AW: [WSS4J] Using trusted Certs with wss4j

Jason,

another short question: did the decryption work on the
server side? Because here the Security Engine needs to
get the private key for that Certificate.

Thx,
Werner

> -----Urspr=FCngliche Nachricht-----
> Von: wss4j-devel-admin-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org=20
> [mailto:wss4j-devel-admin-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org] Im Auftrag=20
> von Jason Essington
> Gesendet: Dienstag, 27. Januar 2004 01:31
> An: [email protected]
> Betreff: [WSS4J] Using trusted Certs with wss4j
>=20
>=20
> I just tried to encrypt a message today using a trusted certificate=20
> (rather than a keypair) and the crypto engine (Merlin) pitched an =
NPE.
>=20
> The problem seems to stem from the getCertificates(String alias)=20
> method. when the WSEncryptBody calls the crypto.getCertificates()=20
> method with an alias that belongs to a self signed trusted=20
> certificate=20
> (cert that has been exported, sans the private key, from another=20
> keystore and imported into the one being used) the method=20
> returns null.=20
> the root cause is KeyStore.getCertificateChain() in the case=20
> of a self=20
> signed trusted certificate only KeyStore.getCertificate() seems to=20
> return a certificate.
>=20
> I solved the problem this way (in Merlin):
>=20
>      public X509Certificate[] getCertificates(String alias) throws=20
> Exception {
>         for (Enumeration enum =3D keystore.aliases();=20
> enum.hasMoreElements();) {
>            String elem =3D (String) enum.nextElement();
>         }
>=20
>         certs =3D keystore.getCertificateChain(alias);
>          if (certs =3D=3D null || certs.length =3D=3D 0) {
>            Certificate cert =3D keystore.getCertificate(alias);
>             // no cert chain, so lets check if getCertificate=20
> gives us a=20
> result.
>             if (cert !=3D null) {
>                certs =3D new Certificate [] {cert};
>             }
>             else {
>                return null;
>             }
>          }
>          X509Certificate[] x509certs =3D new=20
> X509Certificate[certs.length];
>          for (int i =3D 0; i < certs.length; i++) {
>              x509certs[i] =3D (X509Certificate) certs[i];
>          }
>          return x509certs;
>      }
>=20
> But I am not sure if that's the best solution to this problem.
>=20
> This little change does allow me to encrypt (on the sending side) and =

> authenticate Signatures (on the receiving side) messages where the=20
> keystore for the respective action contains a trusted certificate=20
> rather than a keypair.
>=20
> -jason
>=20
>=20
>=20
> -------------------------------------------------------
> The SF.Net email is sponsored by EclipseCon 2004
> Premiere Conference on Open Tools Development and Integration
> See the breadth of Eclipse activity. February 3-5 in Anaheim, CA.
> http://www.eclipsecon.org/osdn
> _______________________________________________
> wss4j-devel mailing list
> [email protected]
> https://lists.sourceforge.net/lists/listinfo/wss4j-devel
>=20


-------------------------------------------------------
The SF.Net email is sponsored by EclipseCon 2004
Premiere Conference on Open Tools Development and Integration
See the breadth of Eclipse activity. February 3-5 in Anaheim, CA.
http://www.eclipsecon.org/osdn