HTTPS/SSL client using 'myproxy' certificates

Hi, I'm trying to write a java client that will achieve the same as the following curl command:
/usr/bin/curl -k --cert /tmp/x509up_u10002 https://mysecure_server
The cert specified is obtained from a myproxy server (http://grid.ncsa.uiuc.edu/myproxy/)
I have written a java client that works fine if its given a p12 certificate and password but I meed it to work with the passwordless cert obtained from the myproxy server.
I believe that the cert /tmp/x509up_u10002 is in pem format.
All my attempts result in errors such as :
sun.security.validator.ValidatorException: No trusted certificate found
(this is despite having the ca cert in the truststore AND an 'all-trusting' TrustManager)
or
javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure
or even
java.io.IOException: toDerInputStream rejects tag type 45 ?????
I'm totally new to this security stuff and would very much appreciate any help or pointers.
Will the java security mechanisms support such a cert without a password?
Many Thanks
Keith

hi all i am new in using cURl with java and has to perform following work by curl with java i.e.
when a user submit the form then the java class get the submitted webpage along with data from the user side to our side without connecting to db and aslo i am getting of verifying the type of certificate i am using.
Message was edited by:
centurions

Similar Messages

  • Which digital certificate (SSL) is used when a proxy client is created

    Dears,
    Could someone please guide if there are more than one digital certificate (SSL) added to the SAP system, and we create a proxy client using the 'URL' (https://....) option, than which digital certificate will be used in the check done.
    Thanks.
    Reda

    The names that go on the certificate must match the names you planned when you did the CAS namespace design.
    Some details here:http://blogs.technet.com/b/exchange/archive/2014/02/28/namespace-planning-in-exchange-2013.aspx
    So in your case if the cert does not match the name, then this will prompt users with errors.   They need to match.  As long as all your internal devices trust the issuer of the internal CA then you can use that.   Installing an
    enterprise CA will automatically publish it's root CA  public cert into AD so it works easily.
    Cheers,
    Rhoderick
    Microsoft Senior Exchange PFE
    Blog:
    http://blogs.technet.com/rmilne 
    Twitter:   LinkedIn:
      Facebook:
      XING:
    Note: Posts are provided “AS IS” without warranty of any kind, either expressed or implied, including but not limited to the implied warranties of merchantability and/or fitness for a particular purpose.

  • HTTPS SSL Certificate Signed using Weak Hashing Algorithm

    I am support one client for,  whom falls under Security  scans mandatory for new implementation of ASA 5520 device .  The client uses Nessus Scan and  the test results are attached
    The Nessus scanner hit on 1 Medium vulnerabilities, Could you pls review the statement and provide work around for the same.
    Nessus Scanner reports
    Medium Severity Vulnerability
    Port : https (443/tcp)
    Issue:
    SSL Certificate Signed using Weak Hashing  Algorithm
    Synopsis :
    The SSL certificate has been signed using  a weak hash algorithm.
    Description :
    The remote service uses an  SSL certificate that has been signed using
    a cryptographically weak hashing  algorithm - MD2, MD4, or MD5. These
    signature algorithms are known to be  vulnerable to collision attacks.
    In theory, a determined attacker may be  able to leverage this weakness
    to generate another certificate with the same  digital signature, which
    could allow him to masquerade as the affected  service.
    See also :
    http://tools.ietf.org/html/rfc3279
    http://www.phreedom.org/research/rogue-ca/
    http://www.microsoft.com/technet/security/advisory/961509.mspx
    http://www.kb.cert.org/vuls/id/836068
    Solution :
    Contact the Certificate Authority to have the certificate  reissued.
    Plugin Output :
    Here is the service's SSL certificate  :
    Subject Name:
    Common Name: xxxxxxxxxx
    Issuer Name:
    Common Name: xxxxxxxxxx
    Serial Number: D8 2E 56 4E
    Version: 3
    Signature Algorithm: MD5 With RSA  Encryption
    Not Valid Before: Aug 25 11:15:36 2011 GMT
    Not Valid After:  Aug 22 11:15:36 2021 GMT
    Public Key Info:
    Algorithm: RSA  Encryption
    Public Key: 00 AA AB 57 9C 74 FF E9 FB 68 E1 BF 69 90 8E D2 65 7F  DF 40
    D6 F6 29 E7 35 5E 16 FB 76 AA 03 3F 47 07 5A D0 6D 07 E0 EC
    06 7E  D4 9A 43 C6 B3 A6 93 B7 76 CC 58 31 25 36 98 04 30 E6
    77 56 D7 C3 EE EF 7A  79 21 5E A0 78 9B F6 1B C5 E6 2A 10 B5
    CB 90 3D 6D 7C A0 8D B1 B8 76 61 7F  E2 D1 00 45 E2 A1 C7 9F
    57 00 37 60 27 E1 56 2A 83 F5 0E 48 36 CC 61 85 59  54 0C CB
    78 82 FB 50 17 CB 7D CD 15
    Exponent: 01 00 01
    Signature: 00 24 51 24 25 47 62 30 73 95 37 C4 71 7E BD E4 95 68 76 35
    2E AF 2B 4A 23 EE 15 AF E9 09 93 3F 02 BB F8 45 00 A1 12 A9
    F7 5A 0C E8  4D DB AE 92 70 E4 4C 24 10 58 6B A9 87 E1 F0 12
    AE 12 18 E8 AB DF B9 02 F7  DA BE 3C 45 02 C4 1E 81 44 C2 74
    25 A2 81 E7 D6 38 ED B9 66 4C 4A 17 AC E3  05 1A 01 14 88 23
    E8 9F 3B 5C C5 B8 13 97 27 17 C3 02 5F 6E 7C DB 4C D3 65  B5
    C5 FC 94 62 59 04 E7 7E FB
    CVE :
    CVE-2004-2761
    BID :
    BID 11849
    BID  33065
    Other References :
    OSVDB:45106
    OSVDB:45108
    OSVDB:45127
    CWE:310
    Nessus Plugin ID  :
    35291
    VulnDB ID:
    69469
    and try with configure the ssl encryption method with " ssl encryption 3des-sha1 aes128-sha1 aes256-sha1 rc4-md5" but it throws the same issue.
    Here is ASA log
    7|Oct 19 2011 01:59:34|725010: Device supports the following 4 cipher(s).
    7|Oct 19 2011 01:59:34|725011: Cipher[1] : DES-CBC3-SHA
    7|Oct 19 2011 01:59:34|725011: Cipher[2] : AES128-SHA
    7|Oct 19 2011 01:59:34|725011: Cipher[3] : AES256-SHA
    7|Oct 19 2011 01:59:34|725011: Cipher[4] : RC4-MD5
    7|Oct 19 2011 01:59:34|725008: SSL client production:xxxxxxxxx/2587 proposes the following 26 cipher(s).
    7|Oct 19 2011 01:59:34|725011: Cipher[1] : ADH-AES256-SHA
    7|Oct 19 2011 01:59:34|725011: Cipher[2] : DHE-RSA-AES256-SHA
    7|Oct 19 2011 01:59:34|725011: Cipher[3] : DHE-DSS-AES256-SHA
    7|Oct 19 2011 01:59:34|725011: Cipher[4] : AES256-SHA
    7|Oct 19 2011 01:59:34|725011: Cipher[5] : ADH-AES128-SHA
    7|Oct 19 2011 01:59:34|725011: Cipher[6] : DHE-RSA-AES128-SHA
    7|Oct 19 2011 01:59:34|725011: Cipher[7] : DHE-DSS-AES128-SHA
    7|Oct 19 2011 01:59:34|725011: Cipher[8] : AES128-SHA
    7|Oct 19 2011 01:59:34|725011: Cipher[9] : ADH-DES-CBC3-SHA
    7|Oct 19 2011 01:59:34|725011: Cipher[10] : ADH-DES-CBC-SHA
    7|Oct 19 2011 01:59:34|725011: Cipher[11] : EXP-ADH-DES-CBC-SHA
    7|Oct 19 2011 01:59:34|725011: Cipher[12] : ADH-RC4-MD5
    7|Oct 19 2011 01:59:34|725011: Cipher[13] : EXP-ADH-RC4-MD5
    7|Oct 19 2011 01:59:34|725011: Cipher[14] : EDH-RSA-DES-CBC3-SHA
    7|Oct 19 2011 01:59:34|725011: Cipher[15] : EDH-RSA-DES-CBC-SHA
    7|Oct 19 2011 01:59:34|725011: Cipher[16] : EXP-EDH-RSA-DES-CBC-SHA
    7|Oct 19 2011 01:59:34|725011: Cipher[17] : EDH-DSS-DES-CBC3-SHA
    7|Oct 19 2011 01:59:34|725011: Cipher[18] : EDH-DSS-DES-CBC-SHA
    7|Oct 19 2011 01:59:34|725011: Cipher[19] : EXP-EDH-DSS-DES-CBC-SHA
    7|Oct 19 2011 01:59:34|725011: Cipher[20] : DES-CBC3-SHA
    7|Oct 19 2011 01:59:34|725011: Cipher[21] : DES-CBC-SHA
    7|Oct 19 2011 01:59:34|725011: Cipher[22] : EXP-DES-CBC-SHA
    7|Oct 19 2011 01:59:34|725011: Cipher[23] : EXP-RC2-CBC-MD5
    7|Oct 19 2011 01:59:34|725011: Cipher[24] : RC4-SHA
    7|Oct 19 2011 01:59:34|725011: Cipher[25] : RC4-MD5
    7|Oct 19 2011 01:59:34|725011: Cipher[26] : EXP-RC4-MD5
    7|Oct 19 2011 01:59:34|725012: Device chooses cipher : DES-CBC3-SHA for the SSL session with client production:xxxxxxxx/2586
    6|Oct 19 2011 01:59:34|725002: Device completed SSL handshake with client production:xxxxxxxxx/2586
    6|Oct 19 2011 01:59:34|725007: SSL session with client production:xxxxxxxx/2586 terminated.
    6|Oct 19 2011 01:59:34|302014: Teardown TCP connection 3201 for production:xxxxxxx/2586 to identity:xxxxxx/443 duration 0:00:00 bytes 758 TCP Reset-I
    6|Oct 19 2011 01:59:34|302013: Built inbound TCP connection 3202 for production:xxxxxxxxxxx/2587 (xxxxxxxxx/2587) to identity:xxxxxx/443 (xxxxxxx/443)
    6|Oct 19 2011 01:59:34|725001: Starting SSL handshake with client production:xxxxxxxxxxx/2587 for TLSv1 session.
    7|Oct 19 2011 01:59:34|725010: Device supports the following 4 cipher(s).
    7|Oct 19 2011 01:59:34|725011: Cipher[1] : DES-CBC3-SHA
    7|Oct 19 2011 01:59:34|725011: Cipher[2] : AES128-SHA
    7|Oct 19 2011 01:59:34|725011: Cipher[3] : AES256-SHA
    7|Oct 19 2011 01:59:34|725011: Cipher[4] : RC4-MD5
    7|Oct 19 2011 01:59:34|725008: SSL client production:xxxxxxxxx/2587 proposes the following 26 cipher(s).
    7|Oct 19 2011 01:59:34|725011: Cipher[1] : ADH-AES256-SHA
    7|Oct 19 2011 01:59:34|725011: Cipher[2] : DHE-RSA-AES256-SHA
    7|Oct 19 2011 01:59:34|725011: Cipher[3] : DHE-DSS-AES256-SHA
    7|Oct 19 2011 01:59:34|725011: Cipher[4] : AES256-SHA
    7|Oct 19 2011 01:59:34|725011: Cipher[5] : ADH-AES128-SHA
    7|Oct 19 2011 01:59:34|725011: Cipher[6] : DHE-RSA-AES128-SHA
    7|Oct 19 2011 01:59:34|725011: Cipher[7] : DHE-DSS-AES128-SHA
    7|Oct 19 2011 01:59:34|725011: Cipher[8] : AES128-SHA
    7|Oct 19 2011 01:59:34|725011: Cipher[9] : ADH-DES-CBC3-SHA
    7|Oct 19 2011 01:59:34|725011: Cipher[10] : ADH-DES-CBC-SHA
    7|Oct 19 2011 01:59:34|725011: Cipher[11] : EXP-ADH-DES-CBC-SHA
    7|Oct 19 2011 01:59:34|725011: Cipher[12] : ADH-RC4-MD5
    7|Oct 19 2011 01:59:34|725011: Cipher[13] : EXP-ADH-RC4-MD5
    7|Oct 19 2011 01:59:34|725011: Cipher[14] : EDH-RSA-DES-CBC3-SHA
    7|Oct 19 2011 01:59:34|725011: Cipher[15] : EDH-RSA-DES-CBC-SHA
    7|Oct 19 2011 01:59:34|725011: Cipher[16] : EXP-EDH-RSA-DES-CBC-SHA
    7|Oct 19 2011 01:59:34|725011: Cipher[17] : EDH-DSS-DES-CBC3-SHA
    7|Oct 19 2011 01:59:34|725011: Cipher[18] : EDH-DSS-DES-CBC-SHA
    7|Oct 19 2011 01:59:34|725011: Cipher[19] : EXP-EDH-DSS-DES-CBC-SHA
    7|Oct 19 2011 01:59:34|725011: Cipher[20] : DES-CBC3-SHA
    7|Oct 19 2011 01:59:34|725011: Cipher[21] : DES-CBC-SHA
    7|Oct 19 2011 01:59:34|725011: Cipher[22] : EXP-DES-CBC-SHA
    7|Oct 19 2011 01:59:34|725011: Cipher[23] : EXP-RC2-CBC-MD5
    7|Oct 19 2011 01:59:34|725011: Cipher[24] : RC4-SHA
    7|Oct 19 2011 01:59:34|725011: Cipher[25] : RC4-MD5
    7|Oct 19 2011 01:59:34|725011: Cipher[26] : EXP-RC4-MD5
    7|Oct 19 2011 01:59:34|725012: Device chooses cipher : DES-CBC3-SHA for the SSL session with client production:xxxxxxxxxx/2587
    6|Oct 19 2011 01:59:34|725002: Device completed SSL handshake with client production:xxxxxxxxx/2587
    H

    Hi Ramkumar,
    The report is complaining that the Certificate Authority who signed the ID certificate presented by the ASA used a weak hashing algorithm. First, you need to determine who signed the certificate.
    If the certificate is self-signed by the ASA, you can generate a new certificate and use SHA1 as the hashing algorithm. To do this, the ASA needs to be running a software version that is at least 8.2(4) (8.3 and 8.4 software also support SHA1).
    If the certificate is signed by an external CA, you need to contact them and ask them to sign a new certificate for you using SHA instead of MD5.
    The links you posted have more information on this as well. Hope that helps.
    -Mike

  • How to Use a Certificate for Two Way SSL and another certificate for WS Security Header at Client Console Application(C# Dotnet)

    Hi,
    I want to consume a Java Web service from Dotnet based client Application. The service require one Certificate("abc.PFX") for Two Way SSL purpose and another certificate("xyz.pfx") for WS security purpose to be passed from client Application(Dotnet
    Console based). I tried configuring the App.config of Client application to pass both the certs but getting Error says:
    Could not establish secure channel for SSL/TLS with authority "******aaaa.com"
    Please suggest how to pass both the certs from client Application..

    Hi,
    This problem can be due to an Untrusted certificate. So you need just full permissions to certificates.
    And for more information, you could refer to:
    http://contractnamespace.blogspot.jp/2014/12/could-not-create-secure-channel-fix.html
    Regards

  • How can you configure an Exchange Account in Mac OS X to use a SSL client certificate?

    I'm trying to connect the Mail App of Mac OS X to my company's Exchange server. For security reasons you have provide a SSL client certificate to the server. You can convince Safari to use a client certificate by putting it into your keychain and configuring a suitable "identity preference" for the URL of the related site. But the Mail App seems not to use the keychain for this part of the SSL negotiations.
    Since you can configure the client certificate usage for an Exchange Account for the iPhone with the Configuration Utility there should be a way for the desktop App, too. Has someone sorted this issue out already or does the Mail App actually lack of client certificate support?

    I had a nice chat with the Apple end user support which revealed that this feature falls in the responsibility of the business support group. Since I have no appropriate support contract I could ask for help for about 480€ per issue -- nice try
    After more research I found the Configuration Profile Reference, where you get information about Exchange accounts too. Starting with a working iOS-Profile I changed the Exchange account part according to this documentation for OS X. All you have to do is to replace PayloadType com.apple.eas.account by com.apple.ews.account.
    After importing this profile I found the expected Exchange account within the Contacts.app. But the SSL client certificate was still not used and therefore my account not usable.
    You could enable Mail, Calendar & Reminders and Notes within the System Preferences, but neither of these would work due to the missing client certificate support.
    I came to the conclusion that the relevant applications in OS X have no proper SSL Client support build in. Since the underlying libraries and frameworks have everything in place that is really a shame.
    Would be nice, if someone would enforce the developers to do their homework there.

  • Using JSSE : "Invalid Netscape CertType extension for SSL client" Error

    Hi all,
    Im using the sample code given sun site for JSSE with Client Authentication. The sample as such it worked with the testkeys provided in that. But it didn't workout when I tried using other certificates.
    Both client and server certificates I generated from our internal Netscape Certificate Manager.
    Function of the server :
    The server will read a private key from the given keystore and starts listening on a port. This server will server only GET request.
    Function of the client :
    The Client sends a GET request to the server and gets the response back.
    I simply changed the key store name alone in the working sample code.
    It is not working.
    The Exception thrown on client side :
    D:\users\Jp\java\jssesamples\sockets\client\class>java SSLSocketClientWithClientAuth1 localhost 1089 /urls
    localhost
    1089
    /urls
    java.net.SocketException: Software caused connection abort: socket write error
    at java.net.SocketOutputStream.socketWrite0(Native Method)
    at java.net.SocketOutputStream.socketWrite(SocketOutputStream.java:92)
    at java.net.SocketOutputStream.write(SocketOutputStream.java:136)
    at com.sun.net.ssl.internal.ssl.OutputRecord.a(DashoA6275)
    at com.sun.net.ssl.internal.ssl.SSLSocketImpl.a(DashoA6275)
    at com.sun.net.ssl.internal.ssl.SunJSSE_ax.a(DashoA6275)
    at com.sun.net.ssl.internal.ssl.SunJSSE_az.j(DashoA6275)
    at com.sun.net.ssl.internal.ssl.SunJSSE_az.a(DashoA6275)
    at com.sun.net.ssl.internal.ssl.SunJSSE_az.a(DashoA6275)
    at com.sun.net.ssl.internal.ssl.SunJSSE_ax.a(DashoA6275)
    at com.sun.net.ssl.internal.ssl.SSLSocketImpl.a(DashoA6275)
    at com.sun.net.ssl.internal.ssl.SSLSocketImpl.j(DashoA6275)
    at com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(DashoA6275)
    at SSLSocketClientWithClientAuth1.main(SSLSocketClientWithClientAuth1.java:119)
    Exception thrown on server side :
    D:\users\Jp\java\jssesamples\sockets\server\class>java ClassFileServer 1089 . TLS true
    USAGE: java ClassFileServer port docroot [TLS [true]]
    If the third argument is TLS, it will start as
    a TLS/SSL file server, otherwise, it will be
    an ordinary file server.
    If the fourth argument is true,it will require
    client authentication as well.
    javax.net.ssl.SSLHandshakeException: java.security.cert.CertificateException: Invalid Netscape CertType extension for SSL client
    at com.sun.net.ssl.internal.ssl.BaseSSLSocketImpl.a(DashoA6275)
    at com.sun.net.ssl.internal.ssl.SSLSocketImpl.a(DashoA6275)
    at com.sun.net.ssl.internal.ssl.SSLSocketImpl.a(DashoA6275)
    at com.sun.net.ssl.internal.ssl.SunJSSE_aw.a(DashoA6275)
    at com.sun.net.ssl.internal.ssl.SunJSSE_aw.a(DashoA6275)
    at com.sun.net.ssl.internal.ssl.SunJSSE_ax.a(DashoA6275)
    at com.sun.net.ssl.internal.ssl.SSLSocketImpl.a(DashoA6275)
    at com.sun.net.ssl.internal.ssl.SSLSocketImpl.j(DashoA6275)
    at com.sun.net.ssl.internal.ssl.SSLSocketImpl.a(DashoA6275)
    at com.sun.net.ssl.internal.ssl.AppInputStream.read(DashoA6275)
    at sun.nio.cs.StreamDecoder$CharsetSD.readBytes(StreamDecoder.java:406)
    at sun.nio.cs.StreamDecoder$CharsetSD.implRead(StreamDecoder.java:446)
    at sun.nio.cs.StreamDecoder.read(StreamDecoder.java:180)
    at java.io.InputStreamReader.read(InputStreamReader.java:167)
    at java.io.BufferedReader.fill(BufferedReader.java:136)
    at java.io.BufferedReader.readLine(BufferedReader.java:299)
    at java.io.BufferedReader.readLine(BufferedReader.java:362)
    at ClassServer.getPath(ClassServer.java:162)
    at ClassServer.run(ClassServer.java:109)
    at java.lang.Thread.run(Thread.java:536)
    Caused by: java.security.cert.CertificateException: Invalid Netscape CertType extension for SSL client
    at com.sun.net.ssl.internal.ssl.X509TrustManagerImpl.a(DashoA6275)
    at com.sun.net.ssl.internal.ssl.X509TrustManagerImpl.a(DashoA6275)
    at com.sun.net.ssl.internal.ssl.X509TrustManagerImpl.a(DashoA6275)
    at com.sun.net.ssl.internal.ssl.X509TrustManagerImpl.checkClientTrusted(DashoA6275)
    at com.sun.net.ssl.internal.ssl.JsseX509TrustManager.checkClientTrusted(DashoA6275)
    ... 17 more
    error writing response: Connection has been shutdown: javax.net.ssl.SSLHandshakeException: java.security.cert.CertificateExce
    ption: Invalid Netscape CertType extension for SSL client
    javax.net.ssl.SSLException: Connection has been shutdown: javax.net.ssl.SSLHandshakeException: java.security.cert.Certificate
    Exception: Invalid Netscape CertType extension for SSL client
    at com.sun.net.ssl.internal.ssl.SSLSocketImpl.d(DashoA6275)
    at com.sun.net.ssl.internal.ssl.SSLSocketImpl.e(DashoA6275)
    at com.sun.net.ssl.internal.ssl.AppOutputStream.write(DashoA6275)
    at com.sun.net.ssl.internal.ssl.AppOutputStream.write(DashoA6275)
    at java.io.DataOutputStream.writeBytes(DataOutputStream.java:256)
    at ClassServer.run(ClassServer.java:128)
    at java.lang.Thread.run(Thread.java:536)
    Caused by: javax.net.ssl.SSLHandshakeException: java.security.cert.CertificateException: Invalid Netscape CertType extension
    for SSL client
    at com.sun.net.ssl.internal.ssl.BaseSSLSocketImpl.a(DashoA6275)
    at com.sun.net.ssl.internal.ssl.SSLSocketImpl.a(DashoA6275)
    at com.sun.net.ssl.internal.ssl.SSLSocketImpl.a(DashoA6275)
    at com.sun.net.ssl.internal.ssl.SunJSSE_aw.a(DashoA6275)
    at com.sun.net.ssl.internal.ssl.SunJSSE_aw.a(DashoA6275)
    at com.sun.net.ssl.internal.ssl.SunJSSE_ax.a(DashoA6275)
    at com.sun.net.ssl.internal.ssl.SSLSocketImpl.a(DashoA6275)
    at com.sun.net.ssl.internal.ssl.SSLSocketImpl.j(DashoA6275)
    at com.sun.net.ssl.internal.ssl.SSLSocketImpl.a(DashoA6275)
    at com.sun.net.ssl.internal.ssl.AppInputStream.read(DashoA6275)
    at sun.nio.cs.StreamDecoder$CharsetSD.readBytes(StreamDecoder.java:406)
    at sun.nio.cs.StreamDecoder$CharsetSD.implRead(StreamDecoder.java:446)
    at sun.nio.cs.StreamDecoder.read(StreamDecoder.java:180)
    at java.io.InputStreamReader.read(InputStreamReader.java:167)
    at java.io.BufferedReader.fill(BufferedReader.java:136)
    at java.io.BufferedReader.readLine(BufferedReader.java:299)
    at java.io.BufferedReader.readLine(BufferedReader.java:362)
    at ClassServer.getPath(ClassServer.java:162)
    at ClassServer.run(ClassServer.java:109)
    ... 1 more
    Caused by: java.security.cert.CertificateException: Invalid Netscape CertType extension for SSL client
    at com.sun.net.ssl.internal.ssl.X509TrustManagerImpl.a(DashoA6275)
    at com.sun.net.ssl.internal.ssl.X509TrustManagerImpl.a(DashoA6275)
    at com.sun.net.ssl.internal.ssl.X509TrustManagerImpl.a(DashoA6275)
    at com.sun.net.ssl.internal.ssl.X509TrustManagerImpl.checkClientTrusted(DashoA6275)
    at com.sun.net.ssl.internal.ssl.JsseX509TrustManager.checkClientTrusted(DashoA6275)
    ... 17 more
    The Client code :
    * @(#)SSLSocketClientWithClientAuth.java     1.5 01/05/10
    * Copyright 1995-2002 Sun Microsystems, Inc. All Rights Reserved.
    * Redistribution and use in source and binary forms, with or
    * without modification, are permitted provided that the following
    * conditions are met:
    * -Redistributions of source code must retain the above copyright
    * notice, this list of conditions and the following disclaimer.
    * -Redistribution in binary form must reproduct the above copyright
    * notice, this list of conditions and the following disclaimer in
    * the documentation and/or other materials provided with the
    * distribution.
    * Neither the name of Sun Microsystems, Inc. or the names of
    * contributors may be used to endorse or promote products derived
    * from this software without specific prior written permission.
    * This software is provided "AS IS," without a warranty of any
    * kind. ALL EXPRESS OR IMPLIED CONDITIONS, REPRESENTATIONS AND
    * WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY,
    * FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT, ARE HEREBY
    * EXCLUDED. SUN AND ITS LICENSORS SHALL NOT BE LIABLE FOR ANY
    * DAMAGES OR LIABILITIES SUFFERED BY LICENSEE AS A RESULT OF OR
    * RELATING TO USE, MODIFICATION OR DISTRIBUTION OF THE SOFTWARE OR
    * ITS DERIVATIVES. IN NO EVENT WILL SUN OR ITS LICENSORS BE LIABLE
    * FOR ANY LOST REVENUE, PROFIT OR DATA, OR FOR DIRECT, INDIRECT,
    * SPECIAL, CONSEQUENTIAL, INCIDENTAL OR PUNITIVE DAMAGES, HOWEVER
    * CAUSED AND REGARDLESS OF THE THEORY OF LIABILITY, ARISING OUT OF
    * THE USE OF OR INABILITY TO USE SOFTWARE, EVEN IF SUN HAS BEEN
    * ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
    * You acknowledge that Software is not designed, licensed or
    * intended for use in the design, construction, operation or
    * maintenance of any nuclear facility.
    import java.net.*;
    import java.io.*;
    import javax.net.ssl.*;
    import javax.security.cert.X509Certificate;
    import java.security.KeyStore;
    * This example shows how to set up a key manager to do client
    * authentication if required by server.
    * This program assumes that the client is not inside a firewall.
    * The application can be modified to connect to a server outside
    * the firewall by following SSLSocketClientWithTunneling.java.
    public class SSLSocketClientWithClientAuth1 {
    public static void main(String[] args) throws Exception {
         String host = null;
         int port = -1;
         String path = null;
         for (int i = 0; i < args.length; i++)
         System.out.println(args);
         if (args.length < 3) {
         System.out.println(
              "USAGE: java SSLSocketClientWithClientAuth " +
              "host port requestedfilepath");
         System.exit(-1);
         try {
         host = args[0];
         port = Integer.parseInt(args[1]);
         path = args[2];
         } catch (IllegalArgumentException e) {
         System.out.println("USAGE: java SSLSocketClientWithClientAuth " +
              "host port requestedfilepath");
         System.exit(-1);
         try {
         * Set up a key manager for client authentication
         * if asked by the server. Use the implementation's
         * default TrustStore and secureRandom routines.
         SSLSocketFactory factory = null;
         try {
              SSLContext ctx;
              KeyManagerFactory kmf;
              KeyStore ks;
              char[] passphrase = "passphrase".toCharArray();
              ctx = SSLContext.getInstance("TLS");
              kmf = KeyManagerFactory.getInstance("SunX509");
              ks = KeyStore.getInstance("JKS");
    //          ks.load(new FileInputStream("testkeys"), passphrase);
              ks.load(new FileInputStream("clientkey"), passphrase);
              kmf.init(ks, passphrase);
              ctx.init(kmf.getKeyManagers(), null, null);
              factory = ctx.getSocketFactory();
         } catch (Exception e) {
              throw new IOException(e.getMessage());
         SSLSocket socket = (SSLSocket)factory.createSocket(host, port);
         * send http request
         * See SSLSocketClient.java for more information about why
         * there is a forced handshake here when using PrintWriters.
         socket.startHandshake();
         PrintWriter out = new PrintWriter(
                        new BufferedWriter(
                        new OutputStreamWriter(
                        socket.getOutputStream())));
         out.println("GET " + path + " HTTP/1.1");
              /* Some internet sites throw bad request error for HTTP/1.1 req if hostname is not specified so the foll line */
              out.println("Host: " + host);
         out.println();
         out.flush();
         * Make sure there were no surprises
         if (out.checkError())
              System.out.println(
              "SSLSocketClient: java.io.PrintWriter error");
         /* read response */
         BufferedReader in = new BufferedReader(
                        new InputStreamReader(
                        socket.getInputStream()));
         String inputLine;
         while ((inputLine = in.readLine()) != null)
              System.out.println(inputLine);
         in.close();
         out.close();
         socket.close();
         } catch (Exception e) {
         e.printStackTrace();
    The Server code :
    * @(#)ClassFileServer.java     1.5 01/05/10
    * Copyright 1995-2002 Sun Microsystems, Inc. All Rights Reserved.
    * Redistribution and use in source and binary forms, with or
    * without modification, are permitted provided that the following
    * conditions are met:
    * -Redistributions of source code must retain the above copyright
    * notice, this list of conditions and the following disclaimer.
    * -Redistribution in binary form must reproduct the above copyright
    * notice, this list of conditions and the following disclaimer in
    * the documentation and/or other materials provided with the
    * distribution.
    * Neither the name of Sun Microsystems, Inc. or the names of
    * contributors may be used to endorse or promote products derived
    * from this software without specific prior written permission.
    * This software is provided "AS IS," without a warranty of any
    * kind. ALL EXPRESS OR IMPLIED CONDITIONS, REPRESENTATIONS AND
    * WARRANTIES, INCLUDING ANY IMPLIED WARRANTY OF MERCHANTABILITY,
    * FITNESS FOR A PARTICULAR PURPOSE OR NON-INFRINGEMENT, ARE HEREBY
    * EXCLUDED. SUN AND ITS LICENSORS SHALL NOT BE LIABLE FOR ANY
    * DAMAGES OR LIABILITIES SUFFERED BY LICENSEE AS A RESULT OF OR
    * RELATING TO USE, MODIFICATION OR DISTRIBUTION OF THE SOFTWARE OR
    * ITS DERIVATIVES. IN NO EVENT WILL SUN OR ITS LICENSORS BE LIABLE
    * FOR ANY LOST REVENUE, PROFIT OR DATA, OR FOR DIRECT, INDIRECT,
    * SPECIAL, CONSEQUENTIAL, INCIDENTAL OR PUNITIVE DAMAGES, HOWEVER
    * CAUSED AND REGARDLESS OF THE THEORY OF LIABILITY, ARISING OUT OF
    * THE USE OF OR INABILITY TO USE SOFTWARE, EVEN IF SUN HAS BEEN
    * ADVISED OF THE POSSIBILITY OF SUCH DAMAGES.
    * You acknowledge that Software is not designed, licensed or
    * intended for use in the design, construction, operation or
    * maintenance of any nuclear facility.
    import java.io.*;
    import java.net.*;
    import java.security.KeyStore;
    import javax.net.*;
    import javax.net.ssl.*;
    import javax.security.cert.X509Certificate;
    /* ClassFileServer.java -- a simple file server that can server
    * Http get request in both clear and secure channel
    * The ClassFileServer implements a ClassServer that
    * reads files from the file system. See the
    * doc for the "Main" method for how to run this
    * server.
    public class ClassFileServer extends ClassServer {
    private String docroot;
    private static int DefaultServerPort = 2001;
    * Constructs a ClassFileServer.
    * @param path the path where the server locates files
    public ClassFileServer(ServerSocket ss, String docroot) throws IOException
         super(ss);
         this.docroot = docroot;
    * Returns an array of bytes containing the bytes for
    * the file represented by the argument <b>path</b>.
    * @return the bytes for the file
    * @exception FileNotFoundException if the file corresponding
    * to <b>path</b> could not be loaded.
    public byte[] getBytes(String path)
         throws IOException
         System.out.println("reading: " + path);
         File f = new File(docroot + File.separator + path);
         int length = (int)(f.length());
         if (length == 0) {
         throw new IOException("File length is zero: " + path);
         } else {
         FileInputStream fin = new FileInputStream(f);
         DataInputStream in = new DataInputStream(fin);
         byte[] bytecodes = new byte[length];
         in.readFully(bytecodes);
         return bytecodes;
    * Main method to create the class server that reads
    * files. This takes two command line arguments, the
    * port on which the server accepts requests and the
    * root of the path. To start up the server: <br><br>
    * <code> java ClassFileServer <port> <path>
    * </code><br><br>
    * <code> new ClassFileServer(port, docroot);
    * </code>
    public static void main(String args[])
         System.out.println(
         "USAGE: java ClassFileServer port docroot [TLS [true]]");
         System.out.println("");
         System.out.println(
         "If the third argument is TLS, it will start as\n" +
         "a TLS/SSL file server, otherwise, it will be\n" +
         "an ordinary file server. \n" +
         "If the fourth argument is true,it will require\n" +
         "client authentication as well.");
         int port = DefaultServerPort;
         String docroot = "";
         if (args.length >= 1) {
         port = Integer.parseInt(args[0]);
         if (args.length >= 2) {
         docroot = args[1];
         String type = "PlainSocket";
         if (args.length >= 3) {
         type = args[2];
         try {
         ServerSocketFactory ssf =
              ClassFileServer.getServerSocketFactory(type);
         ServerSocket ss = ssf.createServerSocket(port);
         if (args.length >= 4 && args[3].equals("true")) {
              ((SSLServerSocket)ss).setNeedClientAuth(true);
         new ClassFileServer(ss, docroot);
         } catch (IOException e) {
         System.out.println("Unable to start ClassServer: " +
                   e.getMessage());
         e.printStackTrace();
    private static ServerSocketFactory getServerSocketFactory(String type) {
         if (type.equals("TLS")) {
         SSLServerSocketFactory ssf = null;
         try {
              // set up key manager to do server authentication
              SSLContext ctx;
              KeyManagerFactory kmf;
              KeyStore ks;
              char[] passphrase = "passphrase".toCharArray();
              ctx = SSLContext.getInstance("TLS");
              kmf = KeyManagerFactory.getInstance("SunX509");
              ks = KeyStore.getInstance("JKS");
    //          ks.load(new FileInputStream("testkeys"), passphrase);
              ks.load(new FileInputStream("serverkey"), passphrase);
              kmf.init(ks, passphrase);
              ctx.init(kmf.getKeyManagers(), null, null);
              ssf = ctx.getServerSocketFactory();
              return ssf;
         } catch (Exception e) {
              e.printStackTrace();
         } else {
         return ServerSocketFactory.getDefault();
         return null;
    Could anyone help ?
    thanks in advance
    Jayaprakash

    The same thing.
    I have found the place where the exception throws.
    It is com.sun.net.ssl.internal.ssl.AVA class.
    It has a constructor AVA(StringReader)
    There is a check in this constructor of different certificate extensions
    (if-else). If it sees no familiar extension it throws exception and handshake fails.
    It is not difficult to fix this problem: just ignore unknown extension.
    Everything works fine with this "improved" class (under VA 3.5).
    But the problem is - the using of this class in applets.
    How can I say the browser to use my "improved" class and not the one it downloaded with java plug-in?

  • Error 403.7 - Forbidden: SSL client certificate is required

    Hi people!
    I�m developing a java client to a WebService (developed in .NET). The communication protocol is HTTPS to the URL where the Web Service is located (something like https://10.200.140.117/dirNotes/serviceName.asmx.). I�ve been reading many posts but I could'nt find the solution to the problem wich has the following message: Error 403.7 - Forbidden: SSL client certificate is required".
    I�m using JDK 1.5 and developing and testing on Windows Plataform. I'm able to access the URL specified above directly from the browser, I installed the client certificate (the same that �ve put into the ,jks keystore. I�ve also imported the whole certificate chain of the server to the cacerts.
    I�ll paste the code and the console trace below. I�d be very grateful if you can help me. Thanks a lot.
    _THE CODE_
    package principal;
    import java.io.BufferedReader;
    import java.io.FileInputStream;
    import java.io.FileNotFoundException;
    import java.io.FileReader;
    import java.io.IOException;
    import java.net.URL;
    import java.net.UnknownHostException;
    import java.security.KeyStore;
    import java.security.Security;
    import javax.net.ssl.HttpsURLConnection;
    import javax.net.ssl.KeyManagerFactory;
    import javax.net.ssl.SSLContext;
    import javax.net.ssl.SSLSocket;
    import javax.net.ssl.SSLSocketFactory;
    import javax.net.ssl.TrustManagerFactory;
    import org.apache.axis.client.Call;
    import org.apache.axis.client.Service;
    import entidade.Certificado;
    public class SSLClient {
    private static final int PORT_NUMBER = 443;
    private static final String HTTPS_ADDRESS = "10.200.140.117";
    private static String strCabecalhoMsg = "";
    private static String strDadosMsg = "";
    public static void main(String[] args) throws Exception {
    System.setProperty("javax.net.ssl.keyStore", Certificado.getStrNomeArquivoJKSServidor());
    System.setProperty("javax.net.ssl.keyStorePassword", "senha");
    System.setProperty("javax.net.ssl.trustStore", "Certificados/cacerts");
    System.setProperty("javax.net.ssl.trustStorePassword", "changeit");
    System.setProperty("javax.net.ssl.keyStoreType", "JKS");
    Security.addProvider(new com.sun.net.ssl.internal.ssl.Provider());
    System.setProperty("javax.net.debug","ssl,handshake,record");
    KeyStore ks = KeyStore.getInstance(KeyStore.getDefaultType());
    ks.load(new FileInputStream(Certificado.getStrNomeArquivoJKSServidor()),
    Certificado.getArranjoCharSenhaCertificadoServidor());
    KeyManagerFactory kmf = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
    kmf.init(ks, Certificado.getArranjoCharSenhaCertificadoServidor());
    KeyStore ksT = KeyStore.getInstance(KeyStore.getDefaultType());
    ksT.load(new FileInputStream("C:/Arquivos de programas/Java/jre1.5.0_05/lib/security/cacerts"), "changeit".toCharArray());
    TrustManagerFactory tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
    tmf.init(ksT);
    SSLContext sc = SSLContext.getInstance("SSLv3");
    sc.init(kmf.getKeyManagers(), tmf.getTrustManagers(), new java.security.SecureRandom());
    SSLSocketFactory factory = sc.getSocketFactory();
    try{
    // method to load the values of the strings strCabecalhoMsg and strDadosMsg
    carregarXMLCabecalhoDados();
    SSLSocket socket =(SSLSocket)factory.createSocket(HTTPS_ADDRESS, PORT_NUMBER);
    socket.startHandshake();
    String [] arr = socket.getEnabledProtocols();
    URL url = new URL("https://10.200.140.117/dirNotes");
    HttpsURLConnection.setDefaultSSLSocketFactory(factory);
    HttpsURLConnection urlc = (HttpsURLConnection) url.openConnection();
    urlc.setDoInput(true);
    urlc.setUseCaches(false);
    Object[] params = {strCabecalhoMsg, strDadosMsg};
    Service service = new Service();
    Call call = (Call) service.createCall();
    call.setTargetEndpointAddress(url);
    call.setOperationName("serviceName");
    String ret = (String) call.invoke(params);
    System.out.println("Result: " + ret);
    catch (UnknownHostException uhe) {
    uhe.printStackTrace();
    System.err.println(uhe);
    catch (Exception uhe) {
    uhe.printStackTrace();
    System.err.println(uhe);
    private static void carregarXMLCabecalhoDados()
    try
    BufferedReader input = new BufferedReader( new FileReader("notas/cabecalho.xml"));
    String str;
    while((str=input.readLine()) != null)
    strCabecalhoMsg += str ;
    System.out.println("Cabe�a: " + strCabecalhoMsg);
    input = new BufferedReader( new FileReader("notas/nota.xml"));
    while((str=input.readLine()) != null)
    strDadosMsg += str ;
    System.out.println("Nota: " + strDadosMsg);
    catch (FileNotFoundException e)
    // TODO Auto-generated catch block
    e.printStackTrace();
    catch (IOException e)
    // TODO Auto-generated catch block
    e.printStackTrace();
    _THE TRACE_
    adding as trusted cert:
    Subject: [email protected], CN=http://www.valicert.com/, OU=ValiCert Class 2 Policy Validation Authority, O="ValiCert, Inc.", L=ValiCert Validation Network
    Issuer: [email protected], CN=http://www.valicert.com/, OU=ValiCert Class 2 Policy Validation Authority, O="ValiCert, Inc.", L=ValiCert Validation Network
    Algorithm: RSA; Serial number: 0x1
    Valid from Fri Jun 25 21:19:54 BRT 1999 until Tue Jun 25 21:19:54 BRT 2019
    *others trusted certs*
    trigger seeding of SecureRandom
    done seeding SecureRandom
    export control - checking the cipher suites
    export control - no cached value available...
    export control - storing legal entry into cache...
    %% No cached client session
    *** ClientHello, TLSv1
    RandomCookie: GMT: 1198158630 bytes = { 48, 135, 53, 24, 112, 72, 104, 220, 27, 114, 37, 42, 25, 77, 224, 32, 12, 58, 90, 217, 232, 3, 104, 251, 93, 82, 40, 91 }
    Session ID: {}
    Cipher Suites: [SSL_RSA_WITH_RC4_128_MD5, SSL_RSA_WITH_RC4_128_SHA, TLS_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_DSS_WITH_AES_128_CBC_SHA, SSL_RSA_WITH_3DES_EDE_CBC_SHA, SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA, SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA, SSL_RSA_WITH_DES_CBC_SHA, SSL_DHE_RSA_WITH_DES_CBC_SHA, SSL_DHE_DSS_WITH_DES_CBC_SHA, SSL_RSA_EXPORT_WITH_RC4_40_MD5, SSL_RSA_EXPORT_WITH_DES40_CBC_SHA, SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA, SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA]
    Compression Methods: { 0 }
    main, WRITE: TLSv1 Handshake, length = 73
    main, WRITE: SSLv2 client hello message, length = 98
    main, READ: TLSv1 Handshake, length = 3953
    *** ServerHello, TLSv1
    RandomCookie: GMT: 1198158523 bytes = { 56, 166, 181, 215, 86, 245, 8, 55, 214, 108, 128, 50, 8, 11, 0, 209, 38, 62, 187, 185, 240, 231, 56, 161, 212, 111, 194, 79 }
    Session ID: {222, 2, 0, 0, 147, 179, 182, 212, 18, 34, 199, 100, 168, 167, 48, 116, 140, 186, 151, 153, 226, 168, 163, 174, 24, 83, 208, 73, 179, 57, 86, 137}
    Cipher Suite: SSL_RSA_WITH_RC4_128_MD5
    Compression Method: 0
    %% Created: [Session-1, SSL_RSA_WITH_RC4_128_MD5]
    ** SSL_RSA_WITH_RC4_128_MD5
    *** Certificate chain
    chain [0] = [
    Version: V3
    *many chains and related data*
    Found trusted certificate:
    Version: V3
    Subject:
    *many trusted certificates and related data*
    *** ServerHelloDone
    *** ClientKeyExchange, RSA PreMasterSecret, TLSv1
    Random Secret: { 3, 1, 117, 112, 233, 166, 240, 9, 226, 67, 53, 111, 194, 84, 124, 103, 197, 28, 17, 36, 32, 48, 145, 166, 161, 61, 30, 63, 153, 214, 137, 113, 222, 204, 138, 77, 212, 75, 65, 192, 159, 215, 69, 156, 47, 188, 179, 219 }
    main, WRITE: TLSv1 Handshake, length = 134
    SESSION KEYGEN:
    PreMaster Secret:
    0000: 03 01 75 70 E9 A6 F0 09 E2 43 35 6F C2 54 7C 67 ..up.....C5o.T.g
    0010: C5 1C 11 24 20 30 91 A6 A1 3D 1E 3F 99 D6 89 71 ...$ 0...=.?...q
    0020: DE CC 8A 4D D4 4B 41 C0 9F D7 45 9C 2F BC B3 DB ...M.KA...E./...
    CONNECTION KEYGEN:
    Client Nonce:
    0000: 47 6A 73 26 30 87 35 18 70 48 68 DC 1B 72 25 2A Gjs&0.5.pHh..r%*
    0010: 19 4D E0 20 0C 3A 5A D9 E8 03 68 FB 5D 52 28 5B .M. .:Z...h.]R([
    Server Nonce:
    0000: 47 6A 73 BB 38 A6 B5 D7 56 F5 08 37 D6 6C 80 32 Gjs.8...V..7.l.2
    0010: 08 0B 00 D1 26 3E BB B9 F0 E7 38 A1 D4 6F C2 4F ....&>....8..o.O
    Master Secret:
    0000: 0B 3A 71 F8 BB 79 5E 07 78 C2 5F 13 4F 92 9D 87 .:q..y^.x._.O...
    0010: CF 69 0D 07 78 D2 59 46 1E C3 C1 5B A2 DB 04 B9 .i..x.YF...[....
    0020: 42 60 92 48 59 8E FD FD C3 5B BD 00 9C 54 7A 7E B`.HY....[...Tz.
    Client MAC write Secret:
    0000: 33 7C 19 C4 75 D2 CE 82 39 98 37 E5 7D 20 CB B1 3...u...9.7.. ..
    Server MAC write Secret:
    0000: 1E 1E 48 C7 D4 77 23 E4 22 26 8B 98 2E 92 5C 95 ..H..w#."&....\.
    Client write key:
    0000: EE 05 39 76 B2 85 63 6C F7 70 30 CB 6D 08 07 54 ..9v..cl.p0.m..T
    Server write key:
    0000: 5C 2E 3B 5E DC D9 EC C5 04 C4 D5 B5 12 11 B9 08 \.;^............
    ... no IV for cipher
    main, WRITE: TLSv1 Change Cipher Spec, length = 1
    *** Finished
    verify_data: { 143, 115, 243, 131, 242, 244, 12, 44, 191, 172, 205, 122 }
    main, WRITE: TLSv1 Handshake, length = 32
    main, READ: TLSv1 Change Cipher Spec, length = 1
    main, READ: TLSv1 Handshake, length = 32
    *** Finished
    verify_data: { 231, 215, 37, 250, 177, 121, 111, 192, 11, 41, 1, 165 }
    %% Cached client session: [Session-1, SSL_RSA_WITH_RC4_128_MD5]
    setting up default SSLSocketFactory
    use default SunJSSE impl class: com.sun.net.ssl.internal.ssl.SSLSocketFactoryImpl
    class com.sun.net.ssl.internal.ssl.SSLSocketFactoryImpl is loaded
    keyStore is : Certificados/certificadoSondaMonitor.jks
    keyStore type is : JKS
    keyStore provider is :
    init keystore
    init keymanager of type SunX509
    trustStore is: Certificados\cacerts
    trustStore type is : jks
    trustStore provider is :
    init truststore
    adding as trusted cert:
    Subject: [email protected], CN=http://www.valicert.com/, OU=ValiCert Class 2 Policy Validation Authority, O="ValiCert, Inc.", L=ValiCert Validation Network
    Issuer: [email protected], CN=http://www.valicert.com/, OU=ValiCert Class 2 Policy Validation Authority, O="ValiCert, Inc.", L=ValiCert Validation Network
    Algorithm: RSA; Serial number: 0x1
    Valid from Fri Jun 25 21:19:54 BRT 1999 until Tue Jun 25 21:19:54 BRT 2019
    adding as trusted cert:
    * many certificates*
    init context
    trigger seeding of SecureRandom
    done seeding SecureRandom
    instantiated an instance of class com.sun.net.ssl.internal.ssl.SSLSocketFactoryImpl
    export control - checking the cipher suites
    export control - found legal entry in cache...
    %% No cached client session
    *** ClientHello, TLSv1
    RandomCookie: GMT: 1198158632 bytes = { 93, 1, 41, 236, 165, 146, 251, 117, 129, 195, 129, 72, 245, 181, 43, 48, 80, 251, 244, 198, 223, 85, 82, 101, 20, 159, 17, 26 }
    Session ID: {}
    Cipher Suites: [SSL_RSA_WITH_RC4_128_MD5, SSL_RSA_WITH_RC4_128_SHA, TLS_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_DSS_WITH_AES_128_CBC_SHA, SSL_RSA_WITH_3DES_EDE_CBC_SHA, SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA, SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA, SSL_RSA_WITH_DES_CBC_SHA, SSL_DHE_RSA_WITH_DES_CBC_SHA, SSL_DHE_DSS_WITH_DES_CBC_SHA, SSL_RSA_EXPORT_WITH_RC4_40_MD5, SSL_RSA_EXPORT_WITH_DES40_CBC_SHA, SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA, SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA]
    Compression Methods: { 0 }
    main, WRITE: TLSv1 Handshake, length = 73
    main, WRITE: SSLv2 client hello message, length = 98
    main, READ: TLSv1 Handshake, length = 3953
    *** ServerHello, TLSv1
    RandomCookie: GMT: 1198158525 bytes = { 109, 114, 234, 1, 130, 97, 251, 9, 61, 105, 56, 246, 239, 222, 97, 143, 22, 254, 65, 213, 10, 204, 153, 67, 237, 133, 223, 48 }
    Session ID: {23, 30, 0, 0, 26, 129, 168, 21, 252, 107, 124, 183, 171, 228, 138, 227, 94, 17, 195, 213, 216, 233, 205, 2, 117, 16, 21, 65, 123, 119, 171, 109}
    Cipher Suite: SSL_RSA_WITH_RC4_128_MD5
    Compression Method: 0
    %% Created: [Session-2, SSL_RSA_WITH_RC4_128_MD5]
    ** SSL_RSA_WITH_RC4_128_MD5
    *** Certificate chain
    chain [0] = [
    many chains again
    *** ServerHelloDone
    *** ClientKeyExchange, RSA PreMasterSecret, TLSv1
    Random Secret: { 3, 1, 116, 247, 155, 227, 25, 25, 231, 129, 199, 76, 134, 222, 98, 69, 149, 224, 75, 6, 60, 121, 115, 216, 244, 246, 102, 92, 188, 64, 113, 56, 190, 43, 32, 51, 90, 254, 141, 184, 71, 48, 41, 29, 173, 180, 46, 116 }
    main, WRITE: TLSv1 Handshake, length = 134
    SESSION KEYGEN:
    PreMaster Secret:
    0000: 03 01 74 F7 9B E3 19 19 E7 81 C7 4C 86 DE 62 45 ..t........L..bE
    0010: 95 E0 4B 06 3C 79 73 D8 F4 F6 66 5C BC 40 71 38 ..K.<ys...f\.@q8
    0020: BE 2B 20 33 5A FE 8D B8 47 30 29 1D AD B4 2E 74 .+ 3Z...G0)....t
    CONNECTION KEYGEN:
    Client Nonce:
    0000: 47 6A 73 28 5D 01 29 EC A5 92 FB 75 81 C3 81 48 Gjs(].)....u...H
    0010: F5 B5 2B 30 50 FB F4 C6 DF 55 52 65 14 9F 11 1A ..+0P....URe....
    Server Nonce:
    0000: 47 6A 73 BD 6D 72 EA 01 82 61 FB 09 3D 69 38 F6 Gjs.mr...a..=i8.
    0010: EF DE 61 8F 16 FE 41 D5 0A CC 99 43 ED 85 DF 30 ..a...A....C...0
    Master Secret:
    0000: FC C9 75 A4 2B F1 8A D8 AD 16 27 70 B7 E4 64 6C ..u.+.....'p..dl
    0010: 05 D7 33 4A 53 91 2F 51 1E 32 D3 3B 2E 18 2E BC ..3JS./Q.2.;....
    0020: E4 16 EE 2F 01 A1 08 48 19 09 32 68 CE 69 8F B1 .../...H..2h.i..
    Client MAC write Secret:
    0000: F1 95 3B CE 06 5B 8A 9B EC DE 1C 8F B4 AB D9 36 ..;..[.........6
    Server MAC write Secret:
    0000: BF 52 36 48 63 24 FE 74 22 BE 00 99 BE F0 6E E5 .R6Hc$.t".....n.
    Client write key:
    0000: 9F 08 0A 6E 8F 54 A3 66 1C BC C7 6B AE 88 67 E0 ...n.T.f...k..g.
    Server write key:
    0000: 06 A1 0B 4F 69 DE 5F AF 0E 6B B5 04 ED E8 EA F5 ...Oi._..k......
    ... no IV for cipher
    main, WRITE: TLSv1 Change Cipher Spec, length = 1
    *** Finished
    verify_data: { 148, 93, 105, 42, 110, 212, 55, 2, 150, 191, 13, 111 }
    main, WRITE: TLSv1 Handshake, length = 32
    main, READ: TLSv1 Change Cipher Spec, length = 1
    main, READ: TLSv1 Handshake, length = 32
    *** Finished
    verify_data: { 171, 150, 45, 10, 99, 35, 67, 174, 35, 52, 23, 192 }
    %% Cached client session: [Session-2, SSL_RSA_WITH_RC4_128_MD5]
    main, setSoTimeout(600000) called
    main, WRITE: TLSv1 Application Data, length = 282
    main, WRITE: TLSv1 Application Data, length = 8208
    main, WRITE: TLSv1 Application Data, length = 1102
    main, READ: TLSv1 Application Data, length = 1830
    main, received EOFException: ignored
    main, called closeInternal(false)
    main, SEND TLSv1 ALERT: warning, description = close_notify
    main, WRITE: TLSv1 Alert, length = 18
    main, called close()
    main, called closeInternal(true)
    AxisFault
    faultCode: {http://xml.apache.org/axis/}HTTP
    faultSubcode:
    faultString: (404)Not Found
    faultActor:
    faultNode:
    faultDetail:
         {}:return code: 404
    <!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
    <HTML><HEAD><TITLE>The page cannot be found</TITLE>
    <META HTTP-EQUIV="Content-Type" Content="text/html; charset=Windows-1252">
    <STYLE type="text/css">
    BODY { font: 8pt/12pt verdana }
    H1 { font: 13pt/15pt verdana }
    H2 { font: 8pt/12pt verdana }
    A:link { color: red }
    A:visited { color: maroon }
    </STYLE>
    </HEAD><BODY><TABLE width=500 border=0 cellspacing=10><TR><TD>
    <h1>The page cannot be found</h1>
    The page you are looking for might have been removed, had its name changed, or is temporarily unavailable.
    <hr>
    <p>Please try the following:</p>
    <ul>
    <li>Make sure that the Web site address displayed in the address bar of your browser is spelled and formatted correctly.</li>
    <li>If you reached this page by clicking a link, contact
    the Web site administrator to alert them that the link is incorrectly formatted.
    </li>
    <li>Click the <a href="javascript:history.back(1)">Back</a> button to try another link.</li>
    </ul>
    <h2>HTTP Error 404 - File or directory not found.<br>Internet Information Services (IIS)</h2>
    <hr>
    <p>Technical Information (for support personnel)</p>
    <ul>
    <li>Go to <a href="http://go.microsoft.com/fwlink/?linkid=8180">Microsoft Product Support Services</a> and perform a title search for the words <b>HTTP</b> and <b>404</b>.</li>
    <li>Open <b>IIS Help</b>, which is accessible in IIS Manager (inetmgr),
    and search for topics titled <b>Web Site Setup</b>, <b>Common Administrative Tasks</b>, and <b>About Custom Error Messages</b>.</li>
    </ul>
    </TD></TR></TABLE></BODY></HTML>
         {http://xml.apache.org/axis/}HttpErrorCode:404
    (404)Not Found
         at org.apache.axis.transport.http.HTTPSender.readFromSocket(HTTPSender.java:744)
         at org.apache.axis.transport.http.HTTPSender.invoke(HTTPSender.java:144)
         at org.apache.axis.strategies.InvocationStrategy.visit(InvocationStrategy.java:32)
         at org.apache.axis.SimpleChain.doVisiting(SimpleChain.java:118)
         at org.apache.axis.SimpleChain.invoke(SimpleChain.java:83)
         at org.apache.axis.client.AxisClient.invoke(AxisClient.java:165)
         at org.apache.axis.client.Call.invokeEngine(Call.java:2784)
         at org.apache.axis.client.Call.invoke(Call.java:2767)
         at org.apache.axis.client.Call.invoke(Call.java:2443)
         at org.apache.axis.client.Call.invoke(Call.java:2366)
         at org.apache.axis.client.Call.invoke(Call.java:1812)
         at principal.SSLClient.main(SSLClient.java:86)
    (404)Not Found
    -----

    I'm having the same problem with the same URL. I try many configuration and nothing works. My code is:
    public class NFeClient {
         static{
              Security.addProvider(new BouncyCastleProvider());
         public static void main(final String[] args) throws Exception {
              final String path = "https://homologacao.nfe.sefaz.rs.gov.br/ws/nfeconsulta/nfeconsulta.asmx";
              final String keyStoreProvider = "BC";
              final String keyStoreType = "PKCS12";
              final String keyStore = "/home/mendes/certificados/cert.p12";
              final String keyStorePassword = "xxxx";
              System.setProperty("javax.net.ssl.keyStoreProvider",keyStoreProvider);
              System.setProperty("javax.net.ssl.keyStoreType",keyStoreType);
              System.setProperty("javax.net.ssl.keyStore",keyStore);
              System.setProperty("javax.net.ssl.keyStorePassword",keyStorePassword);
              System.setProperty("javax.net.ssl.trustStore","/home/mendes/workspace/NFE/jssecacerts");
              final SSLContext context =  SSLContext.getInstance("TLS");
              final KeyManagerFactory kmf = KeyManagerFactory.getInstance("SunX509");
              final KeyStore ks = KeyStore.getInstance(keyStoreType);
              ks.load(new FileInputStream(keyStore), keyStorePassword.toCharArray());
              kmf.init(ks, keyStorePassword.toCharArray());
              context.init(kmf.getKeyManagers(), null, null);
              final URL url = new URL(path);
              final HttpsURLConnection httpsConnection = (HttpsURLConnection) url.openConnection();
              httpsConnection.setDoInput(true);
              httpsConnection.setRequestMethod("GET");
              httpsConnection.setRequestProperty("Host", "iis-server");
              httpsConnection.setRequestProperty("UserAgent", "Mozilla/4.0");
              httpsConnection.setSSLSocketFactory(context.getSocketFactory());
              try{
                   final InputStream is = httpsConnection.getInputStream();
                   final byte[] buff = new byte[1024];
                   int readed;
                   while((readed = is.read(buff)) > 0)
                        System.out.write(buff,0,readed);
              }catch(final IOException ioe){
                   ioe.printStackTrace();
    }and the response of the server is always the same:
    java.io.IOException: Server returned HTTP response code: 403 for URL: https://homologacao.nfe.sefaz.rs.gov.br/ws/nfeconsulta/nfeconsulta.asmx
         at sun.net.www.protocol.http.HttpURLConnection.getInputStream(HttpURLConnection.java:1241)
         at sun.net.www.protocol.https.HttpsURLConnectionImpl.getInputStream(HttpsURLConnectionImpl.java:234)
         at br.com.esales.nfe.signer.client.NFeClient.main(NFeClient.java:60)Edited by: mendes on Apr 25, 2008 9:56 AM

  • HTTPS Without client authentication shows error of Certificate

    Hi Experts,
    I am trying to develop a SOAP to RFC scenario where in SOAP sender HTTP security level - HTTPS Without Client Authentication is selected.
    I have downloaded WSDL from Sender agreement and trying to test web service from SOAPUI.  Now as per my understanding simply placing request to HTTPS:<host>:<port>:XISOAPAdapter/....   with correct user should work and this scenario shouldn't need any certificates.
    However in SOAPUI and even in RWB SOAP Sender, I am receiving error that - Client Certificate required.
    Any comments on why would it be happening ?    In fact whatever option in HTTP Security level I select, error remains same. In NWA is there any other configuration to be done to make this work ?
    Is below understanding right ?
    -- >> HTTPS Without client authentication will not need certificate exchange and simply user authentication will do
    Thanks..
    regards,
    Omkar.

    Hello Omkar,
    What you are trying to do is Consume a SOAP->RFC scenario (synchronous) from SOAP UI and you want that to be secure. With this requirement, just having the certificates alone is not sufficient (sorry for late response..i just came across this post when i was searching something else )
    1)How did you generate the certificate and the private key? Because Key Generation plays a Big Part in it. The Key should have been signed by a CA. Though its not signed by a CA, a trick which would work is, at the time of Key generation, provide the Organization Name as SAP Trust Community and Country as DE.
    2) At the time of Key Generation definitely it shall ask for a password. You remember that.
    3) Export the Private Key as PCKS12 format and the certificate as Base64 format and have it in your local system, (shall be used later in SOAP UI and NWA)
    Here follows the major part
    4) Open NWA and go to Configuration Management->Authentication
    5) Go to Properties Taband click Modify
    6)  Under Logon Application select the check box "Enable Showing Certificate Logon URL Link on Logon Page" and save it.
    7) Now go to the Components Tab.
    8) Search for client_cert Policy Configuration name and Edit it it. Make sure the following Login Modules are maintained in the same Order
    ==> Name: com.sap.engine.services.security.server.jaas.ClientCertLoginModule
           Flag : Sufficient
    ==> Name: BasicPasswordLoginModule
           Flag: Optional
    9) Now Select the name com.sap.engine.services.security.server.jaas.ClientCertLoginModule and you can see lots of entries under the Login Module Options. Remove them all and add anew entry (case sensitive). Save it.
    ==>Name: Rule1.getUserFrom
           value : wholeCert
    10) Now search for the Policy Configuration name sap.com/com.sap.aii.adapter.soap.app*XISOAPAdapter
    and edit it.
    11) Under the Authentication stack select the template client_cert against the used template label. and save it
    12)If you are using AXIS Adapter, do the steps 11 for the Policy Configuration name sap.com/com.sap.aii.axis.app*XIAxisAdapter.
    13) Now in NWA navigate to Operation management->Identity Management
    14) Search for the user PIISUSER (or any user id which you thing has good amount of authorizations to access the service)
    15)Click Modify and go to the TAB Certificates and upload the certificate (not the private key) which you downloaded in step 3.
    16) With this setup what you have done is you have created proper certificate, enabled certificate based logon for SOAP and AXIS adapter and associated the certificate with a user id.
    17) usually in Dual stack PI, we will have the same certificate added to the server pse in strustsso2 tcode. But since its single stack, just make sure in the cert and keys you add this certificate to teh Trusted CAs and also to the Server Keystore.
    18) Now in SOAP UI Right Click on the Project Name->Select Show Project View->Under the WS Security Configurations->Go to Keystore and certificates and add the Private Key
    19) In SOAP UI under the operation name, in the Request, in stead of providing user credentials, choose the private key name against the SSL Keystore entry.
    20) Before you execute the scenario  make sure you have chosen the HTTPS url and https port is proper. Usually its 443, but some customers configure their own port.
    Scenario should work now. Else if you track it using XPI Inspector, you can find out easily at which step it has gone wrong.
    Good Luck!!
    Best Regards,
    Sundar

  • SOAP Adapter - HTTPS w/ client authentication -SSL termination @ dispatcher

    Hi,
    We have a SOAP client sending SOAP message over SSL to PI. We are using client cert for authentication, but terminating SSL at web dispatcher. In this scenario, i) do we need to configure security for XISOAPADAPTER in Visual admin on PI and ii) do we need to set HTTPS with client authentication security option in SOAp Sender communication channel?
    My understanding is that since we are terminatinating SSL at web dispatcher (Server authentication happens between third-party gateway and our gateway and when web dispatcher terminates SSL, client cert for auth is passed via httpheader to PI where it is mapped to UME user with sufficient authorizations) we don't need to set the XISOAPADAPTER security (if it is end-to-end ssl we would i guess set up in V. Admin>Security provider service>clientcertloginmodule for XISOAPADAPTER) and we don't need to set the sender channel as https with client authentication ( it should just be http in SOAP sender channel).
    Is my understanding correct? I will really appreciate any clues?
    Thanks,
    Saurabh

    Hi saurabh
    follow these links to SAP note
    these will be helpful for you
    Note 856597 - FAQ: XI 3.0 / PI 7.0 / PI 7.1 SOAP Adapter
    https://websmp102.sap-ag.de/~form/handler?_APP=01100107900000000342&_EVENT=REDIR&_NNUM=856597&_NLANG=E
    Note 856599 - FAQ: XI 3.0 / PI 7.0 / PI 7.1 Mail Adapter
    https://websmp102.sap-ag.de/~form/handler?_APP=01100107900000000342&_EVENT=REDIR&_NNUM=856599&_NLANG=E
    Note 870845 - XI 3.0 SOAP adapter SSL client certificate problem
    https://websmp130.sap-ag.de/sap(bD1lbiZjPTAwMQ==)/bc/bsp/spn/sapnotes/index2.htm?numm=916664&nlang=EN&smpsrv=https%3a%2f%2fwebsmp102%2esap-ag%2ede
    https://websmp130.sap-ag.de/sap(bD1lbiZjPTAwMQ==)/bc/bsp/spn/sapnotes/index2.htm?numm=870845&nlang=EN&smpsrv=https%3a%2f%2fwebsmp102%2esap-ag%2ede
    regards
    Sandeep
    If helpful kindly reward points

  • SOAP Sender with HTTP(with SSL)=HTTPS with Client Authentication config

    Hi All,
    I have a Web-service-XI-Proxy scenario where we use SOAP Sender Adapter with HTTPs.  Double authentication (client- server) sertificate shall be used.
    Testing simple HTTP and XI user name/password works fine.
    Now I installed requred sertificates in TrustedCA and ssl-provider in VIsualadmin.
    But i can't see how i can configure certificates in SOAP sender Adapter. I've just did SOAP receiver for another scenario and there I could give keystore entry.
    I also doesn't know how to disable asking for name/password.  I am using XI 7.0.
    Please advise.
    Thanks,
    Nataliya

    Hi Nataliya,
    Go to SOAP Adapter> Inbound Security Checks-> HTTP Security Level--> Here you can specify  option "HTTP with Client Authentication. 
    One more thing HTTP Security level option is always available in Sender Adapter.
    For more clarity about HTTPS find below link.
    http://help.sap.com/saphelp_nw04/helpdata/en/14/ef2940cbf2195de10000000a1550b0/content.htm
    To enable the TrustedCA in SOAP Sender adapter. Go SOAP Sender> Security Parameter> Security Profile--> Web Service
    security. Then go to sender agreement there you need to give key store entry.

  • AnyConnect SSL-client Certificate AND AAA RADIUS

    Hi All,
    I'm trying to setup Anyconnect VPN Phone feature. I have the license, and I have been able to get the phone to authenticate / register etc with a username / password.
    I want to use the cert on the phone, use the CN as the username and just verify that against my ACS server via RADIUS.... Easier said than done. The ASA is grabbing the Username, but for the life of me, i can't get it to send the username over to the RADIUS server. I have enabled all sorts of aaa and radius debugging and just get no output at all...
    Here are some relevant log messages I'm getting:
    Starting SSL handshake with client outside:72.91.xx.xx/42501 for TLSv1 session
    Certificate was successfully validated. serial number: 5C7DB8EB000000xxxxxx, subject name:  cn=CP-7942G-SEP002155551BD7,ou=EVVBU,o=Cisco Systems Inc..
    Certificate chain was successfully validated with warning, revocation status was not checked.
    Tunnel group search using certificate maps failed for peer certificate:  serial number: 5C7DB8EB000000xxxxxx, subject name:  cn=CP-7942G-SEP002155551BD7,ou=EVVBU,o=Cisco Systems Inc., issuer_name:  cn=Cisco Manufacturing CA,o=Cisco Systems.
    Device completed SSL handshake with client outside:72.91.xx.xx/42501
    Group SSLClientProfile: Authenticating ssl-client connection from  72.91.14.42 with username, CP-7942G-SEP002155551BD7, from client  certificate
    Teardown TCP connection 35754 for outside:72.91.xx.xx/42501 to  identity:173.227.xxx.xxx/443 duration 0:00:05 bytes 5473 TCP Reset by  appliance
    Relevant Config:
    tunnel-group SSLClientProfile type remote-access
    tunnel-group SSLClientProfile general-attributes
    authentication-server-group RADIUS
    default-group-policy GroupPolicy1
    tunnel-group SSLClientProfile webvpn-attributes
    authentication aaa certificate
    radius-reject-message
    pre-fill-username ssl-client
    group-alias SSLClientProfile enable
    group-url https://URL enable
    group-policy GroupPolicy1 internal
    group-policy GroupPolicy1 attributes
    wins-server none
    dns-server value <ip1> <ip2>
    vpn-tunnel-protocol ssl-client
    default-domain value xxxxxxxx
    address-pools value VPNPOOL
    aaa-server RADIUS protocol radius
    aaa-server RADIUS (inside) host 192.168.102.242
    key *****
    aaa-server RADIUS (inside) host 192.168.240.242
    key *****
    ASA version 8.4
    What am I doing wrong? It will not send the request to the AAA server, very much frustating me...

    PRogress....
    I changed the authentication to Certificate ONLY and set authorization to be RADIUS... now it's sending the request to my ACS server. Next question: What's the password that's being sent? Is it blank? I've tried the phone's whole username, tried the MAC and tried just the SEP part. No Dice. Thoughts?

  • J2me https negotiation - Client Certificate

    Hello all,
    I am developing a j2me application and i am extremely concerned about the security
    and encryption of data. I am planning to implement this using the https implementation
    of java for MIDP2.0 profile and cldc1.1 configuration.
    My question concerns exactly the kvm performs the https negotiation beetween the sever and
    the client and particularly if the client sends a certificate, so the sever knows that the
    request is from a valid source.
    Lets examine the following scenario:
    I have a digitally signed Midlet and a https server with a valid certificate.The Midlet
    performs a https connection with the server.During the "handshake" client and server exchange some messages so they can authenticate each other.
    I know that servers Certificate is used and client can authenticate that server is a trusted source.Does this happen also from client side? Meaning that the client is using a certificate? What certificate? Does the programmer have to implement/materialize anything or this is done automatically and transparently from kvm?
    Please Advice
    NiKolaos

    Hi Vance,
    In http outbound tunnel is allowed with ports 1- 65535. Here issue is while communication between client and server certificate length was 0 which means SSL communication is not happening properly
    Regards
    Chirag

  • Why are intermediate certificates needed within STRUST with SAP as SSL client?

    Scenario: My company is hosting various applications on a web server. Our customers connect their SAP systems to our applications using web services.  We changed one of our VeriSign web server SSL certificates a few weeks ago. This new SSL certificate was signed by a VeriSign intermediate CA which itself is signed by a new VeriSign root CA.
    In the past, we only took care that our customers have the corresponding VeriSign root certificate imported into their SAP via STRUST; in our case this is the following root certificate: http://www.verisign.com/repository/roots/root-certificates/PCA-3G5.pem
    Now as we changed the certificate on our web server, our customers can't connect to it with their SAP systems any more. We found out that it works again, if the customers additionally import the VeriSign intermediate certificates into their SAP via STRUST; in our case the following ones: https://www.verisign.com/support/verisign-intermediate-ca/secure-site-intermediate/index.html
    This is something we don't understand for two reasons:
    1.) Usually it shouldn't be necessary to have intermediate certificates on client side, only on the web server. We saved the two VeriSign intermediate certificates into one file and linked it within our Apache via the "SSLCertificateChainFile" directive. This is what we expected to be enough for all SSL clients which have the corresponding root certificate within their certificate stores.
    2.) Our old certificate was signed by an (other) intermediate certificate, too and we didn't have  this one on client side at our customers… it worked. Why? The only difference seems to be, that the old chain had only one intermediate certificate and the new one has two.
    Anyone has an answer to these questions or an idea how to avoid uploading the intermediate certificates all the time? 

    Hi !
    have a look at this thread may be helpful for you .
    Cannot import certificate response in STRUST
    Regds
    Abhishek

  • Oracle HTTP Server, client certificate chain

    I use Oracle (Apache) HTTP Server, installed from Oracle SOA Suit distrib.
    There're 2 types of ssl client cert chains that I use: client-issue-root, client-root.
    My ssl works fine, unless I should config mod_ossl to accept only user certificates signed by certificate issuer (not root).
    I add SSLRequire directive:
    SSLOptions StdEnvVars ExportCertData
    SSLRequire (%{SSL_CLIENT_CERT_CHAIN_0} == file("/path/to/issue.cer"))
    but this doesn't work (condition expression always turn in false), and
    SSLOptions StdEnvVars ExportCertData
    SSLRequire (%{SSL_CLIENT_CERT_CHAIN_0} == "")
    condition always turn in true.
    So, SSL_CLIENT_CERT_CHAIN_0 is ALWAYS EMPTY.
    I've tried to use different versions of ApacheModuleOSSL.dll (build in 09/19/2006 version 10.1.3.1, 06/12/2007 version 10.1.3.3), result is the same.
    I've found something about mod_ssl (not mod_ossl) in "Technologies for Information Environment Security: TIES project report" (http://edina.ac.uk/projects/ties/ties_23-9.pdf):
    "NOTE: This is the second, and more significant, problem we encountered in this area of mod_ssl: the first caused all the
    SSL_CLIENT_CERT_CHAIN_n environmental variables to be empty. We traced this bug back to a literal +17 offset into a
    character string that should have been +18, but by the time we had done so, a fixed version was available."
    Is there the same problem in mod_ossl?
    Does anybody have any ideas?

    Once again)
    http://www.mail-archive.com/[email protected]/msg11705.html
    I've got a question for Oracle developers: is this the same problem in OHS and OHS2 mod_ossl?
    And if yes, when we can wait the patch?
    Thanks!

  • Javax.xml.ws.soap.SOAPFaultException: InvalidSecurity : error in processing the WS-Security security header error while invoking FinancialUtilService using HTTP proxy client

    I am trying to invoke FinancialUtilService using HTTP proxy client. I am getting below error while i am trying to invoke this service. Using FusionServiceTester i am able to invoke service and upload file to UCM. Using oracle.ucm.fa_client_11.1.1.jar also i am able to upload file to UCM without any issue. But using HTTP proxy client i am facing below error. Can anyone please help me. PFA code i am using to invoke this service.
    javax.xml.ws.soap.SOAPFaultException: InvalidSecurity : error in processing the WS-Security security header
      at com.sun.xml.ws.fault.SOAP11Fault.getProtocolException(SOAP11Fault.java:197)
      at com.sun.xml.ws.fault.SOAPFaultBuilder.createException(SOAPFaultBuilder.java:122)
      at com.sun.xml.ws.client.sei.SyncMethodHandler.invoke(SyncMethodHandler.java:125)
      at com.sun.xml.ws.client.sei.SyncMethodHandler.invoke(SyncMethodHandler.java:95)
      at com.sun.xml.ws.client.sei.SEIStub.invoke(SEIStub.java:135)
      at $Proxy43.uploadFileToUcm(Unknown Source)
      at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
      at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
      at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
      at java.lang.reflect.Method.invoke(Method.java:597)
      at weblogic.wsee.jaxws.spi.ClientInstance$ClientInstanceInvocationHandler.invoke(ClientInstance.java:363)
      at $Proxy44.uploadFileToUcm(Unknown Source)
      at com.oracle.xmlns.apps.financials.commonmodules.shared.financialutilservice.FinancialUtilServiceSoapHttpPortClient.invokeUpload(FinancialUtilServiceSoapHttpPortClient.java:299)
      at com.oracle.xmlns.apps.financials.commonmodules.shared.financialutilservice.FinancialUtilServiceSoapHttpPortClient.main(FinancialUtilServiceSoapHttpPortClient.java:273)
    Process exited with exit code 0.
    Message was edited by: Oliver Steinmeier
    Removed attachment

    Hi Jani,
    Thanks for your reply.
    I am new to webservices and we are trying to do a POC on invoking FinancialUtilService using HTTP proxy client. I am following steps mentioned in attached pdf section "Invoking FinancialUtil Service using Web Service Proxy Client". I have imported certificate using below command. 
         keytool -import -trustcacerts -file D:\Retek\Certificate.cer -alias client -keystore D:\Retek\default-keystore.jks -storepass welcome1
    Invoking
        SecurityPolicyFeature[] securityFeature =
        new SecurityPolicyFeature[] { new
        SecurityPolicyFeature("oracle/wss11_saml_token_with_message_protection_client_policy")};
        financialUtilService_Service = new FinancialUtilService_Service();
        FinancialUtilService financialUtilService= financialUtilService_Service.getFinancialUtilServiceSoapHttpPort(securityFeature);
        // Get the request context to set the outgoing addressing properties
        WSBindingProvider wsbp = (WSBindingProvider)financialUtilService;
        WSEndpointReference replyTo =
          new WSEndpointReference("https://efops-rel91-patchtest-external-fin.us.oracle.com/finFunShared/FinancialUtilService", WS_ADDR_VER);
        String uuid = "uuid:" + UUID.randomUUID();
        wsbp.setOutboundHeaders( new StringHeader(WS_ADDR_VER.messageIDTag, uuid), replyTo.createHeader(WS_ADDR_VER.replyToTag));
        wsbp.getRequestContext().put(WSBindingProvider.USERNAME_PROPERTY, "fin_user1");
        wsbp.getRequestContext().put(WSBindingProvider.PASSWORD_PROPERTY,  "Welcome1");
        wsbp.getRequestContext().put(ClientConstants.WSSEC_RECIPIENT_KEY_ALIAS,"service");
        wsbp.getRequestContext().put(ClientConstants.WSSEC_KEYSTORE_LOCATION, "D:/Retek/default-keystore.jks");
        wsbp.getRequestContext().put(ClientConstants.WSSEC_KEYSTORE_PASSWORD, "welcome1" );
        wsbp.getRequestContext().put(ClientConstants.WSSEC_KEYSTORE_TYPE, "JKS" );
        wsbp.getRequestContext().put(ClientConstants.WSSEC_SIG_KEY_ALIAS, "client" );
        wsbp.getRequestContext().put(ClientConstants.WSSEC_SIG_KEY_PASSWORD, "password" );
        wsbp.getRequestContext().put(ClientConstants.WSSEC_ENC_KEY_ALIAS, "client" );
        wsbp.getRequestContext().put(ClientConstants.WSSEC_ENC_KEY_PASSWORD, "password" );
    SEVERE: WSM-00057 The certificate, client, is not retrieved.
    SEVERE: WSM-00137 The encryption certificate, client, is not retrieved due to exception oracle.wsm.security.SecurityException: WSM-00057 : The certificate, client, is not retrieved..
    SEVERE: WSM-00161 Client encryption public certificate is not configured for Async web service client
    SEVERE: WSM-00005 Error in sending the request.
    SEVERE: WSM-07607 Failure in execution of assertion {http://schemas.oracle.com/ws/2006/01/securitypolicy}wss11-saml-with-certificates executor class oracle.wsm.security.policy.scenario.executor.Wss11SamlWithCertsScenarioExecutor.
    SEVERE: WSM-07602 Failure in WS-Policy Execution due to exception.
    SEVERE: WSM-07501 Failure in Oracle WSM Agent processRequest, category=security, function=agent.function.client, application=null, composite=null, modelObj=FinancialUtilService, policy=oracle/wss11_saml_token_with_message_protection_client_policy, policyVersion=null, assertionName={http://schemas.oracle.com/ws/2006/01/securitypolicy}wss11-saml-with-certificates.
    oracle.wsm.common.sdk.WSMException: WSM-00161 : Client encryption public certificate is not configured for Async web service client
      at oracle.wsm.security.policy.scenario.executor.Wss11SamlWithCertsScenarioExecutor.sendRequest(Wss11SamlWithCertsScenarioExecutor.java:173)
      at oracle.wsm.security.policy.scenario.executor.SecurityScenarioExecutor.execute(SecurityScenarioExecutor.java:545)
      at oracle.wsm.policyengine.impl.runtime.AssertionExecutor.execute(AssertionExecutor.java:41)
      at oracle.wsm.policyengine.impl.runtime.WSPolicyRuntimeExecutor.executeSimpleAssertion(WSPolicyRuntimeExecutor.java:608)
      at oracle.wsm.policyengine.impl.runtime.WSPolicyRuntimeExecutor.executeAndAssertion(WSPolicyRuntimeExecutor.java:335)
      at oracle.wsm.policyengine.impl.runtime.WSPolicyRuntimeExecutor.execute(WSPolicyRuntimeExecutor.java:282)
      at oracle.wsm.policyengine.impl.PolicyExecutionEngine.execute(PolicyExecutionEngine.java:102)
      at oracle.wsm.agent.WSMAgent.processCommon(WSMAgent.java:915)
      at oracle.wsm.agent.WSMAgent.processRequest(WSMAgent.java:436)
      at oracle.wsm.agent.handler.WSMEngineInvoker.handleRequest(WSMEngineInvoker.java:393)
      at oracle.wsm.agent.handler.wls.WSMAgentHook.handleRequest(WSMAgentHook.java:239)
      at weblogic.wsee.jaxws.framework.jaxrpc.TubeFactory$JAXRPCTube.processRequest(TubeFactory.java:220)
      at weblogic.wsee.jaxws.tubeline.FlowControlTube.processRequest(FlowControlTube.java:98)
      at com.sun.xml.ws.api.pipe.Fiber.__doRun(Fiber.java:604)
      at com.sun.xml.ws.api.pipe.Fiber._doRun(Fiber.java:563)
      at com.sun.xml.ws.api.pipe.Fiber.doRun(Fiber.java:548)
      at com.sun.xml.ws.api.pipe.Fiber.runSync(Fiber.java:445)
      at com.sun.xml.ws.client.Stub.process(Stub.java:259)
      at com.sun.xml.ws.client.sei.SEIStub.doProcess(SEIStub.java:152)
      at com.sun.xml.ws.client.sei.SyncMethodHandler.invoke(SyncMethodHandler.java:115)
      at com.sun.xml.ws.client.sei.SyncMethodHandler.invoke(SyncMethodHandler.java:95)
      at com.sun.xml.ws.client.sei.SEIStub.invoke(SEIStub.java:135)
      at $Proxy43.uploadFileToUcm(Unknown Source)
      at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
      at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
      at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
      at java.lang.reflect.Method.invoke(Method.java:597)
      at weblogic.wsee.jaxws.spi.ClientInstance$ClientInstanceInvocationHandler.invoke(ClientInstance.java:363)
      at $Proxy44.uploadFileToUcm(Unknown Source)
      at com.oracle.xmlns.apps.financials.commonmodules.shared.financialutilservice.FinancialUtilServiceSoapHttpPortClient.invokeUpload(FinancialUtilServiceSoapHttpPortClient.java:111)
      at com.oracle.xmlns.apps.financials.commonmodules.shared.financialutilservice.FinancialUtilServiceSoapHttpPortClient.main(FinancialUtilServiceSoapHttpPortClient.java:86)
    Caused by: oracle.wsm.security.SecurityException: WSM-00161 : Client encryption public certificate is not configured for Async web service client
      at oracle.wsm.security.policy.scenario.processor.Wss11X509TokenProcessor.insertClientEncCertToWSAddressingHeader(Wss11X509TokenProcessor.java:979)
      at oracle.wsm.security.policy.scenario.processor.Wss11X509TokenProcessor.build(Wss11X509TokenProcessor.java:206)
      at oracle.wsm.security.policy.scenario.executor.Wss11SamlWithCertsScenarioExecutor.sendRequest(Wss11SamlWithCertsScenarioExecutor.java:164)
      ... 30 more
    Caused by: oracle.wsm.security.SecurityException: WSM-00057 : The certificate, client, is not retrieved.
      at oracle.wsm.security.jps.WsmKeyStore.getJavaCertificate(WsmKeyStore.java:534)
      at oracle.wsm.security.jps.WsmKeyStore.getCryptCert(WsmKeyStore.java:570)
      at oracle.wsm.security.policy.scenario.processor.Wss11X509TokenProcessor.insertClientEncCertToWSAddressingHeader(Wss11X509TokenProcessor.java:977)
      ... 32 more
    SEVERE: WSMAgentHook: An Exception is thrown: WSM-00161 : Client encryption public certificate is not configured for Async web service client
    File upload failed
    javax.xml.ws.WebServiceException: javax.xml.rpc.JAXRPCException: oracle.wsm.common.sdk.WSMException: WSM-00161 : Client encryption public certificate is not configured for Async web service client
      at weblogic.wsee.jaxws.framework.jaxrpc.TubeFactory$JAXRPCTube.processRequest(TubeFactory.java:231)
      at weblogic.wsee.jaxws.tubeline.FlowControlTube.processRequest(FlowControlTube.java:98)
      at com.sun.xml.ws.api.pipe.Fiber.__doRun(Fiber.java:604)
      at com.sun.xml.ws.api.pipe.Fiber._doRun(Fiber.java:563)
      at com.sun.xml.ws.api.pipe.Fiber.doRun(Fiber.java:548)
      at com.sun.xml.ws.api.pipe.Fiber.runSync(Fiber.java:445)
      at com.sun.xml.ws.client.Stub.process(Stub.java:259)
      at com.sun.xml.ws.client.sei.SEIStub.doProcess(SEIStub.java:152)
      at com.sun.xml.ws.client.sei.SyncMethodHandler.invoke(SyncMethodHandler.java:115)
      at com.sun.xml.ws.client.sei.SyncMethodHandler.invoke(SyncMethodHandler.java:95)
      at com.sun.xml.ws.client.sei.SEIStub.invoke(SEIStub.java:135)
      at $Proxy43.uploadFileToUcm(Unknown Source)
      at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
      at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39)
      at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25)
      at java.lang.reflect.Method.invoke(Method.java:597)
      at weblogic.wsee.jaxws.spi.ClientInstance$ClientInstanceInvocationHandler.invoke(ClientInstance.java:363)
      at $Proxy44.uploadFileToUcm(Unknown Source)
      at com.oracle.xmlns.apps.financials.commonmodules.shared.financialutilservice.FinancialUtilServiceSoapHttpPortClient.invokeUpload(FinancialUtilServiceSoapHttpPortClient.java:111)
      at com.oracle.xmlns.apps.financials.commonmodules.shared.financialutilservice.FinancialUtilServiceSoapHttpPortClient.main(FinancialUtilServiceSoapHttpPortClient.java:86)
    Caused by: javax.xml.rpc.JAXRPCException: oracle.wsm.common.sdk.WSMException: WSM-00161 : Client encryption public certificate is not configured for Async web service client
      at oracle.wsm.agent.handler.wls.WSMAgentHook.handleException(WSMAgentHook.java:395)
      at oracle.wsm.agent.handler.wls.WSMAgentHook.handleRequest(WSMAgentHook.java:248)
      at weblogic.wsee.jaxws.framework.jaxrpc.TubeFactory$JAXRPCTube.processRequest(TubeFactory.java:220)
      ... 19 more

Maybe you are looking for