Hi Oliver,
WSS4J does support using PKCS12 via the Merlin properties file, I ran the
following test using the mainline and it worked fine:
Crypto.properties:
g.apache.ws.security.crypto.provider=org.apache.ws.security.components.crypto.Merlin
org.apache.ws.security.crypto.merlin.keystore.type=pkcs12
org.apache.ws.security.crypto.merlin.keystore.password=security
org.apache.ws.security.crypto.merlin.keystore.alias=16c73ab6-b892-458f-abf5-2f875f74882e
org.apache.ws.security.crypto.merlin.alias.password=security
org.apache.ws.security.crypto.merlin.file=keys/x509.PFX.MSFT
PKCS12 file:
keytool -list -alias 16c73ab6-b892-458f-abf5-2f875f74882
e -keystore x509.PFX.MSFT -storetype pkcs12 -v
Enter keystore password: security
Alias name: 16c73ab6-b892-458f-abf5-2f875f74882e
Creation date: 01-Jul-2008
Entry type: keyEntry
Certificate chain length: 1
Certificate[1]:
Owner: CN=dims
Issuer: CN=dims
Serial number: 21614ef708d3c5924ec5c806b41a8655
Valid from: Mon May 12 17:41:17 BST 2003 until: Sat Dec 31 23:59:59 GMT 2039
Certificate fingerprints:
MD5: F1:43:38:7C:6B:6B:E0:FA:95:EC:9A:83:25:71:B1:2A
SHA1: E5:EA:56:F4:68:4B:EA:CD:24:0B:D5:FD:7A:0B:11:67:DD:28:A1:E1
Code:
Document doc = unsignedEnvelope.getAsDocument();
WSSecEncrypt encryptor = new WSSecEncrypt();
Crypto crypto = CryptoFactory.getInstance("crypto.properties");
java.security.cert.X509Certificate[] certs =
crypto.getCertificates("16c73ab6-b892-458f-abf5-2f875f74882e");
WSSecHeader secHeader = new WSSecHeader();
secHeader.insertSecurityHeader(doc);
java.util.Vector parts = new java.util.Vector();
org.apache.ws.security.SOAPConstants soapConstants =
new org.apache.ws.security.SOAP11Constants();
org.apache.ws.security.WSEncryptionPart part = new
org.apache.ws.security.WSEncryptionPart(soapConstants
.getBodyQName().getLocalPart(), soapConstants
.getEnvelopeURI(), "Content");
parts.add(part);
encryptor.setParts(parts);
encryptor.setUserInfo("16c73ab6-b892-458f-abf5-2f875f74882e");
doc = encryptor.build(doc, crypto, secHeader);
I'm not sure whether it's supported in WSS4J 1.5.1 or not. Can you try your
code with 1.5.4 to make sure? Otherwise, maybe your TestService.p12 is suspect.
Colm.
-----Original Message-----
From: Oliver Wulff [mailto:[EMAIL PROTECTED]
Sent: 30 June 2008 18:38
To: wss4j-dev
Subject: PKCS12 support with Merlin
Hi there
I use WSS4J 1.5.1.
I've created the following merlin properties file:
org.apache.ws.security.crypto.provider=org.apache.ws.security.components.crypto.Merlin
org.apache.ws.security.crypto.merlin.keystore.type=pkcs12
org.apache.ws.security.crypto.merlin.keystore.password=changeit
org.apache.ws.security.crypto.merlin.keystore.alias=1
org.apache.ws.security.crypto.merlin.alias.password=changeit
org.apache.ws.security.crypto.merlin.file=TestService.p12
I can list the content of the p12 file with keytool like this:
keytool -list -alias 1 -keystore TestService.p12 -storetype pkcs12 -v
The alias "1" seems to exist:
Aliasname: 1
Erstellungsdatum: 30.06.2008:
Eintragstyp: keyEntry
Zertifikatskettenlõnge: 2
Zertifikat[1]:
......
In the code I do the following:
WSSecEncrypt encryptor = new WSSecEncrypt();.
Crypto crypto = CryptoFactory.getInstance("server.properties");
java.security.cert.X509Certificate[] certs = crypto.getCertificates("1");
WSSecHeader secHeader = new WSSecHeader();
secHeader.insertSecurityHeader(doc);
Vector<WSEncryptionPart> parts = new Vector<WSEncryptionPart>();
WSEncryptionPart part = new WSEncryptionPart(soapconstants
.getBodyQName().getLocalPart(), soapconstants
.getEnvelopeURI(), "Content");,
parts.add(part);
encryptor.setParts(parts);
encryptor.setUserInfo("1");
doc = encryptor.build(doc, crypto, secHeader);
but I get the following exception:
org.apache.ws.security.WSSecurityException: General security error
(Unexpected number of X509Data: for Encryption)
at org.apache.ws.security.message.WSSecEncrypt.prepare
(WSSecEncrypt.java:211)
at org.apache.ws.security.message.WSSecEncrypt.build
(WSSecEncrypt.java:253)
If I use a java keystore, it works.
Thanks for your help
Oliver
******************* BITTE BEACHTEN *******************
Diese Nachricht (wie auch allfällige Anhänge dazu) beinhaltet
möglicherweise vertrauliche oder gesetzlich geschützte Daten oder
Informationen. Zum Empfang derselben ist (sind) ausschliesslich die
genannte(n) Person(en) bestimmt. Falls Sie diese Nachricht
irrtümlicherweise erreicht hat, sind Sie höflich gebeten, diese unter
Ausschluss jeder Reproduktion zu zerstören und die absendende Person
umgehend zu benachrichtigen. Vielen Dank für Ihre Hilfe.
---------------------------------------------------------------------
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]
----------------------------
IONA Technologies PLC (registered in Ireland)
Registered Number: 171387
Registered Address: The IONA Building, Shelbourne Road, Dublin 4, Ireland
---------------------------------------------------------------------
To unsubscribe, e-mail: [EMAIL PROTECTED]
For additional commands, e-mail: [EMAIL PROTECTED]
