AW: [WSS4J] Using trusted Certs with wss4j

Jason,

thanks for the testing and fix the problem. The whole
area of certificate handling and verfication is not
well tested, to say the least :-). I'm not a real
guru in that area and _any_ help is welcome here.

Just a question about your fix: the code in your e-mail
contains a loop (enumaration loop) over all keystore
aliases, but it seems that they are not used later on.
Can you pls clarify? Otherwise your fix looks great.

During the tests we always use a self-signed trusted certificate
(produced by Dims) that is stored in a PKCS12 type keystore.
Do you use another keystore type? Other Keystore provider?

During some other tests I already found problems between
different keystore types (had to introduce a specific check
of DN string, refer to the splitAndTrim() and
equalsStringArray() mehtods because different keystores and
their implementation produced diffrent DN string for the
same certificate (more blanks)).

Just a remark: I'll insert the fix in my codebase here but
will not check it in yet because SF seems to have some
problems with the CVS server. I'll checkin as soon as SF's
CVS is stable again.

Regards,
Werner


> -----Urspr=FCngliche Nachricht-----
> Von: wss4j-devel-admin-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org=20
> [mailto:wss4j-devel-admin-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org] Im Auftrag=20
> von Jason Essington
> Gesendet: Dienstag, 27. Januar 2004 01:31
> An: [email protected]
> Betreff: [WSS4J] Using trusted Certs with wss4j
>=20
>=20
> I just tried to encrypt a message today using a trusted certificate=20
> (rather than a keypair) and the crypto engine (Merlin) pitched an =
NPE.
>=20
> The problem seems to stem from the getCertificates(String alias)=20
> method. when the WSEncryptBody calls the crypto.getCertificates()=20
> method with an alias that belongs to a self signed trusted=20
> certificate=20
> (cert that has been exported, sans the private key, from another=20
> keystore and imported into the one being used) the method=20
> returns null.=20
> the root cause is KeyStore.getCertificateChain() in the case=20
> of a self=20
> signed trusted certificate only KeyStore.getCertificate() seems to=20
> return a certificate.
>=20
> I solved the problem this way (in Merlin):
>=20
>      public X509Certificate[] getCertificates(String alias) throws=20
> Exception {
>         for (Enumeration enum =3D keystore.aliases();=20
> enum.hasMoreElements();) {
>            String elem =3D (String) enum.nextElement();
>         }
>=20
>         certs =3D keystore.getCertificateChain(alias);
>          if (certs =3D=3D null || certs.length =3D=3D 0) {
>            Certificate cert =3D keystore.getCertificate(alias);
>             // no cert chain, so lets check if getCertificate=20
> gives us a=20
> result.
>             if (cert !=3D null) {
>                certs =3D new Certificate [] {cert};
>             }
>             else {
>                return null;
>             }
>          }
>          X509Certificate[] x509certs =3D new=20
> X509Certificate[certs.length];
>          for (int i =3D 0; i < certs.length; i++) {
>              x509certs[i] =3D (X509Certificate) certs[i];
>          }
>          return x509certs;
>      }
>=20
> But I am not sure if that's the best solution to this problem.
>=20
> This little change does allow me to encrypt (on the sending side) and =

> authenticate Signatures (on the receiving side) messages where the=20
> keystore for the respective action contains a trusted certificate=20
> rather than a keypair.
>=20
> -jason
>=20
>=20
>=20
> -------------------------------------------------------
> The SF.Net email is sponsored by EclipseCon 2004
> Premiere Conference on Open Tools Development and Integration
> See the breadth of Eclipse activity. February 3-5 in Anaheim, CA.
> http://www.eclipsecon.org/osdn
> _______________________________________________
> wss4j-devel mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/wss4j-devel
>=20


-------------------------------------------------------
The SF.Net email is sponsored by EclipseCon 2004
Premiere Conference on Open Tools Development and Integration
See the breadth of Eclipse activity. February 3-5 in Anaheim, CA.
http://www.eclipsecon.org/osdn