My client implements two-way SSL as follows:
private final static String KEYSTORE = "/security/client.jks"
private final static String KEYSTORE_PASSWORD = "secret";
private final static String KEYSTORE_TYPE = "JKS";
private final static String TRUSTSTORE = "/security/certificates.jks"
private final static String TRUSTSTORE_PASSWORD = "secret";
private final static String TRUSTSTORE_TYPE = "JKS";
...
KeyStore keystore = KeyStore.getInstance (KEYSTORE_TYPE);
FileInputStream keystoreInput = new FileInputStream (new File (KEYSTORE));
keystore.load (keystoreInput, KEYSTORE_PASSWORD.toCharArray ());
KeyStore truststore = KeyStore.getInstance (TRUSTSTORE_TYPE);
FileInputStream truststoreIs = new FileInputStream (new File (TRUSTSTORE));
truststore.load (truststoreIs, TRUSTSTORE_PASSWORD.toCharArray ());
SSLSocketFactory socketFactory = new SSLSocketFactory (keystore, KEYSTORE_PASSWORD, truststore);
Scheme scheme = new Scheme ("https", 8543, socketFactory);
SchemeRegistry registry = new SchemeRegistry ();
registry.register (scheme);
ClientConnectionManager ccm = new PoolingClientConnectionManager (registry);
httpclient = new DefaultHttpClient (ccm);
HttpResponse response = null;
HttpGet httpget = new HttpGet ("https://mylocalhost.com:8543/test");
response = httpclient.execute (httpget);
...
And I'm trying to get the X.509 certificate on the server side from the client through javax.servlet.http.HttpServletRequest.getAttribute ("javax.servlet.request.X509Certificate"), as described here: http://tomcat.apache.org/tomcat -5.5-doc / servletapi / javax / servlet / ServletRequest.html # getAttribute% 28java.lang.String% 29 .
I get HttpServletRequest on the server side through:
HttpServletRequest servletRequest = (HttpServletRequest) msg.get ("HTTP.REQUEST"); via the handleMessage (Message msg) method of my interceptor class, which extends AbstractPhaseInterceptor <Message>. I have to use JAX-RS 1.1.1 on the server side due to some Maven dependencies that I am not allowed to change, and therefore I can not use ContainerRequestFilter (supported by JAX-RS 2.0).
My problem is that getAttribute ("javax.servlet.request.X509Certificate") on the server side always returns null. If I check the traffic between the server and the client, I see that the certificate from the server is sent to the client, and this handshake works. But I don’t see that the client certificate is being sent to the server, and I think this is the reason why getAttribute("javax.servlet.request.X509Certificate") returns null . Does anyone know how I can solve this problem? I have already tried some other client-side implementations, but no change.
What am I doing wrong? Thank you very much in advance!
Additional Information: I saw on the server side that javax.servlet.request.ssl_session_id, javax.servlet.request.key_size and javax.servlet.request.cipher_suite are installed, but the javax.servlet.request.X509Certificate key is not set. I am using Jetty Server 8.1.15, Apache CXF 2.7.x and JAX-RS 1.1.1. I tried to configure Jetty through http://cxf.apache.org/docs/jetty-configuration.html and http://cxf.apache.org/docs/secure-jax-rs-services.html#SecureJAX-RSServices-Configuringendpoints , the attribute is still not set.
source share