SSL secured Web Service client using CXF Spring configuration

1
votes

I need to create SSL secured Web Service client using CXF Spring configuration and I wonder how do I tell to CXF to use client certificate from my keystore? Do i need to create cxf.xml file under WEB-INF ? If yes what should i include there?

I need just the client side, as the server side is a 3rd party provider im connecting to.

I do have the following dependencies in my pom

 <groupId>org.apache.cxf</groupId>
        <artifactId>cxf-rt-frontend-jaxws</artifactId>
        <version>${cxf.version}</version>
    </dependency>
    <dependency>
        <groupId>org.apache.cxf</groupId>
        <artifactId>cxf-rt-transports-http</artifactId>
        <version>${cxf.version}</version>
    </dependency>

Thank you!

2
cxf

2 Answers

0
votes

I had the same problem and didn't find a spring way to config it. So I do this.

0
votes

how about http://cxf.apache.org/docs/client-http-transport-including-ssl-support.html#ClientHTTPTransport%28includingSSLsupport%29-ConfiguringSSLSupport

<http:conduit name="{http://apache.org/hello_world}HelloWorld.http-conduit">
<http:tlsClientParameters>
  <sec:keyManagers keyPassword="password">
    <sec:keyStore type="JKS" password="password"
                  file="my/file/dir/Morpit.jks"/>
  </sec:keyManagers>
  <sec:trustManagers>
    <sec:keyStore type="JKS" password="password"
                  file="my/file/dir/Truststore.jks"/>
  </sec:trustManagers>
  <sec:cipherSuitesFilter>
    <!-- these filters ensure that a ciphersuite with export-suitable or null encryption is used, but exclude anonymous Diffie-Hellman key change as
         this is vulnerable to man-in-the-middle attacks -->
    <sec:include>.*_EXPORT_.*</sec:include>
    <sec:include>.*_EXPORT1024_.*</sec:include>
    <sec:include>.*_WITH_DES_.*</sec:include>
    <sec:include>.*_WITH_AES_.*</sec:include>
    <sec:include>.*_WITH_NULL_.*</sec:include>
    <sec:exclude>.*_DH_anon_.*</sec:exclude>
  </sec:cipherSuitesFilter>
</http:tlsClientParameters>
<http:authorization>
  <sec:UserName>Betty</sec:UserName>
  <sec:Password>password</sec:Password>
</http:authorization>
<http:client AutoRedirect="true" Connection="Keep-Alive"/>
</http:conduit>