Problems with Oracle Web Logic 10.3.6, certificates and proxies

Question

Good morning.
We are trying to establish a SSL connection using Apache Cxf and WebLogic Server 10.3.6.
For that, we are passing through a proxy. Using Apache Tomcat, the test is ok, we can connect to the endpoint correctly. But in WebLogic 10.3.6, we have problems with the certificates.
In our code, we are loading the certificates programatically.
The web-services-config.xml is the following:
<?xml version="1.0" encoding="UTF-8"?>
<beans
     xsi:schemaLocation=" http://www.springframework.org/schema/beans http://www.springframework.org/schema/beans/spring-beans-2.5.xsd http://cxf.apache.org/configuration/security http://cxf.apache.org/schemas/configuration/security.xsd http://cxf.apache.org/transports/http/configuration http://cxf.apache.org/schemas/configuration/http-conf.xsd http://cxf.apache.org/jaxws http://cxf.apache.org/schemas/jaxws.xsd http://www.springframework.org/schema/context http://www.springframework.org/schema/context/spring-context-2.5.xsd"
     xmlns:http="http://cxf.apache.org/transports/http/configuration"
     xmlns:sec="http://cxf.apache.org/configuration/security" xmlns:jaxws="http://cxf.apache.org/jaxws"
     xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xmlns="http://www.springframework.org/schema/beans">
     <jaxws:client address="@SNE.SNE_WS_URL@"
          serviceClass="com.bankia.sne.ws.clientes.buzonAPESNE.APESNEBuzonWSTipoPuerto"
          id="puertoAPESNEBuzonWS" />
     <http:conduit name="@SNE.SNE_WS_URL@">
          <http:client Connection="Keep-Alive" AutoRedirect="true"
               ProxyServerType="HTTP" ProxyServerPort="@SNE.PROXY_PORT@"
               ProxyServer="@SNE.PROXY_HOST@" />
          <http:proxyAuthorization>+
               <sec:UserName>@SNE.PROXY_USER@</sec:UserName>
               <sec:Password>@SNE.PROXY_PASSWORD@</sec:Password>
          </http:proxyAuthorization>
          <http:tlsClientParameters>
               <sec:cipherSuitesFilter>
                    <!-- these filters ensure that a ciphersuite with export-suitable or
                         null encryption is used, but exclude anonymous Diffie-Hellman key change
                         as this is vulnerable to man-in-the-middle attacks -->
                    <sec:include>.*EXPORT.*</sec:include>
                    <sec:include>.*EXPORT1024.*</sec:include>
                    <sec:include>.*WITHDES_.*</sec:include>
                    <sec:include>.*WITHNULL_.*</sec:include>
                    <sec:exclude>.*DHanon_.*</sec:exclude>
               </sec:cipherSuitesFilter>
          </http:tlsClientParameters>
     </http:conduit>
</beans>
That's the code used for establish the CXF connection:
private void configuraConexion(Buzon buzon){
          try {
               LOGGER.debug("Configurando conexión con el sevicio Web para el buzón con id " + buzon.getId() + " ...");
               Client client = ClientProxy.getClient(puertoAPESNEBuzonWS);
               HTTPConduit httpConduit = (HTTPConduit) client.getConduit();
               TLSClientParameters tlsParams = httpConduit.getTlsClientParameters();
               Certificado certificado = buzon.getCertificado();
               byte[] bytes = certificado.bytesCertificado();
               CertificadoSerializable certSerializado = (CertificadoSerializable)Serializador.desserializar(bytes);
               //Cargamos el truststore de disco
               TrustManagerFactory trustFactory = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());
               KeyStore truststore = KeyStore.getInstance(Propiedades.getProperty(KEY_SERVICIO_WEB_ALMACEN_TRUSTSTORE));
               String contrasenia = Propiedades.getProperty(KEY_SERVICIO_WEB_TRUSTORE_PASSWORD);
               // -- provide your truststore
               File ficheroTruststore = null;
               String rutaTrustore = Propiedades.getProperty(KEY_SERVICIO_WEB_TRUSTORE_RUTA) Propiedades.getProperty(KEY_SERVICIO_WEB_NOMBRE_TRUSTSTORE);
               LOGGER.debug("rutaTrustore --> " + rutaTrustore);
               if (rutaTrustore!=null){+
                    ficheroTruststore = new File(rutaTrustore);
          URL url = null;
               if(ficheroTruststore == null || !ficheroTruststore.exists()){
                    url = Localizador.getResource(Propiedades.getProperty(KEY_SERVICIO_WEB_NOMBRE_TRUSTSTORE));
                    ficheroTruststore = new File(url.getPath());
                    truststore.load(url.openStream(), contrasenia.toCharArray());
               }else{
                    truststore.load(new FileInputStream(ficheroTruststore), contrasenia.toCharArray());                    
               LOGGER.info("[ServicioWSBuzonAPESNEImpl.configuraConexion] Fichero truststore.pks recuperado de "+ficheroTruststore.getPath());
               trustFactory.init(truststore);
               TrustManager[] tm = trustFactory.getTrustManagers();
               tlsParams.setTrustManagers(tm);
               //Cargamos el Keystore de base de datos
               KeyStore keyStore = KeyStore.getInstance(Propiedades.getProperty(KEY_SERVICIO_WEB_TIPO_ALMACEN_KEYSTORE));
               keyStore.load(null, certificado.getContrasenia().toCharArray());
               keyStore.setKeyEntry(certificado.getAlias(), certSerializado.getClavePrivada(), certificado.getContrasenia().toCharArray(), certSerializado.getCadena());
               // set our key store+
               // (used to authenticate the local SSLSocket to its peer)
               KeyManagerFactory keyFactory = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
               keyFactory.init(keyStore, certificado.getContrasenia().toCharArray());
               KeyManager[] km = keyFactory.getKeyManagers();
               tlsParams.setKeyManagers(km);
               httpConduit.setTlsClientParameters(tlsParams);
               LOGGER.debug("Conexión configurada satisfactoriamente");
          }catch (Exception e) {
               LOGGER.error("Error al configurar la conexión del servicio Web", e);
               throw new WSBuzonException("Error al configurar la conexión del servicio Web: " + e.getMessage());
We don't know how to solve this issue? Please, could you help us?
Thanks in advance,
Jaime.
Edited by: j2eedevelopment on 10-jul-2012 10:05

Answer 1

Hi Zack, thanks for the answer.
I've cleaned the code below.
Our problem is the following: we wan't to use many keystores, in function the user who is connected in the application. For that reason, we wan't to give the keyStore from Java Client, because we've saw that, in WebLogic, you can select one keystore, but only one. For that reason, we wantto change the keystore in run time execution, dinamically.
The problem we have found are the following:
1) If we configure WebLogic with the correct keystore and trustore, we are not able to change keysotre and trustore in runtime execution, so we have to us always the same keystore and we don't want this.
2) Also, I'm trying now to use JaxWS instead Apache Cxf, and I've tried to put the ssl properties of the system with the following code:
System.setProperty(JAVAXNETSSLTRUST_STORE, trustore);
System.setProperty(JAVAXNETSSLTRUST_STORE_PASSWORD, trustStorePassword);
System.setProperty(JAVAXNETSSLKEY_STORE, keyStore);
System.setProperty(JAVAXNETSSLKEY_STORE_PASSWORD, keyStorePassword);
System.setProperty(JAVAXNETSSLKEY_STORE_TYPE, keyStoreType);
Thanks in advance,
Jaime.