Hermes ebXML SSL Configuration

Introduction

This blog item describes how I setup End-2-End security ebXML communication using the Hermes2 framework.
The ebMS client is on a Tomcat installation and it communicates with an Apache WebServer (running on Linux and redirecting ebms communication to Tomcat instance on the same server).


Prerequisite:

• Hermes2 (client) and Tomcat installed
• Hermes2 (server) and Tomcat installed
  
• Server certificates generated (self signed)
  

Configuring Hermes2 (corvus webbapplication within Tomcat)

When you change the partner agreement to use the https:// protocol towards the receiver you will get the following error (look in the ebms.log of the ebMS sender).
hk.hku.cecid.ebms.spa.task.DeliveryException: Cannot send the message
    by hk.hku.cecid.piazza.commons.net.ConnectionException: Unable to send HTTP SOAP request
    by javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
    by sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
    by sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target
    at hk.hku.cecid.ebms.spa.task.OutboxTask.sendMsgByHttp(OutboxTask.java:578)
    at hk.hku.cecid.ebms.spa.task.OutboxTask.execute(OutboxTask.java:440)
    at hk.hku.cecid.piazza.commons.module.ActiveThread.run(ActiveThread.java:90)
    at java.lang.Thread.run(Unknown Source)

1. You need to edit the <CorvusWebApp>/WEB-INF/classes/hk/hku/cecid/piazza/corvus/core/conf/corvus.module.xml
   <module id="piazza.corvus" name="Piazza Corvus" version="1.0">
   
       <component id="logger" name="System Logger">
           <class>hk.hku.cecid.piazza.commons.util.LoggerLog4j</class>
           <parameter name="config" value="hk/hku/cecid/piazza/corvus/core/conf/corvus.log.properties.xml" />      
           <parameter name="category" value="hk.hku.cecid.piazza" />
       </component>
   
       <component id="properties" name="System Properties">
           <class>hk.hku.cecid.piazza.commons.util.PropertyTree</class>
           <parameter name="config" value="hk/hku/cecid/piazza/corvus/core/conf/corvus.properties.xml" />
       </component>
   
       <component id="messages" name="System Messages">
           <class>hk.hku.cecid.piazza.commons.util.MessagesTree</class>
           <parameter name="config" value="hk/hku/cecid/piazza/corvus/core/conf/corvus.messages.xml" />
       </component>
   
       <!-- Set up a SSL Trust Manager for SSL connection -->
       <component id="ssl-trust-manager" name="SSL Trust Manager">
           <class>hk.hku.cecid.piazza.commons.security.KeyStoreTrustManager</class>
           <parameter name="keystore-location" value="c:/program files/java/jre1.5.0_22/lib/security/cacerts" />
           <parameter name="keystore-password" value="changeit" />
       </component>
   
       <!-- Set up a SSL Key Manager for SSL connection, it is configured in application server most case (e.g. Tomcat server.xml) -->
       <component id="ssl-key-manager" name="SSL Key Manager">
           <class>hk.hku.cecid.piazza.commons.security.KeyStoreKeyManager</class>
           <parameter name="keystore-location" value="d:/local/programs/hermes2/plugins/hk.hku.cecid.ebms/security/corvus.p12" />
           <parameter name="keystore-password" value="password" />
           <parameter name="key-alias" value="corvus2" />
           <parameter name="key-password" value="password" />
           <parameter name="keystore-type" value="PKCS12" />
           <parameter name="keystore-provider" value="org.bouncycastle.jce.provider.BouncyCastleProvider" />
       </component>
   
   </module>
   
   
2. Edit the <CorvusWebApp>/WEB-INF/classes/hk/hku/cecid/piazza/corvus/core/conf/corvus.properties.xml
   <?xml version="1.0" encoding="UTF-8"?><corvus>
   
       <!-- Home Directory -->
       <home>d:\local\programs\hermes2/</home>
   
       <!-- Plugin Registry -->
       <plugin>
           <registry>d:/local/programs/hermes2/plugins</registry>
           <descriptor>plugin.xml</descriptor>
       </plugin>
   
       <!-- Encoding settings -->
       <encoding>
           <servlet-request>UTF-8</servlet-request>
           <servlet-response>text/html;UTF-8</servlet-response>
       </encoding>
     
       <!-- Environment settings -->
       <environment>
           <properties>
               <http.proxyHost/>
               <http.proxyPort/>
               <https.proxyHost/>
               <https.proxyPort/>
               <sun.net.client.defaultConnectTimeout>30000</sun.net.client.defaultConnectTimeout>
               <sun.net.client.defaultReadTimeout>300000</sun.net.client.defaultReadTimeout>
               <file.encoding>UTF-8</file.encoding>
               <javax.net.ssl.keystore>d:/local/programs/hermes2/plugins/hk.hku.cecid.ebms/security/corvus.p12</javax.net.ssl.keystore>
               <javax.net.ssl.keyStorePassword>password</javax.net.ssl.keyStorePassword>
               <javax.net.ssl.keyStoreType>PKCS12</javax.net.ssl.keyStoreType>
               <javax.net.ssl.trustStore>c:/program files/java/jre1.5.0_22/lib/security/cacerts</javax.net.ssl.trustStore>
               <javax.net.ssl.trustStorePassword>changeit</javax.net.ssl.trustStorePassword>
               <javax.net.ssl.trustStoreType>PKCS12</javax.net.ssl.trustStoreType>
           </properties>
       </environment>
     
   </corvus>
   
   Notes:
   * Be sure to use absolute paths for the keystore locations
   * The Keymanager store is used to store the Certificate for this ebMS instance
   * The Trust Manager is used to upload the Certificates this ebMS instance can trust. When sender ebMS try to establish a secure connection, the receiver ebMS will provide a public certificate to sender ebMS to identify its identity. If this certificate is self-signed, it should be added to the truststore defined on the sender side.
   
   
   

When you send a message again now to the https endpoint I got the error:
hk.hku.cecid.ebms.spa.task.DeliveryException: Cannot send the message
    by hk.hku.cecid.piazza.commons.net.ConnectionException: Unable to send HTTP SOAP request
    by javax.net.ssl.SSLHandshakeException: java.security.cert.CertificateException: Certificate chain not trusted
    by java.security.cert.CertificateException: Certificate chain not trusted
    at hk.hku.cecid.ebms.spa.task.OutboxTask.sendMsgByHttp(OutboxTask.java:578)
    at hk.hku.cecid.ebms.spa.task.OutboxTask.execute(OutboxTask.java:440)
    at hk.hku.cecid.piazza.commons.module.ActiveThread.run(ActiveThread.java:90)
    at java.lang.Thread.run(Unknown Source)

This is because I did not import the certificate of the Receiver yet into the Java TrustStore as defined above (In this case the server certificate was self signed).

1. Import the server certificate in the trust store (be sure the certificate is X.501):
   keytool -import -alias tomcat -keystore <your_keystore_filename> -trustcacerts -file <your_certificate_filename>
   

When I imported the server.crt and ca.crt (both generated on the Linux server with OpenSSL).