2-Way SSL with a WebService

Question

Hi,
unfortunately I have some problem to setup a Client that interacts with a Web Service via 2-way SSL. I hope that anybody of you can give me a useful hint to solve the problem.
Client Side: I used a Java Client (just for testing) that runs as a program with the setExampleEnv-Settings.
JAVA_OPTIONS="-Dbea.home=c:/bea -Dssl.debug=true -Djava.protocol.handler.pkgs=weblogic.webservice.client -Dweblogic.webservice.client.verbose=true -Dweblogic.security.SSL.verbose=true -Dweblogic.StdoutDebugEnabled=true -Dweblogic.webservice.client.ssl.strictcertchecking=false -Dweblogic.security.SSL.ignoreHostnameVerification=examples.security.sslclient.NulledHostnameVerifier"
try {
// set the SSL adapter
SSLAdapterFactory adapterFactory = SSLAdapterFactory.getDefaultFactory();
WLSSLAdapter adapter = (WLSSLAdapter) adapterFactory.getSSLAdapter();
adapter.setVerbose( true );
adapter.setStrictChecking( false );
adapter.setTrustedCertificatesFile( "c:/bea/keytest/testidentity_server/testcertgenca.pem" );
// two-way SSL you must loadLocalIdentity to provide certs back to the server
FileInputStream clientCredentialFile = new FileInputStream ( "c:/bea/keytest/testidentity_client/testidentity.pem" );
String pwd = "weblogic";
adapter.loadLocalIdentity( clientCredentialFile, pwd.toCharArray() );
adapterFactory.setDefaultAdapter( adapter );
adapterFactory.setUseDefaultAdapter( true );
DummyXYZConnection_Impl lookup = new DummyXYZConnection_Impl( "https://10.30.52.52:7612/DummyXYZConnection_webapp/DummyXYZConnection?WSDL" );
DummyXYZConnectionPort value = lookup.getDummyXYZConnectionPort();
result = value.operationalAvailability();
System.out.println( "********************************************" );
System.out.println( result );
System.out.println( "********************************************" );
} catch ( Exception e ) {
System.out.println( "Interner Anwendungsfehler: " + e.getMessage() );
e.printStackTrace();
- Trusted Certificates File: Server certificate and the certificate from CertGenCA.pem
- Client Credential File: Client certificate, certificate from CertGenCA.pem and private key
Server Side: There is a Web Service deployed.
JAVA_OPTIONS="-Dssl.debug=true -Djava.protocol.handler.pkgs=weblogic.webservice.client -Dweblogic.webservice.client.verbose=true -Dweblogic.security.SSL.verbose=true -Dweblogic.StdoutDebugEnabled=true -Dweblogic.webservice.client.ssl.strictcertchecking=false -Dweblogic.security.SSL.ignoreHostnameVerification=examples.security.sslclient.NulledHostnameVerifier -Dweblogic.webservice.client.ssl.trustedcertfile=/export/home/weblogic/keytest/testidentity_client/testcertgenca.pem"
The Trusted Certificates File "testcertgenca.pem" includes the Client certificate and the certificate from CertGenCA.pem.
In addition to that I have configured the SSL Listen Port, the Custom Identity Store and the Java Trust Store.
- Custom Identity Keystore (jks): Server certificate and private key
- Java Standard Trust Keystore:     JAVA_HOME/jre/lib/security/cacerts
- Client Certs Requested And Enforced
When I run the client now, I always receive the following stack trace:
<02.03.2005 19.52 Uhr CET> <Info> <WebService> <BEA-220094> <An IOException was thrown trying to access the WSDL at the given URL.>
<02.03.2005 19.52 Uhr CET> <Info> <WebService> <BEA-220034> <A stack trace associated with message 220094 follows:
javax.net.ssl.SSLHandshakeException: [Security:090497]HANDSHAKE_FAILURE alert received from 10.30.52.52 - 10.30.52.52. Check both sides of the SSL configuration for mismatches in supported ciphers, supported protocol versions, trusted CAs, and hostname verification settings.
     at com.certicom.tls.interfaceimpl.TLSConnectionImpl.fireException(Unknown Source)
     at com.certicom.tls.interfaceimpl.TLSConnectionImpl.fireAlertReceived(Unknown Source)
     at com.certicom.tls.record.alert.AlertHandler.handle(Unknown Source)
     at com.certicom.tls.record.alert.AlertHandler.handleAlertMessages(Unknown Source)
     at com.certicom.tls.record.MessageInterpreter.interpretContent(Unknown Source)
     at com.certicom.tls.record.MessageInterpreter.decryptMessage(Unknown Source)
     at com.certicom.tls.record.ReadHandler.processRecord(Unknown Source)
     at com.certicom.tls.record.ReadHandler.readRecord(Unknown Source)
     at com.certicom.tls.record.ReadHandler.readUntilHandshakeComplete(Unknown Source)
     at com.certicom.tls.interfaceimpl.TLSConnectionImpl.completeHandshake(Unknown Source)
     at com.certicom.tls.record.WriteHandler.write(Unknown Source)
     at com.certicom.io.OutputSSLIOStreamWrapper.write(Unknown Source)
     at com.certicom.net.ssl.HttpsClient.doHandshake(Unknown Source)
     at com.certicom.net.ssl.internal.HttpURLConnection.getInputStream(Unknown Source)
     at weblogic.webservice.client.https.HttpsURLConnection.getInputStream(HttpsURLConnection.java:228)
     at weblogic.webservice.tools.wsdlp.DefinitionFactory.createDefinition(DefinitionFactory.java:106)
     at weblogic.webservice.tools.wsdlp.WSDLParser.<init>(WSDLParser.java:76)
     at weblogic.webservice.WebServiceFactory.createFromWSDL(WebServiceFactory.java:108)
     at weblogic.webservice.core.rpc.ServiceImpl.<init>(ServiceImpl.java:91)
     at weblogic.webservice.core.rpc.ServiceImpl.<init>(ServiceImpl.java:66)
     at com.itellium.ecom.webservice.EComAMSConnection_Impl.<init>(EComAMSConnection_Impl.java:22)
     at Ssl2WayTest.main(Ssl2WayTest.java:53)
>
Interner Anwendungsfehler: Failed to retrieve WSDL from https://10.30.52.52:7612/EComAMSConnection_webapp/EComAMSConnection?WSDL. Please check the URL and make sure that it is a valid XML file [javax.net.ssl.SSLHandshakeException: [Security:090497]HANDSHAKE_FAILURE alert received from 10.30.52.52 - 10.30.52.52. Check both sides of the SSL configuration for mismatches in supported ciphers, supported protocol versions, trusted CAs, and hostname verification settings.]
Where is the problem, the trusted CAs?
When is choose "Client Certs Requested But Not Enforced" everything is working fine!
All keys are build with the "utils.CertGen"-Tool and selfsigned.
Thank you very much for your support.
Best regards,
Stefan
P.S.: My environment settings are: BEA WLS 8.1 SP2 with JDK 1.4.1_05.

Answer 1

Turn ssl debug on on the server: -Dssl.debug=true -Dweblogic.StdoutDebugEnabled=true
The server should log the reason why it rejected the connection - probably because the client did not provide any identity certificate. If this is the case make sure the server trusts the client certificate. SSL server sends the list of trusted certificates' subject names to the client with the certificate request, and if the client's identity cert issuer is not in the list the client will not send its identity certificate at all. See server log for the list of its trusted certificates.
Pavel.