Re: http client cert verification

[ychawla]

On your client, you can add a HTTP conduit:

        <http:conduit
                name="*.http-conduit">
                <http:tlsClientParameters disableCNCheck="true">
                        <sec:keyManagers keyPassword="password">
                                <sec:keyStore type="JKS"
                                        password="password"
                                        file="my.jks" />
                        </sec:keyManagers>
                        <sec:trustManagers>
                                <sec:keyStore type="JKS"
                                        password="password"
                                        file="truststore.ts" />
                        </sec:trustManagers>
                        <sec:cipherSuitesFilter>
                                
                                <sec:include>.*_EXPORT_.*</sec:include>
                                <sec:include>.*_EXPORT1024_.*</sec:include>
                                <sec:include>.*_WITH_DES_.*</sec:include>
                                <sec:include>.*_WITH_NULL_.*</sec:include>
                                <sec:exclude>.*_DH_anon_.*</sec:exclude>
                        </sec:cipherSuitesFilter>
                </http:tlsClientParameters>
                <http:client AutoRedirect="true" Connection="Keep-Alive" />
        </http:conduit>

On the server, you can set it up to require client auth:

    <http:destination name="{http://namespace}My-Service.http-destination"/>    

  <httpj:engine-factory bus="cxf">
         
         <httpj:engine port="18052">
             <httpj:tlsServerParameters>
               <sec:keyManagers keyPassword="password">
                  <sec:keyStore type="JKS" password="password" 
                       file="keystore.jks"/>
              </sec:keyManagers>
              <sec:trustManagers>
                  <sec:keyStore type="JKS" password="password"   
                       file="truststore.ts"/>
              </sec:trustManagers>
              <sec:cipherSuitesFilter>
                
                <sec:include>.*_EXPORT_.*</sec:include>
                <sec:include>.*_EXPORT1024_.*</sec:include>
                <sec:include>.*_WITH_DES_.*</sec:include>
                <sec:include>.*_WITH_NULL_.*</sec:include>
                <sec:exclude>.*_DH_anon_.*</sec:exclude>
              </sec:cipherSuitesFilter>
              <sec:clientAuthentication want="true" required="true"/>
            </httpj:tlsServerParameters>
          </httpj:engine>
   </httpj:engine-factory>

Check here for CXF configuration:

http://cxf.apache.org/docs/jetty-configuration.html

Thanks,
Yogesh

--
View this message in context: 
http://camel.465427.n5.nabble.com/http-client-cert-verification-tp5542079p5542552.html
Sent from the Camel - Users mailing list archive at Nabble.com.