Java SOAP service over SSL with client certificates

Question

So I've been trying to setup a Java SOAP servlet with JAX-WS and SSL. I got the actual service running over SSL, but I need it to authenticate based on the client certificate, and right now it's accepting all connections against it.

Here's my code so far:

TrustManager tm = new X509TrustManager() {
public void checkClientTrusted(X509Certificate[] chain,
                String authType)
                throws CertificateException {
    System.out.println("yay1");
}



public void checkServerTrusted(X509Certificate[] chain,
                String authType)
                throws CertificateException {
    System.out.println("yay2");
}

public X509Certificate[] getAcceptedIssuers() {
    throw new UnsupportedOperationException("Not supported yet.");
}
};


String uri = "http://127.0.0.1:8083/SoapContext/SoapPort";
Object implementor = new Main();

Endpoint endpoint = Endpoint.create(implementor);

SSLContext ssl = SSLContext.getInstance("TLS");

KeyManagerFactory keyFactory = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
KeyStore store = KeyStore.getInstance("JKS");

store.load(new FileInputStream("serverkeystore"),"123456".toCharArray());

keyFactory.init(store, "123456".toCharArray());


TrustManagerFactory trustFactory = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());

trustFactory.init(store);


ssl.init(keyFactory.getKeyManagers(),
new TrustManager[] { tm }, null);

HttpsConfigurator configurator = new HttpsConfigurator(ssl);

HttpsServer httpsServer = HttpsServer.create(new InetSocketAddress(8083), 8083);

httpsServer.setHttpsConfigurator(configurator);

HttpContext httpContext = httpsServer.createContext("/SoapContext/SoapPort");

httpsServer.start();

endpoint.publish(httpContext);

And I'm testing it with this PHP code:

$soapClient = new SoapClient("https://localhost:8083/SoapContext/SoapPort?wsdl", array('local_cert' => "newcert.pem"));
$soapClient->add(array('i' => '1', 'j' => '2'));

Unfortunately, it errors out with this when I include the local_cert:

SOAP-ERROR: Parsing WSDL: Couldn't load from 'https://localhost:8083/SoapContext/SoapPort?wsdl' : failed to load external entity "https://localhost:8083/SoapContext/SoapPort?wsdl"

It does connect successfully if I don't include local_cert, but it never calls my custom TrustManager, so it accepts all incoming connections.

What am I doing wrong? Thanks!

Answer 1

I do not know PHP but your TrustManager in the web service is not doing any authentication.
So the connection should not be rejected due to client authentication issues.

Does the new_cert.pem you are referencing in your client, contain the private key?
If not then this could be the problem.

I suggest you take a wireshark and see the communication.
I suspect you will not see a rejection coming from your server.

The failure should be local on your client