1

I am setting up the tomcat server which communicate with external system through SOAP web services(I am using the external system stubs and apache Axis2 library for that). The external system is secured with ssl client/server authentication. The system provides me keystore file in .pfx format which contains two certificates.

Things I have tried:

I have extract those two certificates and added in my keystore. I added below entry in my tomcat/bin/catalina.bat file

set JAVA_OPTS = %JAVA_OPTS% -Djavax.net.ssl.trustStore=/pathtomykeystore/cacerts -Djavax.net.ssl.keyStore=/pathtomykeystore/cacerts -Djavax.net.ssl.keyStorePassword=changeit -Djavax.net.ssl.trustStorePassword=changeit

With above configuration my request fails with No X.509 client certificate HTTP header found in request.

I have enable ssl logs then I found that serverHelloDone is printed and after that it says

"No suitable client certificate could be found - continuing without client authentication"

The same thing I have tried from SOAPUI Tool where I directly configure .pfx file as keystore and it is working fine there

The diff between Tomcat and SOPAUI logs is SOAPUI can successfully competing Client authentication where tomcat is not. also below lines are missing from tomcat ssl logs

keystore is: 
keystoreType is: jks
keystore provider is

Update1: I remove the keystore configuration from SOAPUI->project view-> WS Security Configuration -> keystore (This is working configuration) and added above mentioned JAVA_OPTS entries in soapui.bat file and now SOAPUI also giving a same error.

Anyone helps arround how soap ui pick and send the certificates from keystore configured in project view->keystore

Prasad Parab
  • 437
  • 1
  • 7
  • 26
  • There are several possible issues. Maybe the keystore *IS* being defined ... and the problem is "somewhere else", FIRST STEPS: 1) Read [this](https://docs.oracle.com/javase/8/docs/technotes/guides/security/jsse/ReadDebug.html), , then 2) Enable SSL debugging: `-Djavax.net.debug=all` – paulsm4 Jan 25 '19 at 06:00
  • I already check the -Djavax.net.debug logs. In logs it seems like tomcat is not picking the keystore so when server request the certificate for client authentication it says _"No suitable client certificate could be found - continuing without client authentication"_ and gives **No X.509 client certificate HTTP header found in request.** error – Prasad Parab Jan 29 '19 at 14:36

0 Answers0