带有SSL身份验证的Java SOAP客户端：错误证书

Question

I'm writing a Java SOAP client to connect through HTTPS with SSL authentication to a SOAP webservice. I have a keyStore and a trustStore to make the SSL authentication. I use javax to implement the client.

I set the certificates (keyStore, trustStore) with the following method :

System.setProperty("javax.net.ssl.keyStore",configuration.getProperty("***"));
System.setProperty("javax.net.ssl.keyStorePassword", configuration.getProperty("***"));
System.setProperty("javax.net.ssl.keyStoreType", configuration.getProperty("***"));     
System.setProperty("javax.net.ssl.trustStore",configuration.getProperty("***"));
System.setProperty("javax.net.ssl.trustStorePassword", configuration.getProperty("***"));
System.setProperty("javax.net.ssl.trustStoreType", configuration.getProperty("***"));

The code to make the SOAP connexion :

HttpsURLConnection httpsConnection = null;              
SSLContext sslContext = SSLContext.getInstance("SSL");
TrustManager[] trustAll = new TrustManager[] {new TrustAllCertificates()};
sslContext.init(null, trustAll, new java.security.SecureRandom());

// Set trust all certificates context to HttpsURLConnection
HttpsURLConnection.setDefaultSSLSocketFactory(sslContext.getSocketFactory());

// Open HTTPS connection
URL urlUrl = new URL(url);
httpsConnection = (HttpsURLConnection) urlUrl.openConnection();

// Trust all hosts
httpsConnection.setHostnameVerifier(new TrustAllHosts());

// Connect
httpsConnection.connect();

SOAPMessage soapResponse = soapConnection.call(createSOAPRequest(request), url);
soapConnection.close();
httpsConnection.disconnect();

When I try to connect, I have the following error :

javax.net.ssl.SSLHandshakeException: Received fatal alert: bad_certificate
    at sun.security.ssl.Alerts.getSSLException(Alerts.java:192)
    at sun.security.ssl.Alerts.getSSLException(Alerts.java:154)
    at sun.security.ssl.SSLSocketImpl.recvAlert(SSLSocketImpl.java:1979)
    at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:1086)
    at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1332)
    at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1359)
    at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1343)
    at sun.net.www.protocol.https.HttpsClient.afterConnect(HttpsClient.java:563)
    at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(AbstractDelegateHttpsURLConnection.java:185)
    at sun.net.www.protocol.https.HttpsURLConnectionImpl.connect(HttpsURLConnectionImpl.java:153)

I have tested the certificates (and password) with a curl connexion and it works. The problem doesn't come from the keyStore and trustStore.

I think that my app (javax ?) doesn't use the certificate during the connexion. Any idea ?

Answer 1

It seems like you do double work and finally ignore your system properties. When you setup system properties for Trust/Key stores - you do not need to use all that SSLContext, TrustManager, HostVerifier stuff. do it as with simple HTTP and do not care about.

URL urlUrl = new URL(url);
// all of those connections work since they are interfaces. Implementation is HTTPS of course
HttpsURLConnection httpsConnection = (HttpsURLConnection) urlUrl.openConnection();

HttpURLConnection httpConnection = (HttpURLConnection) urlUrl.openConnection();

URLConnection urlConnection = urlUrl.openConnection();