SOAPUi和密钥库

Question

最近,我不得不加强我和Web服务之间的SOAP通信.在我的服务器上创建私钥文件后,在创建/发送CSR后,以PEM格式接收证书文件.

我想在SOAPUi中测试它,但它一直说错误:访问被拒绝.客户端SSL证书必需.

我在这做了什么:

• 证书转换

  openssl pkcs12 -export -out **certif.p12** -inkey **myprivatekey.pem** -in **Certificate-received.pem**
  

• 密钥库导入

  keytool -importkeystore -deststorepass **changeit** -destkeypass **changeit** -destkeystore **pierrejks.jks** -srckeystore **certif.p12** -srcstoretype PKCS12 -srcstorepass **tenzin** -alias 1
  

在SOAPUi中,

我转到首选项并在SSL设置选项卡中,

• 密钥库设置为pierrejks.jks

• 密码库密码提供: changeit

• 需要客户端身份验证.

现在在项目上(右键单击项目的根目录然后显示项目视图),我转到WS-Security Configurations,keystore选项卡添加新的源代码.

• Source是pierrejks.jks文件的路径
• 密码是的changeit
• 默认值Alias设置为pierrealias
• 没有提供别名密码

填写完这些信息后,状态就变好了

在Outgoing WS-Security Configurations中,添加了一个带有新WSS-Entry Encryption的配置.

• 配置名称是pierreconf
• WSS条目类型是加密
• Keystore选择是pierrejks.jks
• 别名是1
• 密码的changeit

最后,使用pierreconf Outgoing WSS配置文件发出请求,这是我有错误.此时,如果我理解正确,RAW选项卡显示它已加密:

POST https://gsxapi.apple.com/gsx-ws/services/emea/iphone HTTP/1.1
Accept-Encoding: gzip,deflate
Content-Type: text/xml;charset=UTF-8
SOAPAction: "urn:authenticate"
Content-Length: 3047
Host: gsxapi.apple.com
Connection: Keep-Alive
User-Agent: Apache-HttpClient/4.1.1 (java 1.5)

    <soapenv:Envelope xmlns:glob="http://gsxws.apple.com/elements/global" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/">
       <soapenv:Header><wsse:Security xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"><xenc:EncryptedKey Id="EK-974B3C3F270F85DA2A143289398095719" xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"><xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p"/><ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#"><wsse:SecurityTokenReference><ds:X509Data><ds:X509IssuerSerial><ds:X509IssuerName>C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple Corporate External Authentication CA 1</ds:X509IssuerName><ds:X509SerialNumber>6119460251051586160</ds:X509SerialNumber></ds:X509IssuerSerial></ds:X509Data></wsse:SecurityTokenReference></ds:KeyInfo><xenc:CipherData><xenc:CipherValue>yWIQ5aWqy50ba/kaw3mLYyvpBL8S+mcQnkZri8q6deJXoNFZm+TGOry9ds5VCbsYzpgjAYGFRZxnEfnAirFDqojUgbthc6E/YeG15y1GShiBZrBB3U5KVk6ZIqRaOAVSBMCG5DXosFDz0I/MrToMA8MvX5A26pgp6siM6fhfVRLfFPDCJQOQJw3gr2G3IUnu0t4jf2BIs4FPObtOZSN1ou+w3ny2meL2F0VhT2UPDbZ46EKwHiY7Az9RVt0MocWRRQSR9FU4h6zqziWbUC95OrzrKXrbo01La8UDZ4mykQXqg==</xenc:CipherValue></xenc:CipherData><xenc:ReferenceList><xenc:DataReference URI="#ED-974B3C3F270F85DA2A143289398095720"/></xenc:ReferenceList></xenc:EncryptedKey></wsse:Security></soapenv:Header>
       <soapenv:Body><xenc:EncryptedData Id="ED-974B3C3F270F85DA2A143289398095720" Type="http://www.w3.org/2001/04/xmlenc#Content" xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"><xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes128-cbc"/><ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#"><wsse:SecurityTokenReference wsse11:TokenType="http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsse11="http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd"><wsse:Reference URI="#EK-974B3C3F270F85DA2A143289398095719"/></wsse:SecurityTokenReference></ds:KeyInfo><xenc:CipherData><xenc:CipherValue>cYyhZSw7/XR9Gtj7+lzkwwilTlpuAHVYdT+v8WeofYo48j8K0CReBIdeUI3pfWQ+cEj1D+VQO1k7e6fCsDuK7vZfrCG2qrYDlJmChnDrR7Tr5QSpC/ES3ohnYFqRrNnaOAhgjrqtDevww/S0dUKxmAFEbY18rvbF+l1T32da53zo1b9mN+sD9oKdWq7w+1eJHZOpJ4WQuMcdHp9DqAxizu4nc4FX65myZieI2qoWTzKGqeNMbqqyFFVpQ0iqI+7sT5Rh9Qc/Sw9pZMHxx3x856+PH/4PExTj/00f7rzhy6MhxEFavHksBraeGU6Ctd+xRMaA4Y/ZXGytf6M9C5j0v2SDqAFtwtj9Sky2uRzsXlNwmjinI29SsGAcOOBvyB7+Ff8rSATR3snMgvuNN3l0GsLDP1tzqz7vhHkCeKtsRCC8xtOqsZsz9QEmB31Gz3QMilsmsyhjdZ5QUsc+VU/HJhON2pzk7xL+V8zupc/uDoeg9AS38lti2nid5WDLAdG8j1IAU7ox/tJnAs7NTti9XN2nTcHf9u7laQfEm7i4VaLkn6hHsXf7JTE5GBkTF2sbR0cpSnIi2fYbHlU6EIugTgwU0875enhRQiyHhb84QByTfxig0bXaMCMnHDkdjH41+HoKu5SGxoPOyKp/JDpQaPY3J56RFrp0j8tRlqpUYIU=</xenc:CipherValue></xenc:CipherData></xenc:EncryptedData></soapenv:Body>
    </soapenv:Envelope>

返回消息是

HTTP/1.1 401 Access Denied
Connection: close
Content-Length: 57
Content-Type: text/html
Cache-Control: no-cache,no-store
Pragma: no-cache

Error: Access is Denied. Client SSL Certificate Required.

目前我还不清楚如何使用SSL.

我确定我犯了一些错误,有人能指出我正确的方向吗？

Answer 1

完成了 !

信息:我的SOAPUi版本是5.0我决定不使用JKS作为密钥库而只使用p12文件

这是我一步一步做的

PKCS12文件创建

使用我的privatekey.pem文件(用于生成CSR文件)和certificate.pem接收(由前一方提供的CSR文件生成)

openssl pkcs12 -export -out certif.p12 -inkey myprivatekey.pem -in Certificate-received.pem

问题:

• Enter pass phrase for myprivatekey.pem :我输入了用于生成私钥的密码.
• Enter export password:tenzin
• Verifying - Enter Export Password:tenzin

在SOAP UI中,

在偏好中,

1. certif.p12被选为密钥库.
2. 给出的密码是tenzin
3. 勾选需要客户端身份验证.

有用.