-ssl.html .

But now I want to test the mock service with a "real" certificate issue by Entrust Certification Authority - L1C.

Other information for this certificate is

• Ensures the identity of a remote computer
• 1.2.840.113533.7.75.2
• 2.23.140.1.2.2

It is valid until 2016.

I used the command to import the certificate to server.keystore .

c:\Program Files\Java\jre6\bin\keytool.exe -import -alias server -keystore server.keystore -storepass mypasss -file server_cer_issued_by_entrust.cer

(if I replace server_cer_issued_by_entrust.cer with a self signed (created) certificate it works)

I got the error in SoapUI which says ssh handshake error.

I just realize that it maybe not possible since the mock service is 127.0.0.1 but the actual certificate is issue for a web service like "mydomain.com", is that right?

Answer 1

SOAPUI runs over java , and when java connects to SSL url performs two validations:

1. Validate that the server certificate is trusted.
2. Validate that the common name in subject distinguished name of the server certificate matches the domain.

I assume that the first validation pass since in the link instructions which you provide its specify the same keystore in mock service for both: keystore and truststore, and since server certificate is imported in this one there is no problem to pass this validation.

So probably as you said the problem is that your mock service is on 127.0.0.1 and your certificate is issued to be used in mydomain.com .

A possible workaround is to disable SSL validation however this has no sense since as you said in the question you want to test the service with "real" certificate, instead maybe you can try editing host file and adding the mapping for 127.0.0.1 ip address for your certificate server domain, in your case:

127.0.0.1       mydomain.com

And then change the SOAPUI endpoint for your mock service to https://mydomain.com .

Hope this helps,