I have written Jersey RESTful clients that made use of a Dumb X509TrustManager and HostnameVerifier to trust all SSL certs on our lab systems to make it easier to deal with certs that are self-signed.
ClientConfig config = new DefaultClientConfig();
SSLContext context = null;
try
{
context = SSLContext.getInstance("SSL");
context.init(null,
new TrustManager[] { new DumbX509TrustManager() },
null);
config.getProperties()
.put(HTTPSProperties.PROPERTY_HTTPS_PROPERTIES,
new HTTPSProperties(this.getHostnameVerifier(),
context));
webClient = Client.create(config);
}
....
Is there a way for me to do something similar using CXF?
This is from the CXF mailing list. Note that I didn't have to implement it due to other system updates, so this is theoretical:
WebClient webClient = WebClient.create(this.serviceURL,
this.username,
this.password,
null); // Spring config file - we don't use this
if (trustAllCerts)
{
HTTPConduit conduit = WebClient.getConfig(webClient)
.getHttpConduit();
TLSClientParameters params =
conduit.getTlsClientParameters();
if (params == null)
{
params = new TLSClientParameters();
conduit.setTlsClientParameters(params);
}
params.setTrustManagers(new TrustManager[] { new
DumbX509TrustManager() });
params.setDisableCNCheck(true);
}
To complete the answer from sdoca, here is an implementation with a dumb X509 trust manager:
import org.apache.cxf.configuration.jsse.TLSClientParameters;
import org.apache.cxf.jaxrs.client.WebClient;
import org.apache.cxf.transport.http.HTTPConduit;
[...]
public class ApiClient {
private WebClient webClient;
[...]
public void init() {
webClient = createWebClient(URI).accept(MediaType.APPLICATION_JSON).type(MediaType.APPLICATION_JSON);
addX509TrustManager();
}
private void addX509TrustManager() {
Assert.notNull(webClient, "Client needs to be initialized");
HTTPConduit conduit = WebClient.getConfig(webClient).getHttpConduit();
TLSClientParameters params = conduit.getTlsClientParameters();
if (params == null) {
params = new TLSClientParameters();
conduit.setTlsClientParameters(params);
}
params.setTrustManagers(new TrustManager[] { new BlindTrustManager() });
params.setDisableCNCheck(true);
}
}
Where BlindTrustManager is defined as follows:
import java.security.cert.X509Certificate;
import javax.net.ssl.X509TrustManager;
/**
* This dumb X509TrustManager trusts all certificate. TThis SHOULD NOT be used in Production.
*/
public class BlindTrustManager implements X509TrustManager {
@Override
public void checkClientTrusted(X509Certificate[] chain,
String authType) throws java.security.cert.CertificateException {
}
@Override
public void checkServerTrusted(X509Certificate[] chain,
String authType) throws java.security.cert.CertificateException {
}
@Override
public X509Certificate[] getAcceptedIssuers() {
return null;
}
}
It may be useful to check this links for a better understanding:
If you love us? You can donate to us via Paypal or buy me a coffee so we can maintain and grow! Thank you!
Donate Us With