2-way SSL, Server to Server - How?

Question

Need run Client within running JBoss server, to connect to multiple web services on other servers. Only option I see is to set system properties "javax.net.ssl.keyStore", "javax.net.ssl.keyStorePassword", etc. But access to System properties is not synchronized and I may very well have two threads requiring different keystores to connect to different business partners' web services.
Is it at all possible to set these security parameters on the connection itself and not as a system-wide property?
One thought occurs to me and I'd be grateful if someone can confirm - is it possible to put multiple client certificates in the "javax.net.ssl.keyStore" keystore? Will the JVM automatically determine which client certificate to send? If so, then all client connections could use the same keystore with multiple key pairs in it. Can anyone confirm? I only ask, because in the case of Tomcat, the server's keystore must contain only one keypair.
Thx,
Todd
Message was edited by:
tscales
Message was edited by:
tscales

Answer 1

I found the solution.... I created a custom SSL SocketFactory which loads a separate keystore (other than that which tomcat uses) and used that to communicate with the webservice. Since Axis2 uses Jakarta Commons HttpClient to communicate over https I modfied the RPCServiceClient properties to use custom ssl socket factory instead of JSSE
This way I can use different keystores to communicate with multiple web services which require different Client Certs
Here's the code:
serviceClient = new RPCServiceClient();
Protocol myProtocolHandler = new Protocol("https", new ClientCertSocketFactory(), 443);
serviceClient.getOptions().setProperty(HTTPConstants.CUSTOM_PROTOCOL_HANDLER, myProtocolHandler);
The ClientCertSocketFactory Class.......
import java.io.FileInputStream;
import java.io.IOException;
import java.net.InetAddress;
import java.net.Socket;
import java.net.UnknownHostException;
import java.security.KeyStore;
import javax.net.ssl.KeyManagerFactory;
import javax.net.ssl.SSLContext;
import javax.net.ssl.SSLSocket;
import javax.net.ssl.SSLSocketFactory;
import org.apache.commons.httpclient.ConnectTimeoutException;
import org.apache.commons.httpclient.params.HttpConnectionParams;
import org.apache.commons.httpclient.protocol.SecureProtocolSocketFactory;
public class ClientCertSocketFactory implements SecureProtocolSocketFactory{
     public Socket createSocket(Socket arg0, String host, int port, boolean arg3) throws IOException, UnknownHostException {          
          return createSocket(host,port);
     public Socket createSocket(String host, int port, InetAddress arg2, int arg3, HttpConnectionParams arg4) throws IOException, UnknownHostException, ConnectTimeoutException {
          return createSocket(host,port);
     public Socket createSocket(String host, int port, InetAddress arg2, int arg3) throws IOException, UnknownHostException {
          return createSocket(host,port);
     public Socket createSocket(String host, int port) throws IOException, UnknownHostException {
          SSLSocket theSocket = null;
          try {
               KeyStore keyStoreKeys;
               KeyManagerFactory keyMgrFactory;
               SSLContext sslContext;
               keyStoreKeys = KeyStore.getInstance("PKCS12");               
               keyStoreKeys.load(new FileInputStream("c:/client1.p12"),"abc123".toCharArray());
               keyMgrFactory = KeyManagerFactory.getInstance("SunX509");
               keyMgrFactory.init(keyStoreKeys, "abc123".toCharArray());
               sslContext = SSLContext.getInstance("TLS");
               sslContext.init(keyMgrFactory.getKeyManagers(), null, null);
               SSLSocketFactory socketFactory = sslContext.getSocketFactory();
               theSocket = (SSLSocket) socketFactory.createSocket(host, port);
          } catch (Exception e) {
               e.printStackTrace();
          return theSocket;
}