Requesting the client to present a certificate?

Hi there, I'm currently trying to write a servlet, which would prompt the user to chose a certificate from their browser. Then based on the type of certificate (we have issued 2 different types of certificates, one a long time ago and one fairly recently), I would direct them to 2 different pages.
Is this possible?
Farhan

Perfect, thanks! That answers the first part of my question. Now I'm wondering if what I'm trying to do is even possible.
Basically, after requesting the client cert. (I'm guessing this is an SSL session), I want to redirect the browser to one of two sites. These other 2 sites are also SSL sessions and will also request the certificate. I'm guessing the user will have to choose his same cert twice. Is there anyway to avoid the 2nd cert request?
Maybe by forwarding the cert to the 2nd server, and then redirecting the browser, or some other such trick?

Similar Messages

How do I get the client certificate from the request

We are on Netweaver 2004 using the SAP webdispatcher (end-to-end). I need to do an OCSP validation, I have all of the code I need for the OCSP portion. What I need is the X509Certficate that came from the client. Is this stored in the request object, session? How do I get it?
Thanks.

Hi Joseph,
I think the question is which component terminates the SSL connection. It could be an upfront load balancer or the WebAS itself. The former could write the certificate into a request header vairable, while the latter will create a J2EE standard request attribute: javax.servlet.request.X509Certificate
I never did it with the web dispatcher, but you can try the following:
X509Certificate[] certs = (X509Certificate[]) request.getAttribute("javax.servlet.request.X509Certificate");
HTH
Daniel

Getting the Client Certificate out of the HttpServletRequest object

I have an interesting issue with weblogic 5.1 SP6 and getting/obtaining Client
Certificates.
The issue is that the Client Certificate is not always in the HttpServletRequest
object depending on how the weblogic.properties are set. Here is my code to get
the Certificates.
// get the cert chain from the request
Object obj=request.getAttributs("javax.net.ssl.peer_certificates");
if (obj instanceof weblogic.security.X509[]) {
weblogic.security.X509[] wlogicCert = (weblogic.security.X509[]) obj;
                                        try {
                                        iaik.x509.X509Certificate iaikClientCert =
     new iaik.x509.X509Certificate(wlogicCert[0].getBytes());
     clientSDN = aiaikClientCert.getSubjectDN().getName();
     clientCert = (Certificate)iaikClientCert;
The only time the certificate is present in the Request Object is when the following
weblogic.properties are set:
weblogic.security.enforceClientCert=true
weblogic.security.clientRootCA=CARoot.pem
If the properties are set to to this: no Certificate can be received from the
Request object.
weblogic.security.enforceClientCert=false
#weblogic.security.clientRootCA=CARoot.pem
Is there a way to have Weblogic always receive/get a Client Certificate if one
is provided by the client, but not have weblogic do any validation of the certificate?
Any help would be appreciated!
Gary

ok i see.
although it should be able to get the underlying
outputStream handle since i have initialized
(associated) it on the previous line.
ThanksWell, you might be able to get the underlying stream. Look at the API docs. If there's a method there to do it, then you can. If not, then you can't.
If you can do it, then you have to look at the API docs for FileOutputStream and see if it lets you get the associated File or path. If such a method exists, then you can get it. If not, then you can't.
Even if both methods exist and you can utimately get the file, do you understand why this is not the same as "getting the file associated with a PrintStream"?

2-way SSL and access control using the client certificate

Hi,
I'd like to configure WLS 8.1 so that the server will use the client identity extracted from the client certificate to determine whether permissions should be granted. I am having some problems.
Details: The client can be either a Web service or a web application. The steps for authentication and authorization should be:
- The client sends a request to an Apache server (DMZ) which will then be forwarded to WLS.
- The client's identity, common name from the X.509 certificate, is mapped to the "username" (using WLS default identity assertion provider).
- Validate whether the client should be trusted (via the list in the trusted credentials)
- Check whether the resource should be granted based on the "username".
The on-line manual says
"If the Web browser or Java client requests a WebLogic Server resource protected by a security policy, WebLogic Server requires that the Web browser or Java client have an identity."
"The user corresponding to the Subject's Distinguished Name (SubjectDN) attribute in the client's digital certificate must be defined in the server's security realm; otherwise the client will not be allowed to access a protected WebLogic resource. For information on configuring users on the server, see Creating Users in Managing WebLogic Security."
So the questions I have are:
- If the client identity is certificate based, why should we configure users with the "user name" and "password"? How can we get around it?
- Once I defined the security condition for my app to use "user name of the caller," a default username and password prompt automatically popped up.
Apparently, the SSL mutual authentication configuration and the default authentication provider to use the X.509 type didn't take any effect.
- Without defining the security policy for the application, the debugging messages show that
getRoles(): input arguments: subject:0
Entitlement - <Role:Annonymous with expr:Grp(everyone)>
Any suggestions? Thanks.

Hi,
I am trying to use 2 way ssl using webservices client , here is my code :
AxisProperties.setProperty("org.apache.axis.components.net.SecureSocketFactory","org.apache.axis.components.net.SunFakeTrustSocketFactory");
SSLAdapterFactory factory = SSLAdapterFactory.getDefaultFactory();
WLSSLAdapter adapter = (WLSSLAdapter) factory.getSSLAdapter();
// clientCredentialFile stores in PEM format the public key and
// all the CAs associated with it + then the private key. All this in // a concatenated manner
FileInputStream clientCredentialFile = new FileInputStream ("C:\\sslcert\\client-pub3.pem");
// private key password
String pwd = "password";
adapter.loadLocalIdentity(clientCredentialFile, pwd.toCharArray());
adapter.setVerbose(true);
adapter.setTrustedCertificatesFile("C:\\certificate\\server\\server.jks");
adapter.setStrictCheckingDefault(false);
factory.setDefaultAdapter(adapter);
factory.setUseDefaultAdapter(true);
boolean idAvailability = false;
UNSLocator locator = new UNSLocator();
URL portAddress = new URL("https://localhost:7002/smuSSWeb/UNSResponse.xml");
UNSPort unsprt = locator.getUNSPort(portAddress);
idAvailability = unsprt.isIDAvailable("Yulin125", "C");
System.out.println("Got from method :"+idAvailability);
After runing this code i am getting the following exception :
AxisFault
faultCode: {http://schemas.xmlsoap.org/soap/envelope/}Server.userException
faultSubcode:
faultString: java.net.SocketException: Software caused connection abort: socket write error
faultActor:
faultNode:
faultDetail:
I am using .pem (clientsigned,clientinter,clientroot, root-key) files for client authentication and i am using server.jks as a keystore for my server authentication.Once i run this code , i am able to present the server certificate chain to the client but i am not able to present the client certificate chain to server.
I am stuck with for quite sometime.
Some insight needed from the guru's

How to get the client identity from the certificate at server side

hi, this is ravi kiran,
I am working on a project which requires, receiving a signed file from the client side and verify whether the file is signed by a valid certificate that is there in the servers keystore.
How can i get the client certificate at server side and check with the certificates already present in the servers keystore.
i have no idea how to do this
can any one help me
thanx in advance

Hi Ravi, did you get any answer to your question ?
I'm also after a similar problem, please share your solution, if you have any.

The request sent by the client was syntactically incorrect

"The request sent by the client was syntactically incorrect" and "Invalid path " are the error when I try to send a request using struts. Help me.

This error messsage is given by Struts when you try to access an action-mapping that isn't defined in struts-config.xml. You propably misspelled the URL.
Remember, the default extension is *.do, so a typical URL will look like this: http://host/user/create.do.
To present the user for a nicer error page you can include the following in your web.xml file:
<error-page>
<error-code>400</error-code>
<location>/common/badRequest.jsp</location>
</error-page>

How can we limit the client certificates Safari displays for TLS authentication?

Some background regarding where the certificates come from: Our company has it's own enterprise MDM solution. When a device enrolls, it receives certificates (identities) - 2 from MDM and a third for SSO.
When a user of an iPad or iPhone attempts to connect to a website requiring a client certificate, the user is presented with a list of available certificates in the system keychain in a pick list. There does not appear to be a way to filter that list. Also, it appears that every single certificate available is listed twice.
Is there any way to prevent Safari from displaying every identity certificate in the system keychain?
The first example shows multiple certificates used for MDM enrollment
The second example shows one certificate listed twice.

I know this will sound like a conspiracy theory, but maybe Apple doesn't want you printing from your iPad... yet. Could be something Apple did so as not to "Steal their Thunder" when they announce the upgrades on the next generation iPad. Just a thought...

OHS not passing the client certificate in headers to WebLogic 11g

I'm struggling with the ssl configuration on Oracle HTTP Server, I have it configured so that it request the correct client certificate, I select it but when it performs the http redirects between itself and WebLogic none of the headers I configured in the httpd.conf are passed to WebLogic.
ssl.conf
# OHS Listen Port
# Listen 4443
Listen 443
<IfModule ossl_module>
## SSL Global Context
## All SSL configuration in this context applies both to
## the main server and all SSL-enabled virtual hosts.
# Some MIME-types for downloading Certificates and CRLs
AddType application/x-x509-ca-cert .crt
AddType application/x-pkcs7-crl .crl
# Pass Phrase Dialog:
# Configure the pass phrase gathering process.
# The filtering dialog program (`builtin' is a internal
# terminal dialog) has to provide the pass phrase on stdout.
SSLPassPhraseDialog builtin
# Inter-Process Session Cache:
# Configure the SSL Session Cache: First the mechanism
# to use and second the expiring timeout (in seconds).
SSLSessionCache "shmcb:${ORACLE_INSTANCE}/diagnostics/logs/${COMPONENT_TYPE}/${COMPONENT_NAME}/ssl_scache(512000)"
SSLSessionCacheTimeout 300
# Semaphore:
# Configure the path to the mutual exclusion semaphore the
# SSL engine uses internally for inter-process synchronization.
<IfModule mpm_winnt_module>
SSLMutex "none"
</IfModule>
<IfModule !mpm_winnt_module>
SSLMutex pthread
</IfModule>
## SSL Virtual Host Context
<VirtualHost *:443>
# SSL Engine Switch:
# Enable/Disable SSL for this virtual host.
SSLEngine on
# Client Authentication (Type):
# Client certificate verification type and depth. Types are
# none, optional and require.
SSLVerifyClient optional
# SSL Cipher Suite:
# List the ciphers that the client is permitted to negotiate.
SSLCipherSuite SSL_RSA_WITH_RC4_128_MD5,SSL_RSA_WITH_RC4_128_SHA,SSL_RSA_WITH_3DES_EDE_CBC_SHA,SSL_RSA_WITH_DES_CBC_SHA,TLS_RSA_WITH_AES_128_CBC_SHA,TLS_RSA_WITH_AES_256_CBC_SHA
# SSL Certificate Revocation List Check
# Valid values are On and Off
SSLCRLCheck Off
#Path to the wallet
SSLWallet "${ORACLE_INSTANCE}/config/${COMPONENT_TYPE}/${COMPONENT_NAME}/keystores/default"
<FilesMatch "\.(cgi|shtml|phtml|php)$">
SSLOptions +StdEnvVars
</FilesMatch>
<Directory "${ORACLE_INSTANCE}/config/${COMPONENT_TYPE}/${COMPONENT_NAME}/cgi-bin">
SSLOptions +StdEnvVars
</Directory>
BrowserMatch ".*MSIE.*" \
nokeepalive ssl-unclean-shutdown \
downgrade-1.0 force-response-1.0
SimulateHttps On
</VirtualHost>
</IfModule>
I added the following to the httpd.conf
LoadModule certheaders_module "${ORACLE_HOME}/ohs/modules/mod_certheaders.so"
AddCertHeader HTTPS
AddCertHeader SSL_CLIENT_CERT
AddCertHeader SSL_CLIENT_S_DN
AddCertHeader SSL_CLIENT_S_DN_CN
AddCertHeader SSL_SERVER_CERT
The only errors I see in the logs are:
[ERROR:32] [OHS-9999] [core.c] [host_id: angkor.englink.bah.com] [host_addr: 127.0.0.1] [tid: 1335089472] [user: root] [ecid: 004bXaue_EwFw000jzwkno0006kT00000K] [rid: 0] [VirtualHost: main] File does not exist: /u01/app/oracle/Middleware/WT/Runtime/config/OHS/englink/htdocs/favicon.ico
Other things to mention:
I do have a certificate error but I don't see anything in the logs as to why and to be honest i'm not sure where to look.
And I did not originally configure this server but i'm concerned that the above thinks the host_addr is 127.0.0.1 instead of the actual ip of the server (should I change this?)
Any help is appreciated.
Edited by: 843394 on Mar 10, 2011 6:28 AM

Were you able to resolve this issue? I am currently having the same issue. I thought that it was likely that my ssl.conf didn't have SSLOptions +ExportCertData ... but I still have the issue after modifying ssl.conf.

Can a pl sql cartridge get the client certificate through ssl in OAS

I am In a web publishing system project, I use SSL and client certificate to verify the user, the environment is OAS4.0.6 and Oracle 8i, and I use PL SQL cartridge to proceed the http request , Now the problem is how can I get the client certificate infomation in my pl sql scripts, I do not know where should i post this problem, So I post it here, If you have any experience in using SSL of OAS, pls help me!
tsailiang
[email protected]
thank you very much!

Sorry wrong forum.....
This forum is for the Internet File Server (ifs) not the oracle application server (oas), sometimes known as iAS or Oracle9i Applicaiton Server.
null

How can the client know if the SSL certificate specified in the service-config.xml file is invalid/u

Hi,
How can the client know if the SSL certificate specified in the service-config.xml file is invalid/untrusted/expired? For example using iOS client, the trusted certificate will not work and the client has no way to know that the certificate is untrusted. Can the lcds server return any specific exceptions for SSL errors?
Thanks,
Swathi.

We use a standard Java keystore and certificate validation can be handled as per standard best practices. At present we do not provide a hook point to validate the server certificate. However, you can register a bootstrap service which validates the certificate on system startup: http://help.adobe.com/en_US/dataservicesjee/4.6/Developing/WSc3ff6d0ea77859461172e0811f00f 6fe7f-7ffeUpdate.html This would require you to pass another copy of the keystore configuration to you Bootstrap service and then you can inspect the certificate in the keystore and validate it.

Changing request IP of the client

I am using servlet and jsp. This servlet and jsp returns the request IP address of the client (As you know by using reqeust.getRemoteAdd()).
I am calling thses pages from ordinary java programs. (throuh URLConnection and Socket programs).
Whats my need is... while making request from the client, i need to get the different IP from server side; that should not be a original ip of the client.
It just like IP masking... What i have to do here?... This is very urgent i need to do... Thanks in advance to all of you guys...

It should not be a original IP address of the client.
It may be any other IP which is not present or present.
you know the hide my ip concept?... While we making request from the browser, it sends the different IP to serever insteadof original ip of the client..
Thanks a lot ya...

HOW TO FIND THE PATH TRAVELLED BY THE CLIENT'S REQUEST PACKET

Hi,
I want to know is there any way by which we can know the entire path or the hops travelled by the client request packet to reach the web-server.Say suppose the client machine is part of a large network in a corparate where there is a a personlaized WAN. I want to know whther i can achive this using the servlets.
and i even want to know some information about the client's NIC Card Physical Address.If at all i use the HttpServletRequest.inetAddress() gives the public IP of the Client which is shared in the network.
Please suggest me a way by which i can do this.
Thanks in Advance!!!
Regards,
RAHUL

hey i m back
import java.net.Inet4Address;
import java.net.InetAddress;
import java.net.URL;
import java.util.Arrays;
import jpcap.JpcapCaptor;
import jpcap.JpcapSender;
import jpcap.NetworkInterface;
import jpcap.NetworkInterfaceAddress;
import jpcap.packet.EthernetPacket;
import jpcap.packet.ICMPPacket;
import jpcap.packet.IPPacket;
import jpcap.packet.Packet;
public class Traceroute {
     public static void main(String[] args) throws Exception{
          if(args.length<2){
               System.out.println("Usage: java Traceroute <device index (e.g., 0, 1..)> <target host address>");
               System.exit(0);
          //initialize Jpcap
          NetworkInterface device=JpcapCaptor.getDeviceList()[Integer.parseInt(args[0])];
          JpcapCaptor captor=JpcapCaptor.openDevice(device,2000,false,5000);
          InetAddress thisIP=null;
          for(NetworkInterfaceAddress addr:device.addresses)
               if(addr.address instanceof Inet4Address){
                    thisIP=addr.address;
                    break;
          //obtain MAC address of the default gateway
          InetAddress pingAddr=InetAddress.getByName("www.microsoft.com");
          captor.setFilter("tcp and dst host "+pingAddr.getHostAddress(),true);
          byte[] gwmac=null;
          while(true){
               new URL("http://www.microsoft.com").openStream().close();
               Packet ping=captor.getPacket();
               if(ping==null){
                    System.out.println("cannot obtain MAC address of default gateway.");
                    System.exit(-1);
               }else if(Arrays.equals(((EthernetPacket)ping.datalink).dst_mac,device.mac_address))
                         continue;
               gwmac=((EthernetPacket)ping.datalink).dst_mac;
               break;
          //create ICMP packet
          ICMPPacket icmp=new ICMPPacket();
          icmp.type=ICMPPacket.ICMP_ECHO;
          icmp.seq=100;
          icmp.id=0;
          icmp.setIPv4Parameter(0,false,false,false,0,false,false,false,0,0,0,IPPacket.IPPROTO_ICMP,
                    thisIP,InetAddress.getByName(args[1]));
          icmp.data="data".getBytes();
          EthernetPacket ether=new EthernetPacket();
          ether.frametype=EthernetPacket.ETHERTYPE_IP;
          ether.src_mac=device.mac_address;
          ether.dst_mac=gwmac;
          icmp.datalink=ether;
          captor.setFilter("icmp and dst host "+thisIP.getHostAddress(),true);
          JpcapSender sender=captor.getJpcapSenderInstance();
          //JpcapSender sender=JpcapSender.openDevice(device);
          sender.sendPacket(icmp);
          while(true){
               ICMPPacket p=(ICMPPacket) captor.getPacket();
               //System.out.println("received "+p);
               if(p==null){
                    System.out.println("Timeout");
               }else if(p.type==ICMPPacket.ICMP_TIMXCEED){
                    p.src_ip.getHostName();
                    System.out.println(icmp.hop_limit+": "+p.src_ip);
                    icmp.hop_limit++;
               }else if(p.type==ICMPPacket.ICMP_UNREACH){
                    p.src_ip.getHostName();
                    System.out.println(icmp.hop_limit+": "+p.src_ip);
                    System.exit(0);
               }else if(p.type==ICMPPacket.ICMP_ECHOREPLY){
                    p.src_ip.getHostName();
                    System.out.println(icmp.hop_limit+": "+p.src_ip);
                    System.exit(0);
               }else continue;
               sender.sendPacket(icmp);
}

Publishing server doesn't work - error 'The request URL doesn't contain the query string for the client OS'

Hi,
I'm trying to setup an App-V environment in my lab.
I've used the App-V 5.0 Trial guide to help me configure all necessary components.
I'm able to install everything without error.
when come time to publish an app, it simply doesn't show up on my client.
after looking at events on the client and server, I found that the Publishing server is returning under Admin the following message.
'The request URL doesn't contain the query string for the client OS'
My setup is pretty simple.
App-V Server managament and Publishing on the same box
App-V database on my SQL server.
I'm able to see the publishing "webpage" by using http:://localhost:889.
It only display this :
-<Publishing Protocol="1.0"
<Packages />
</Publishing>
I've published one app from the management console.
any idea what could mean this error?
thanks

Hi,
thanks for the link.
I've validated the suggested debug steps. It seems that the problem is with my Publish server again.
I've looked in the web.config file. It seems to be missing some parts compare to the example provided.
Again, I've published an application from the management console. Management and Publishing are running on the same box, while SQL is remote.
Here's the web.config
<?xml version="1.0" ?>
- <configuration>
- <system.web>
<compilation debug="false" targetFramework="4.0" />
<machineKey validationKey="AutoGenerate,IsolateApps" decryptionKey="AutoGenerate,IsolateApps" />
- <authentication>
- 
<forms requireSSL="true" />
</authentication>
</system.web>
- <system.webServer>
- <modules runAllManagedModulesForAllRequests="true">
<add name="UrlRoutingModule" type="System.Web.Routing.UrlRoutingModule, System.Web, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a" />
</modules>
- <security>
- <requestFiltering>
- <verbs>
<remove verb="GET" />
<add verb="GET" allowed="true" />
</verbs>
</requestFiltering>
</security>
</system.webServer>
- <system.serviceModel>
<serviceHostingEnvironment aspNetCompatibilityEnabled="true" multipleSiteBindingsEnabled="true" />
+ <behaviors>
- <serviceBehaviors>
- <behavior name="">
<serviceAuthorization impersonateCallerForAllOperations="true" />
<serviceMetadata httpGetEnabled="false" httpsGetEnabled="false" />
</behavior>
</serviceBehaviors>
</behaviors>
- <bindings>
- <webHttpBinding>
- <binding name="SecureBinding">
- <security mode="Transport">
<transport clientCredentialType="Windows" />
</security>
</binding>
<binding name="UnsecureBinding" />
</webHttpBinding>
</bindings>
- <protocolMapping>
<add scheme="http" binding="webHttpBinding" bindingConfiguration="UnsecureBinding" />
<add scheme="https" binding="webHttpBinding" bindingConfiguration="SecureBinding" />
</protocolMapping>
- <standardEndpoints>
- <webHttpEndpoint>
- 
<standardEndpoint name="" helpEnabled="true" automaticFormatSelectionEnabled="true" />
</webHttpEndpoint>
</standardEndpoints>
</system.serviceModel>
</configuration>

ISE Problem: EAP-TLS failed SSL/TLS handshake because of an unknown CA in the client certificates chain

Hello, I´m stucked with this problem for 3 weeks now.
I´m not able to configure the EAP-TLS autentication.
In the "Certificate Store" of the ISE server I have Installed the Root, policy and the Issuing certificates as "trust for client authentication",and in the Local store I have a certificate issuing for the same issuing authority which sign the thw client ones.
The ISE´s certificate has been issued with the "server Authentication certificate" template.
The clients have installed the certificates also the certificate chain.
When I try to authenticate the wireless clients I allways get the same error: " Authentication failed : 12514 EAP-TLS failed SSL/TLS handshake because of an unknown CA in the client certificates chain"
and "OpenSSLErrorMessage=SSL alert
code=0x230=560 ; source=local ; type=fatal ; message="Unknown CA - error self-signed certificate in chain",OpenSSLErrorStack= 1208556432:error:140890B2:SSL routines:SSL3_GET_CLIENT_CERTIFICATE:no certificate returned:s3_srvr.c:2720"
I don´t know what else can I do.
Thank you
Jorge

Hi Rik,
the Below are the certificate details
ISE Certificate Signed by XX-CA-PROC-06
User PKI Signed by XX-CA-OTHER-08
In ISE certificate Store i have the below certificates
XX-CA-OTHER-08 signed by XX-CA-ROOT-04
XX-CA-PROC-06 signed by XX-CA-ROOT-04
XX-CA-ROOT-04 signed by XX-CA-ROOT-04
ISE certificate signed by XX-CA-PROC-06
I have enabled - 'Trust for client authentication' on all three certificates
this is unchecked - 'Enable Validation of Certificate Extensions (accept only valid certificate)'
when i check the certificates of current user in the Client PC this is how it shows.
XX-CA-ROOT-04 is listed in Trusted root Certification Authority
and XX-CA-PROC-06 and XX-CA-OTHER-08 are in Intermediate Certificate Authorities

12520 EAP-TLS failed SSL/TLS handshake because the client rejected the ISE local-certificate

Hi guys,
I have root CA and intermediate CA in ISE local certificate store trusted for client authentication.
I have imported both root ca and client certificate in the device I want to authenticate, but ISE keeps spitting out this error :
12520 EAP-TLS failed SSL/TLS handshake because the client rejected the ISE local-certificate

Refer the link for troubleshooting in page no 22 the issue is mentioned, check it: http://www.cisco.com/c/dam/en/us/solutions/collateral/enterprise/design-zone-security/howto_81_troubleshooting_failed_authc.pdf

Requesting the client to present a certificate?

Similar Messages

Maybe you are looking for