Axis2 / Rampart客戶自簽名證書

Question

我正在嘗試使用安全客戶端訪問Web服務。

我生成了兩個文件：

nb19200.pkcs12

server.jks

我將服務器密鑰庫粘貼在tomcat中，並將pkcs12上傳到我的瀏覽器，一切正常。

現在，在我的客戶端應用程序中，我嘗試了以下操作：

首先，導出服務器證書，我使用以下命令：

keytool -exportcert-別名servercert-文件servercert.cer -keystore server.jks -storepass * *

然后將其導入沒有任何內容的密鑰庫中：

keytool -importcert -keystore truststore.jks -alias servercert-文件servercert.cer -v trustcacerts -noprompt -storepass * **

我的代碼如下：

    System.setProperty("javax.net.ssl.trustStore","servertrust.jks");
    System.setProperty("javax.net.ssl.trustStorePassword", "password");

    //To be able to load the client configuration from axis2.xml
    ConfigurationContext ctx = ConfigurationContextFactory.createConfigurationContextFromFileSystem("client-repo", null);

    SecureServiceStub stub = new SecureServiceStub(ctx,"https://localhost:8443/axis2/services/SecureService");

    ServiceClient sc = stub._getServiceClient();

    sc.engageModule("rampart");

    //call the service etc.

好的，使用此配置，我得到以下錯誤：

原因：java.net.SocketException：連接被遠程主機關閉

如果我評論前兩行，我得到的錯誤是：

引起原因：sun.security.provider.certpath.SunCertPathBuilderException：無法找到到請求目標的有效證書路徑

那我在做什么錯？

我完全迷路了。

更新完整代碼：

http://pastebin.com/8xTYK3tY

堆棧跟蹤：

Exception in thread "main" org.apache.axis2.AxisFault: Connection refused: connect
at org.apache.axis2.AxisFault.makeFault(AxisFault.java:430)
at org.apache.axis2.transport.http.HTTPSender.sendViaPost(HTTPSender.java:197)
at org.apache.axis2.transport.http.HTTPSender.send(HTTPSender.java:75)
at org.apache.axis2.transport.http.CommonsHTTPTransportSender.writeMessageWithCommons(CommonsHTTPTransportSender.java:404)
at org.apache.axis2.transport.http.CommonsHTTPTransportSender.invoke(CommonsHTTPTransportSender.java:231)
at org.apache.axis2.engine.AxisEngine.send(AxisEngine.java:443)
at org.apache.axis2.description.OutInAxisOperationClient.send(OutInAxisOperation.java:406)
at org.apache.axis2.description.OutInAxisOperationClient.executeImpl(OutInAxisOperation.java:229)
at org.apache.axis2.client.OperationClient.execute(OperationClient.java:165)
at tutorial.rampart.client.SecureServiceStub.add(SecureServiceStub.java:191)
at tutorial.rampart.client.SecureServiceCGClient.main(SecureServiceCGClient.java:36)
Caused by: java.net.ConnectException: Connection refused: connect
at java.net.PlainSocketImpl.socketConnect(Native Method)
at java.net.PlainSocketImpl.doConnect(PlainSocketImpl.java:351)
at java.net.PlainSocketImpl.connectToAddress(PlainSocketImpl.java:213)
at java.net.PlainSocketImpl.connect(PlainSocketImpl.java:200)
at java.net.SocksSocketImpl.connect(SocksSocketImpl.java:366)
at java.net.Socket.connect(Socket.java:529)
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.connect(SSLSocketImpl.java:564)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
at java.lang.reflect.Method.invoke(Method.java:597)
at org.apache.commons.httpclient.protocol.ReflectionSocketFactory.createSocket(ReflectionSocketFactory.java:140)
at org.apache.commons.httpclient.protocol.SSLProtocolSocketFactory.createSocket(SSLProtocolSocketFactory.java:130)
at org.apache.commons.httpclient.HttpConnection.open(HttpConnection.java:707)
at org.apache.commons.httpclient.MultiThreadedHttpConnectionManager$HttpConnectionAdapter.open(MultiThreadedHttpConnectionManager.java:1361)
at org.apache.commons.httpclient.HttpMethodDirector.executeWithRetry(HttpMethodDirector.java:387)
at org.apache.commons.httpclient.HttpMethodDirector.executeMethod(HttpMethodDirector.java:171)
at org.apache.commons.httpclient.HttpClient.executeMethod(HttpClient.java:397)
at org.apache.axis2.transport.http.AbstractHTTPSender.executeMethod(AbstractHTTPSender.java:621)
at org.apache.axis2.transport.http.HTTPSender.sendViaPost(HTTPSender.java:193)

Answer 1

查看定義密鑰庫路徑的行：

System.setProperty("javax.net.ssl.trustStore","servertrust.jks");

但是您提到文件名是server.jks 。 因此，如果是這種情況，這就是為什么代碼找不到正確的證書文件的原因。

更新：

使用ssl（https）時，服務器將搜索正確的證書，附加到“ CN”上。 CN必須等於主機名。 根據您發布的URL，我看到您正在使用localhost，因此必須使CN等於您的計算機名稱（您可以通過右鍵單擊“我的電腦”->“屬性”來查看它）。

Answer 2

請確保該服務正在偵聽端口8443。檢查URL https://localhost:8443/axis2/services/SecureService存在。 您可以嘗試使用此URL https://localhost:8443/axis2/services/SecureService?wsdl並查看是否可以從該URL獲取服務的WSDL。

Answer 3

我找到了解決方案。

我錯過了這個：

System.setProperty("javax.net.ssl.keyStore","keys/client.jks");
System.setProperty("javax.net.ssl.keyStorePassword", "password");