Consuming HTTPS Webservice in Flex 4

2
votes

I'm trying to consume one HTTPS webservice in Adobe Flash Builder.

when I add the URL I get this error:

There was an error during service introspection. WSDLException: faultCode=OTHER_ERROR: Unable to resolve imported document at 'https://172.21.17.235:9443/testehttpsWeb/sca/testeIOExport1/WEB-INF/wsdl/testehttps_testeIOExport1.wsdl'.: javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

How can I configure my client to consume the Webservice?

2
apache-flexweb-servicessoapsslhttps
That looks like a Java error to me, not a Flex one. Also, it would help to post some code... - J_A_X
I don't think it is one webservice error. Because I can consume it using .NET I think the problem is in the Flex Client trying to receive certificate, or something related to that. - Pedro
Well, javax.net.ssl.SSLHandshakeException is definitely a Java error that isn't being handled (no matter what client you use). Again, putting code up will help decipher the problem. - J_A_X
There is no code, in the IDE you just select the URL of the Service to Consume, and you get the error. - Pedro

2 Answers

5
votes

We will have to buy ice cream to the person that figured this out!

The solution was to import the certificate not to a JKS truststore, but to the cacarets file, in my case:

keytool -import -alias trusted1 -keystore "C:\Program Files (x86)\Adobe\Adobe Flash Builder 4\jre\lib\security\cacerts" -file c:\somepath\mycert.cer

In this case there is no need to add the:

-Djavax.net.ssl.trustStore="c:\somepath\truststore.jks"

...line on FlashBuilder.ini

An imported note is that the DNS Server must be able to translate the Web Service path by name instead of by IP, because in the installed certificate the CN mentions the Web Service server name not it's IP

Regards

3
votes

Flash Builder is built on top of Eclipse. Eclipse is written in Java, and this is probably the cause of your issue. Java itself doesn't trust any SSL (it doesn't support the root CAs out of the box, nor any certificates). You have to setup a truststore to use SSL with Java.

In eclipse, this means setting up a truststore and adding it's location to the eclipse.ini. To setup the truststore, first browse in your browser to the SSL site you are connecting to, and save the certificate (usually right/left click on the lock icon and follow the steps). The you need to use "keytool" from the Java JDK to create the truststore, such as:

keytool -import -alias trusted1 -keystore c:\somepath\truststore.jks -file c:\somepath\mycert.cer

Then find your eclipse.ini (usually in your Flex Builder or eclipse folder). Add this:

-Djavax.net.ssl.trustStore="c:\somepath\truststore.jks"