Web Services Over SSL - HOW TOSetup steps for deploying and accessing Web Services securely. Summary. This HOWTO guide explains steps involved in (i) deploying SSL accessible Java Web Services. Servlet based SOAP platforms such as Apache Axis or HP Web Services Platform ( HP- WSP ); and. Java client programs. Web Services with https protocol. The guide accompanies scripts and. Web Service ( Hello World variety ) and.
Revision: 0. 8. 1, Date: Apr. Sep. 1. 2, 2. 00. This writeup is being obsoleted by Web Services Security.
13 Apache Web Server Security and Hardening Tips.
- About SSL Labs. SSL Labs is a collection of documents, tools and thoughts related to SSL. It's an attempt to better understand how SSL is deployed, and an attempt to.
- This article is part of a series of articles about making XAMPP more secure. See the overview page for all the security measures. If you don’t have encryption.
J2. EE Security for Servlets, EJBs and Web Services. Introduction. This guide is for you if. Apache Axis or HP- WSP or any other Servlet based SOAP platform and. Web Service accessible over SSL to all or only certain clients using. Java client program that invokes a Web Service with https URL using SSL. Apache Axis is an opensource software and can be downloaded from. Evaluation copy of HP- WSP.
This. guide and the supplied example scripts and sources are based on Apache Axis Alpha. March 2. 00. 2. release of HP- WSP. It is the. Servlet container who takes care of all the encryption, decryption and verification stuff. In this. respect, use of SSL is transparent to the SOAP platform or the Web Service. So, what is needed is.
SSL. In addition, the WSDL. Web Service must specify the appropriate URL to access the service. This guide includes the steps for Apache Jakarta Tomcat 4. HP- AS 8. 0, a full- fledged J2. EE. App. Server free for commercial use. You can download HP- AS 8.
It is noteworthy that HP- AS 8. Tomcat 4. 0. 1 leads me to beleive that Tomcat. However, I don't track Tomcat development very closely and I could. Let me know if I this is so. Certain steps mentioned in this guide require the Java source files and scripts available in.
WSOver. SSL. zip. This would create the directory with name. WSOver. SSL and place the contents within this directory.
As the scripts to compile, deploy. SOAP Platform specific and there are minot differences in the client source. I have kept sources for Apache Axis and HP- WSP in separate sub- directories with names. I have written only Windows scripts to compile, deploy and run the examples only. Translation to. Linux/Unix scripts are straightforward.
A future revision of this document will use OS neutral. Apache Jakarta Ant scripts. File and directory pathnames. Windows convention. Again, translation to. Linux/Unix names are trivial. It sould work on other OS platforms.
JDK1. 2. x and 1. Note that you must have JSSE, either as part of JDK1.
Apache Jakarta Tom. Cat or HP- AS 8. 0 for SSL. It is also needed for running the client program. Download JSSE package. You can get it from.
Be prepared to setup an account at Sun's Download Center. Install JSSE. In most basic form, it involves unzipping the downloaded file and copying.
JAVA. But I must warn you that the documentation is. For example, it mentions copying. JAVA. Later on, I.
Sun's documentation for JSSE uses JAVA. Go to sub- directory axis or hpwsp and. This script invokes the URLReader.
JVM. If you are behind a corporate firewall, you should edit the script file to. System properties https.
Host and. https. proxy. Port. Following worked fine for me. A proper. understanding now will save you a lot of grief later on. If. you are not using environment variable %JAVA. This should have. JAVA. For example, you could keep JSSE jar files in a separate. CLASSPATH. Also, you could add the SSL Provider to the.
Security class within your program and not specify in the commandline. Though you don't need to. I would advise going through the references at the end of this guide or any. You won't. find this in the actual script file. Also, the server's certificate is exported to file server. Similarly, the client's. This way, keystore client.
If you plan. to access the server with its symbolic name or IP address on the network, you must specify that. You can also have multiple certificates for the same physical. Though this script is okay for running the example, a real production deployment must. Use of proper distinguished name or dname values.
Getting certificates signed by an authorised CA ( Certificate Authority ). Not specifying the password in the script file. If the passowrd is not specified in the. Use of a production grade tool to manage client certificates, especially if the server. Note that in a typical use of SSL to access a web application, the client authenticates the server.
This works fine as there are. However, these mechansims will not be availalble to a Web. Services client and hence it makes sense to use certificate based client authentication. Edit the %TOMCAT. Also add the attributes for keystore filename and password.
You may need to change these values for your setup. It might warn you that the. We did not get our certificates signed. CA, did we? However, keep pressing 'Yes'. Tomcat. I did not find any attribute of. Factory to specify the truststore and its password. A truststore is needed to.
As I have the client's certificate exported to the same. I tried just setting the attribute client. Auth to true. But. Design Biogas Plant Pdf Editor more. Though I did not try this myself, a couple of.
If. you have selected default options while installing HP- AS, its value should be c: \hpmw\hpas. If you don't have HP- AS 8. Create HTTPS listener configuration file. Go to directory. %HPAS.
Now edit this file to reflect your setup. Find below the edited.
Note that this configuration file requires that the clients also present. Delete these. lines. I had to go through tech. Edit file hpas- deploy.
HTTPS listener. I added this entry just after the entry for HTTP listener. Service name=. Launch the HP- AS console. Point your browser to the URL. It should take you the HPAS 8. Running the Example Program. The supplied example demonstrates the use of HTTP over SSL ( or https ) for communication between.
Web Service end points. Use of https protects the content exchanged and can also be used by one. The example consists of a simple Java class Hello with method. String greet(String anme) and a client class client. Client. Class. Hello is deployed as a Web Service and the client invokes the method. If you do not see any response.
Patience pays off while working with. SSL. Try to isolate the problem. Test your configuration for correct JSSE installation.
Test. Tom. Cat ot HP- AS for correct HTTPS listener configuration. Test correct input key generation. Check the set. HPWSEnv.
Check and recheck the spelling of values. Once you have. identified the problem, look at the appropriate resource for troubleshooting tips. Look at the platform specific readme.
These may be specific to the version. I am using. This happens even when I correctly specified the System properties https. Host. and https. proxy. Port. The exact error message I got was: Unable to tunnel through. This is possible as. Wsdl. 2java uses the JDK classes to access the URL whereas Axis has its own implementation.
HTTP over TCP/IP. When I run a program that invokes the same method on the same service in a tight loop over HTTPS. Bind. Exception: Address in use. I have never encountered this over HTTP. Also, I didn't observe this on my slower. MHz Pentium machine, but can reproduce very quickly on faster 9.
MHz Athlon machine. References. Inside Java 2 Platform Security by Li Gong. The Java Series book published by. ADDISON- WESLEY. Java Security, 2nd Edition by Scott Oaks. O'REILLY. Use HTTPS in your Java client code Java Tip 9. Java. World. Setting up Apache Tomcat and a Simple Apache SOAP Client for SSL Communication.