CXF SSL Spring configuration - Empty client certificate chain

Question

Hi everybody,

I am trying to build a SSL secured Web Service client using CXF Spring configuration and I wonder how is it possible to tell to CXF to use this client certificate in my keystore. This should exists because if my keystore holds plenty of certificate how does CXF is supposed to do to find the good one?

Here is my configuration:

<http-conf:conduit name="{urn:ihe:iti:xds-b:2007}DocumentRepositoryPortType.http-conduit">
    <http-conf:client AutoRedirect="true" Connection="Keep-Alive"/>
<http-conf:tlsClientParameters secureSocketProtocol="SSL">
    <sec:keyManagers keyPassword="storepass">
            <sec:keyStore type="JKS" password="storepass" file="src/main/resources/keystore.jks" />
        </sec:keyManagers>
    <sec:trustManagers>
            <sec:keyStore type="JKS" password="storepass" file="src/main/resources/truststore.jks" />
    </sec:trustManagers>
    <sec:cipherSuitesFilter>
        <sec:include>.*_EXPORT_.*</sec:include>
    <sec:include>.*_EXPORT1024_.*</sec:include>
    <sec:include>.*_WITH_DES_.*</sec:include>
    <sec:include>.*_WITH_NULL_.*</sec:include>
    <sec:exclude>.*_DH_anon_.*</sec:exclude>
     </sec:cipherSuitesFilter>
    </http-conf:tlsClientParameters>
</http-conf:conduit>

In the

<sec:keyManagers keyPassword="
    <sec:keyStore type="JKS" password="storepass" file="src/main/resources/keystore.jks" />
</sec:keyManagers>

section, is there a way to write something like

alias="mycertificate"

?

I searched on several Web sites but no result for the moment.

Actually my problem is that when my CXF client communicates with a SSL secured server there is a Certificate Request coming from the server in order to identify myself with a certificate. The server tells me which are the cert authorities it is waiting for, in my keystore I do have a certificate which has been certified by one of these authorities but there is no certificate transmission from my client...

Here is how it looks in the SSL logs:

CertificateRequest:

*** CertificateRequest
Cert Types: RSA, DSS, 
Cert Authorities:
<CN=****, DC=****, DC=****>
Others authorities...

Empty client certificate chain:

*** Certificate chain
***

Do you guys have any idea?

Thanks in advance!

Answer 1

It's likely the "name" attribute on the http-conduit is wrong. It should be the Endpoint name (from within the Service element), not the PortType name.

However, I would recommend using a URL for the name.

<http-conf:conduit name="http://localhost:8080/.*" .....>
...
</http-conf>

Note the wildcard (.*) at the end to match all URL's.