Ask a Question

why no specify truststore but still work in soap ui 5.1.3

SOLVED
tong123123
New Contributor

why no specify truststore but still work in soap ui 5.1.3

in SOAPUI 5.1.3, preferences > SSL Settings, I have set keystore but not truststore (also no place to set truststore in ssl settings), then I connect to https server, but it works, why SOAPUI 5.1.3 does not need to set the truststore?

1 ACCEPTED SOLUTION

Accepted Solutions
rupert_anderson
Valued Contributor

Re: why no specify truststore but still work in soap ui 5.1.3

Hi,

Presumably to make testing SSL secured web services a little easier for SoapUI, a custom SSLSocketFactory (SoapUISSLSocketFactory) has been written to override the checkServerTrusted methods to do nothing. This means that SoapUI will trust any SSL protected service without the need to import the service's SSL certificate into a SoapUI truststore. 

 

Hope this helps,

Cheers,

Rupert

Author of SoapUI Cookbook

View solution in original post

3 REPLIES 3
rupert_anderson
Valued Contributor

Re: why no specify truststore but still work in soap ui 5.1.3

Hi,

Presumably to make testing SSL secured web services a little easier for SoapUI, a custom SSLSocketFactory (SoapUISSLSocketFactory) has been written to override the checkServerTrusted methods to do nothing. This means that SoapUI will trust any SSL protected service without the need to import the service's SSL certificate into a SoapUI truststore. 

 

Hope this helps,

Cheers,

Rupert

Author of SoapUI Cookbook

View solution in original post

tong123123
New Contributor

Re: why no specify truststore but still work in soap ui 5.1.3

then when I set keystore in preference > ssl settings, what has been done behind?

System.setProperty(" javax.net.ssl.keystore", xxx)?

 

Can I see in code that how soapUI 5.1.3 has created "custom SSLSocketFactory (SoapUISSLSocketFactory) has been written to override the checkServerTrusted methods to do nothing"?

rupert_anderson
Valued Contributor

Re: why no specify truststore but still work in soap ui 5.1.3

Hi,

The keystore property is used to provide a java keystore that holds a 'client' certificate in the case where the service requires that the client (in this case SoapUI) verify it's identity using an client SSL certificate i.e. bi-lateral SSL certificates - does this make sense?

 

Yes you can - please see the SoapUISSLSocketFactory in the latest GitHub code https://github.com/SmartBear/soapui/blob/9df751c4bf2f053c82538bc86db1ab592f89af9d/soapui/src/main/ja...

 

...

@Override
public void checkServerTrusted(X509Certificate[] certs, String authType) {
}

...

 

Cheers,

Rup

Author of SoapUI Cookbook
cancel
Showing results for 
Search instead for 
Did you mean: