在SSL CXF SOAP客户端下访问Web服务

Question

这是一个与我的问题here有关的问题。当我尝试使用自签名证书添加SSL时，出现以下错误。

org.springframework.web.util.NestedServletException: Request processing failed; nested 
exception is javax.xml.ws.soap.SOAPFaultException: Error reading XMLStreamReader. 
org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.jav 

a:656) 
org.springframework.web.servlet.FrameworkServlet.doGet(FrameworkServlet.java:549) 
javax.servlet.http.HttpServlet.service(HttpServlet.java:617) 
javax.servlet.http.HttpServlet.service(HttpServlet.java:717) 

root cause 

javax.xml.ws.soap.SOAPFaultException: Error reading XMLStreamReader. 
org.apache.cxf.jaxws.JaxWsClientProxy.invoke(JaxWsClientProxy.java:146) 
$Proxy107.getEmployee(Unknown Source) 
org.samith.web.controller.FrontController.frontRequestHandler(FrontController.java:27) 
sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) 
sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39) 
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25) 
java.lang.reflect.Method.invoke(Method.java:597) 
org.springframework.web.bind.annotation.support.HandlerMethodInvoker.invokeHandlerMethod(HandlerMethodInvoker.java:176) 
org.springframework.web.servlet.mvc.annotation.AnnotationMethodHandlerAdapter.invokeHandlerMethod(AnnotationMethodHandlerAdapter.java:426) 
org.springframework.web.servlet.mvc.annotation.AnnotationMethodHandlerAdapter.handle(AnnotationMethodHandlerAdapter.java:414) 
org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:790) 
org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:719) 
org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:644) 
org.springframework.web.servlet.FrameworkServlet.doGet(FrameworkServlet.java:549) 
javax.servlet.http.HttpServlet.service(HttpServlet.java:617) 
javax.servlet.http.HttpServlet.service(HttpServlet.java:717) 

root cause 

com.ctc.wstx.exc.WstxEOFException: Unexpected EOF in prolog 
at [row,col {unknown-source}]: [1,0] 
com.ctc.wstx.sr.StreamScanner.throwUnexpectedEOF(StreamScanner.java:682) 
com.ctc.wstx.sr.BasicStreamReader.handleEOF(BasicStreamReader.java:2090) 
com.ctc.wstx.sr.BasicStreamReader.nextFromProlog(BasicStreamReader.java:1996) 
com.ctc.wstx.sr.BasicStreamReader.next(BasicStreamReader.java:1100) 
com.ctc.wstx.sr.BasicStreamReader.nextTag(BasicStreamReader.java:1123) 
org.apache.cxf.binding.soap.interceptor.ReadHeadersInterceptor.handleMessage(ReadHeadersInterceptor.java:122) 
org.apache.cxf.binding.soap.interceptor.ReadHeadersInterceptor.handleMessage(ReadHeadersInterceptor.java:60) 
org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(PhaseInterceptorChain.java:255) 
org.apache.cxf.endpoint.ClientImpl.onMessage(ClientImpl.java:755) 
org.apache.cxf.transport.http.HTTPConduit$WrappedOutputStream.handleResponseInternal(HTTPConduit.java:2335) 
org.apache.cxf.transport.http.HTTPConduit$WrappedOutputStream.handleResponse(HTTPConduit.java:2193) 
org.apache.cxf.transport.http.HTTPConduit$WrappedOutputStream.close(HTTPConduit.java:2037) 
org.apache.cxf.io.CacheAndWriteOutputStream.postClose(CacheAndWriteOutputStream.java:47) 
org.apache.cxf.io.CachedOutputStream.close(CachedOutputStream.java:188) 
org.apache.cxf.transport.AbstractConduit.close(AbstractConduit.java:56) 
org.apache.cxf.transport.http.HTTPConduit.close(HTTPConduit.java:697) 
org.apache.cxf.interceptor.MessageSenderInterceptor$MessageSenderEndingInterceptor.h andleMessage(MessageSenderInterceptor.java:62) 
org.apache.cxf.phase.PhaseInterceptorChain.doIntercept(PhaseInterceptorChain.java:255) 
org.apache.cxf.endpoint.ClientImpl.invoke(ClientImpl.java:516) 
org.apache.cxf.endpoint.ClientImpl.invoke(ClientImpl.java:313) 
org.apache.cxf.endpoint.ClientImpl.invoke(ClientImpl.java:265) 
org.apache.cxf.frontend.ClientProxy.invokeSync(ClientProxy.java:73) 
org.apache.cxf.jaxws.JaxWsClientProxy.invoke(JaxWsClientProxy.java:124) 
$Proxy107.getEmployee(Unknown Source) 
org.samith.web.controller.FrontController.frontRequestHandler(FrontController.java:27) 
sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) 
sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:39) 
sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:25) 
java.lang.reflect.Method.invoke(Method.java:597) 
org.springframework.web.bind.annotation.support.HandlerMethodInvoker.invokeHandlerMethod(HandlerMethodInvoker.java:176) 
org.springframework.web.servlet.mvc.annotation.AnnotationMethodHandlerAdapter.invokeHandlerMethod(AnnotationMethodHandlerAdapter.java:426) 
org.springframework.web.servlet.mvc.annotation.AnnotationMethodHandlerAdapter.handle(AnnotationMethodHandlerAdapter.java:414) 
org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:790) 
org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:719) 
org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:644) 
org.springframework.web.servlet.FrameworkServlet.doGet(FrameworkServlet.java:549) 
javax.servlet.http.HttpServlet.service(HttpServlet.java:617) 
javax.servlet.http.HttpServlet.service(HttpServlet.java:717) 

而我的客户端配置文件有这个XML片段，

<http-conf:conduit name="*.http-conduit"> 
    <http-conf:tlsClientParameters secureSocketProtocol="SSL"> 
     <sec:keyManagers keyPassword="*****"> 
      <sec:keyStore type="JKS" password="welcome" file="full_path_to_employee_auth.jks" /> 
     </sec:keyManagers> 
    </http-conf:tlsClientParameters> 
    <http:client AutoRedirect="true" Connection="Keep-Alive"/> 
</http-conf:conduit> 

我加入了参考的conf/tomcat的server.xml中使用正确的路径文件到employee_auth.jks文件。通过服务端的单向Web XML文件具有此项

<security-constraint> 
    <web-resource-collection> 
     <web-resource-name>Restricted web services</web-resource-name> 
     <url-pattern>/*</url-pattern> 
     <http-method>GET</http-method> 
     <http-method>POST</http-method> 
    </web-resource-collection> 
    <user-data-constraint> 
     require SSL 
     <transport-guarantee>CONFIDENTIAL</transport-guarantee> 
    </user-data-constraint> 
</security-constraint> 

客户端服务器通信的情况非常好时，该服务side.I未启用SSL正在研究这个让挂在CXF。任何帮助将不胜感激。

Answer 1

这是导致软件消化不良的自签名证书;双方都未能完成一次完整的SSL握手，并且在SOAP消息传输之前就让事情崩溃。

您需要tell the client到信任自签名的证书，也就是，你需要把它添加到trustManagers，而不是keyManagers（这就是你放的身份为客户端用来证明谁它是服务器）。您可能还需要禁用检查服务器的CN是否匹配所需的地址，通过：

<http-conf:tlsClientParameters disableCNcheck="true" /> 

但要知道，这是潜在的危险。

最终，您最好得到一个正确的CA签名的主机证书，因为这比让每个该死的客户端工作在半安全级别上的麻烦要少得多。单主机证书非常便宜（甚至可能对您免费;您的组织 - 像我的一样）可能会有现成的交易。