Architect Consultant blog

Introduction In one of my previous Blog item about Cordys BOP4, I described how Apache WebServer and Cordys BOP must be configured for using secure two-way-SSL. I discovered some behavior of this set-up which i want to share in this blog. Behavior When you configure two-way-SSL in Apache Webserver, the client certificate is used by the Apache WebServer to check whether this client may access the WebServer. However this certificate is also used by Cordys BOP4 for the identification of the User within BOP4. For this you have to configure a User that has the client certificate attached to it. * Goto User Manager > Users Roles * Select a User, Right click Edit * Select as Authentication Type: Certificate * Click Use Certificate and import the public certificate of the client (X.501 compliant) When you sent a soap message to the platform you must NOT use wsse:Security tags in the soap header anymore    Roger Password ...

Introduction This blog item describes how I setup End-2-End security ebXML communication using the Hermes2 framework. The ebMS client is on a Tomcat installation and it communicates with an Apache WebServer (running on Linux and redirecting ebms communication to Tomcat instance on the same server). Prerequisite: Hermes2 (client) and Tomcat installed Hermes2 (server) and Tomcat installed Server certificates generated (self signed) Configuring Hermes2 (corvus webbapplication within Tomcat) When you change the partner agreement to use the https:// protocol towards the receiver you will get the following error (look in the ebms.log of the ebMS sender). hk.hku.cecid.ebms.spa.task.DeliveryException: Cannot send the message     by hk.hku.cecid.piazza.commons.net.ConnectionException: Unable to send HTTP SOAP request     by javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider...

Introduction I know there has been written a lot already about SSL configuration on Tomcat and Apache, but for my own registration I store some links I used to setup SSL. It also contains some handy commands I used to generate certificates. Links Client Certificate Authentication with Apache Apache webserver and SSL configuration Nice overview of SSL and OpenSSL OpenSSL and PKCS#12 FQA Description of Java keytool Most common keytool commands Configuration of Hermes2 (ebXML framework) with SSL Configuration of SSL in Tomcat Terms X.509 In cryptography, X.509 is an ITU-T standard for a public key infrastructure (PKI) for single sign-on (SSO) and Privilege Management Infrastructure (PMI). X.509 specifies, amongst other things, standard formats for public key certificates , certificate revocation lists , attribute certificates , and a certification path validation algorithm. PKCS#12 PKCS#12 is a standard for storing private keys and certificates securely. It define...

Introduction This blog item will show an example how to configure secure SSL with Apache 2.2.x and Cordys BOP4 (CU9) (on Windows). Creating Test Certificate First we will create a test certificate with Apache. Copy the <Apache>/conf/ openssl.cnf to a temportary directory (<temp>) Because the EventService of Cordys uses the IP address as an alternate domain, you have to change the openssl.cnf file in the <temp> directory. Add the following line behind [ v3_req ]: subjectAltName=DNS: www.example.com,DNS: 192.168.2.103 (Change localhost and IP address accordingly) First we will create the RSA Private Key: <Apache>/bin/openssl genrsa -des3 -out server.key 1024 Now we must generate a Certificate Signed Request (CSR). During the generation of the CSR, you will be prompted for several pieces of information. These are the X.509 attributes of the certificate. One of the prompts will be for "Common Name (e.g., YOUR name)". It is important that this field be fil...