4

We have a SOAP-webservice which we are trying to acquire a connection to through a https-connection setup with username / password connection, no certificate should be involved. It seems that Java is still attempting and failing a certificate handshake. How do I setup the connection such that it manages to use the username/password?

Error generated on attempting a query-call on MyWeb:

2012-08-29 13:31:19,918 WARN  (LogUtils.java:371) - Interceptor for {http://myaddress/}MyWebService#{http://myqname/}getStatus has thrown exception, unwinding now
org.apache.cxf.interceptor.Fault: Could not send Message.
    at org.apache.cxf.interceptor.MessageSenderInterceptor$MessageSenderEndingInterceptor.handleMessage(MessageSenderInterceptor.java:64)
    at org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(PhaseInterceptorChain.java:263)
    at org.apache.cxf.endpoint.ClientImpl.doInvoke(ClientImpl.java:510)
    at org.apache.cxf.endpoint.ClientImpl.invoke(ClientImpl.java:440)
    at org.apache.cxf.endpoint.ClientImpl.invoke(ClientImpl.java:343)
    at org.apache.cxf.endpoint.ClientImpl.invoke(ClientImpl.java:295)
    at org.apache.cxf.frontend.ClientProxy.invokeSync(ClientProxy.java:73)
    at org.apache.cxf.jaxws.JaxWsClientProxy.invoke(JaxWsClientProxy.java:124)
    at $Proxy55.getTccStatus(Unknown Source)
    at se.transrail.cato.monitor.server.MonitorWsClient.readTccStatus(MonitorWsClient.java:65)
    at se.transrail.cato.monitor.server.WebServicePoller.run(WebServicePoller.java:73)
    at java.util.concurrent.Executors$RunnableAdapter.call(Executors.java:471)
    at java.util.concurrent.FutureTask$Sync.innerRunAndReset(FutureTask.java:351)
    at java.util.concurrent.FutureTask.runAndReset(FutureTask.java:178)
    at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.access$301(ScheduledThreadPoolExecutor.java:178)
    at java.util.concurrent.ScheduledThreadPoolExecutor$ScheduledFutureTask.run(ScheduledThreadPoolExecutor.java:293)
    at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1110)
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:603)
    at java.lang.Thread.run(Thread.java:722)
Caused by: javax.net.ssl.SSLHandshakeException: SSLHandshakeException invoking https://myaddress/: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
    at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)
    at sun.reflect.NativeConstructorAccessorImpl.newInstance(NativeConstructorAccessorImpl.java:57)
    at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(DelegatingConstructorAccessorImpl.java:45)
    at java.lang.reflect.Constructor.newInstance(Constructor.java:525)
    at org.apache.cxf.transport.http.HTTPConduit$WrappedOutputStream.mapException(HTTPConduit.java:1404)
    at org.apache.cxf.transport.http.HTTPConduit$WrappedOutputStream.close(HTTPConduit.java:1389)
    at org.apache.cxf.transport.AbstractConduit.close(AbstractConduit.java:56)
    at org.apache.cxf.transport.http.HTTPConduit.close(HTTPConduit.java:623)
    at org.apache.cxf.interceptor.MessageSenderInterceptor$MessageSenderEndingInterceptor.handleMessage(MessageSenderInterceptor.java:62)
    ... 18 more
Caused by: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
    at sun.security.ssl.Alerts.getSSLException(Alerts.java:192)
    at sun.security.ssl.SSLSocketImpl.fatal(SSLSocketImpl.java:1868)
    at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:276)
    at sun.security.ssl.Handshaker.fatalSE(Handshaker.java:270)
    at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1338)
    at sun.security.ssl.ClientHandshaker.processMessage(ClientHandshaker.java:154)
    at sun.security.ssl.Handshaker.processLoop(Handshaker.java:868)
    at sun.security.ssl.Handshaker.process_record(Handshaker.java:804)
    at sun.security.ssl.SSLSocketImpl.readRecord(SSLSocketImpl.java:998)
    at sun.security.ssl.SSLSocketImpl.performInitialHandshake(SSLSocketImpl.java:1294)
    at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1321)
    at sun.security.ssl.SSLSocketImpl.startHandshake(SSLSocketImpl.java:1305)
    at sun.net.www.protocol.https.HttpsClient.afterConnect(HttpsClient.java:515)
    at sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(AbstractDelegateHttpsURLConnection.java:185)
    at sun.net.www.protocol.http.HttpURLConnection.getOutputStream(HttpURLConnection.java:1090)
    at sun.net.www.protocol.https.HttpsURLConnectionImpl.getOutputStream(HttpsURLConnectionImpl.java:250)
    at org.apache.cxf.transport.http.HTTPConduit$WrappedOutputStream.handleHeadersTrustCaching(HTTPConduit.java:1337)
    at org.apache.cxf.transport.http.HTTPConduit$WrappedOutputStream.onFirstWrite(HTTPConduit.java:1283)
    at org.apache.cxf.io.AbstractWrappedOutputStream.write(AbstractWrappedOutputStream.java:42)
    at org.apache.cxf.io.AbstractThresholdOutputStream.write(AbstractThresholdOutputStream.java:69)
    at org.apache.cxf.transport.http.HTTPConduit$WrappedOutputStream.close(HTTPConduit.java:1361)
    ... 21 more
Caused by: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
    at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:385)
    at sun.security.validator.PKIXValidator.engineValidate(PKIXValidator.java:292)
    at sun.security.validator.Validator.validate(Validator.java:260)
    at sun.security.ssl.X509TrustManagerImpl.validate(X509TrustManagerImpl.java:326)
    at sun.security.ssl.X509TrustManagerImpl.checkTrusted(X509TrustManagerImpl.java:231)
    at sun.security.ssl.X509TrustManagerImpl.checkServerTrusted(X509TrustManagerImpl.java:126)
    at sun.security.ssl.ClientHandshaker.serverCertificate(ClientHandshaker.java:1320)
    ... 37 more
Caused by: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
    at sun.security.provider.certpath.SunCertPathBuilder.engineBuild(SunCertPathBuilder.java:196)
    at java.security.cert.CertPathBuilder.build(CertPathBuilder.java:268)
    at sun.security.validator.PKIXValidator.doBuild(PKIXValidator.java:380)
    ... 43 more

MyWeb and MyWebService are generated by Apache CXF 2.4.8 wsdl2java. MyWeb is interface of MyWebService. In myweb.wsdl I have replaced

Setup:

private MyWeb preparePort() {
    MyWebService ss = new MyWebService(
            // locally stored wsdl to avoid connection at this time
            getClass().getClassLoader().getResource("myweb.wsdl");,
            new QName("http://qname/", "MyWebService"));
    MyWeb port = ss.getMonitorWebServicePort();

    Client cl = ClientProxy.getClient(port);

    HTTPConduit http = (HTTPConduit) cl.getConduit();

    HTTPClientPolicy httpClientPolicy = new HTTPClientPolicy();

    httpClientPolicy.setConnectionTimeout(connectionTimeout);
    httpClientPolicy.setReceiveTimeout(receiveTimeout);
    httpClientPolicy.setConnection(ConnectionType.CLOSE);
    httpClientPolicy.setMaxRetransmits(1);

    http.setClient(httpClientPolicy);

    ((BindingProvider) port).getRequestContext().putAll(of(
            USERNAME_PROPERTY, username,
            PASSWORD_PROPERTY, password,
            ENDPOINT_ADDRESS_PROPERTY, "https://mywebaddress/"));
    return port;

From myweb.wsdl

<wsdl:service name="MyWebService">
    <wsdl:port binding="tns:MyWebServiceSoapBinding" name="MyWebPort">
        <soap:address location="https://mywebaddress/"/>
    </wsdl:port>
</wsdl:service>

Attempted fixes found on the net that didn't work:

//    AuthorizationPolicy authorizationPolicy = new AuthorizationPolicy();
//    authorizationPolicy.setUserName(username);
//    authorizationPolicy.setPassword(password);
//    authorizationPolicy.setAuthorizationType("Basic");
//    http.setAuthorization(authorizationPolicy);

//    Authenticator myAuth = new Authenticator()
//    {
//        @Override
//        protected PasswordAuthentication getPasswordAuthentication()
//        {
//            return new PasswordAuthentication(username, password.toCharArray());
//        }
//    };
//    Authenticator.setDefault(myAuth);

1 Answer 1

6

Found a working solution here http://techpolesen.blogspot.se/2007/08/using-ssl-with-xfirecxf-battling.html which overrides the TrustManager to make it accept the connection without the existance of a certificate:

    String targetAddr = http.getTarget().getAddress().getValue();
    if (targetAddr.toLowerCase().startsWith("https:")) {
        TrustManager[] simpleTrustManager = new TrustManager[] { new X509TrustManager() {
            public void checkClientTrusted(
                    java.security.cert.X509Certificate[] certs, String authType) {
            }

            public void checkServerTrusted(
                    java.security.cert.X509Certificate[] certs, String authType) {
            }
            public java.security.cert.X509Certificate[] getAcceptedIssuers() {
                return null;
            }
        } };
        TLSClientParameters tlsParams = new TLSClientParameters();
        tlsParams.setTrustManagers(simpleTrustManager);
        tlsParams.setDisableCNCheck(true);
        http.setTlsClientParameters(tlsParams);
    }
0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.