SSL muthual authentication

Hi all!

I'm writing a web service client application using JWSDP. The SOAP message is sent via HTTPS channel. In SSL handshake, the muthual authentication is required. In order to solve this I attached to my client:

System.setProperty("javax.net.ssl.keyStore","key.pfx" );

System.setProperty("javax.net.ssl.keyStorePassword","pass" );

System.setProperty("javax.net.ssl.keyStoreType","pkcs12" );

System.setProperty("javax.net.ssl.trustStore","truststore.ks" );

System.setProperty("javax.net.ssl.trustStorePassword","pass2" );

Provider provider =new com.sun.net.ssl.internal.ssl.Provider();

Security.addProvider( provider );

System.setProperty("java.protocol.handler.pkgs","com.sun.net.ssl.internal.www.protocol" );

I tried to connect to the server with settings above with a simple HTTP client, using HttpURLConnection. It was successfull, and when I turn "javax.net.debug" property to "all", I see in my log: "Found trusted certificate:...".

When I try to connect to the server with ws-client based on JWSDP, I do not see "Found trusted certificate:..." in my logs, and muthual authentication is not successfull.

I tried the system property settings above with an axis-based ws-client also, and it worked.

Do I have to configure any other properties using JWSDP in order to turn muthual authentication on?

Please help!

waczack

[1770 byte] By [waczacka] at [2007-10-2 21:36:22]
# 1
Set SSLSocket.setNeedClientAuth(true) at the server.
ejpa at 2007-7-14 0:50:33 > top of Java-index,Security,Java Secure Socket Extension (JSSE)...
# 2
The server is made by another company (I think it's written in .NET), so I have no choice to modify it.waczack
waczacka at 2007-7-14 0:50:33 > top of Java-index,Security,Java Secure Socket Extension (JSSE)...
# 3

That is the only way to accomplish mutual authentication in Java.By which is meant that the server requires the client to authenticate itself. The server always authenticates itself to the client. If client authentication is required it has to be set at the server end. How that is done in .NET is not a question for these forums.

I also don't understand how you are getting 'Found trusted certificate' over an HTTP connection, where there is no authentication at all, unless this is coming from your application, in which case logging it is clearly a mistake.

ejpa at 2007-7-14 0:50:33 > top of Java-index,Security,Java Secure Socket Extension (JSSE)...