Forum Discussion

Mark_Hansen's avatar
Mark_Hansen
Occasional Contributor
16 years ago

X.509 Cert Failing Triple AAA

Calling a service hosted on a XI50 box.  The service is secured by a X.509 public cert, I can import the keystore and have defined the signature for the within the keystore.  It fails AAA every time.

I have started SOAPUI with Sun and IBM's JSSE and doesn't make a difference.

I took a look between a WAS app that makes the call and gets through and SOAPUI and major difference seems to be the Value Type.  The message that work have X509v3 as the valueType.



#1 could that be the issue, and is there a way to modify this type.
#2 what else could it be..

Very frustrated.. Please help.

17 Replies

Sort By
Show More
  • Mark_Hansen's avatar
    Mark_Hansen
    Occasional Contributor
    16 years ago
    Additional information from IBM datapower support for support that SOAPUI uses for the token type

    (IBM Writes)
    Thank you for the additional information.
    I am still working on the recreate.  However, I would like to confirm that DataPower does support X509PKIPathv1 token. However if we can reproduce that, I can forward it to engineering team to evaluate for possibly bug.
    I will contact you again within 2 days with some update or any additional question.
  • omatzura's avatar
    omatzura
    Super Contributor
    16 years ago
    Hi Mark,

    sorry for the silence, I'm working on this and will let you know when I have more info.. Monday presumably!

    regards,

    /Ole
    eviware.com
  • Mark_Hansen's avatar
    Mark_Hansen
    Occasional Contributor
    16 years ago
    Thanks.. I apperciate the help.. I'll look for something Monday.. HAGW..
  • omatzura's avatar
    omatzura
    Super Contributor
    16 years ago
    Hi Mark,

    ok, I've dug into this a little; it seems that you get the correct V3 ValueType if you t select the "Use Single Certificate" option only; if you don't select it  the wss4j uses the V1 ValueType since there may be other certificates in the certificate chain that are of this type. I'm not sure if this is correct behavior and I could fix this by checking all certificates, but on the other hand which valuetype should it be if there are both V1 and V3 certificates in the chain? The type of the "last" certificate?

    Before I dig in more and try to work around this I wanted to check if you could use the "Use Single Certificate" option as I have to get the V3 ValueType!?

    I'll send you screen-shots of my settings via mail!

    regards,

    /Ole
    eviware.com
  • Mark_Hansen's avatar
    Mark_Hansen
    Occasional Contributor
    16 years ago
    Per your e-mail we tried the "Use Single Cert" and SOAPUI submits 2 transactions. 1 fails AAA and the other gets passed it.  Also, I'm getting a 500 return code to SOAPUI due to the second sumbit.

    Not sure why it's submitting more than one request for this option.. Can you take a look at it.  Thanks.  If we got it to only submit one request it'd probably work.