Failed to create javax.xml.ws.WebServiceException service exception:

Question

I need desperate help to find out why my application is not building a web service.

Here is my webservice Java class:

@WebService @Component public class LoginWs extends AbstractWs { private static final Logger logger=MiscUtils.getLogger(); @Autowired private PersonDao personDao = null; /** * Returns PersonTransfer on valid login * @throws NotAuthorisedException if password is incorrect */ public PersonTransfer login(String userNameOrEmailAddress, String password) throws NotAuthorisedException { Person person=personDao.findByUserNameOrEmailAddress(userNameOrEmailAddress, true); if (person != null && person.checkPassword(password)) { PersonTransfer personTransfer = PersonTransfer.getTransfer(person); personDao.setLastLogin(person.getId(), new GregorianCalendar()); EventLogDao.logEvent(ActionType.READ_DATA.name(), "LoginWs.login()", "personId=" + person.getId()); return(personTransfer); } logger.debug("Login failed : u/p="+userNameOrEmailAddress+"/"+password); throw(new NotAuthorisedException("Invalid Username/Password")); } } 

Code calling this service:

  public static LoginWs getLoginWs() { LoginWsService service = new LoginWsService(buildURL("LoginService")); LoginWs port = service.getLoginWsPort(); CxfClientUtils.configureClientConnection(port); return(port); } 

The exception is:

  LoginWsService service = new LoginWsService(buildURL("LoginService")); 

Here is the complete exception:

  Error javax.xml.ws.WebServiceException: org.apache.cxf.service.factory.ServiceConstructionException: Failed to create service. at org.apache.cxf.jaxws.ServiceImpl.<init>(ServiceImpl.java:149) at org.apache.cxf.jaxws.spi.ProviderImpl.createServiceDelegate(ProviderImpl.java:65) at javax.xml.ws.Service.<init>(Service.java:56) at org.websr.my_server.ws.LoginWsService.<init>(Unknown Source) Caused by: javax.wsdl.WSDLException: WSDLException: faultCode=PARSER_ERROR: Problem parsing 'https://192.168.2.184:8443/my_server/ws/LoginService?wsdl'.: javax.net.ssl.SSLHandshakeException: java.security.cert.CertificateException: No subject alternative names present 

Can someone tell me why it does not work when creating the Service. In the LoginWs method, this line

  CxfClientUtils.configureClientConnection(port); 

sets up an SSL connection, but my code doesn't even get there. It is trying to connect to LoginWsService service = new LoginWsService (buildURL ("LoginService")); and failure.

Can someone please tell me what is going on here? Thank!

cert.pem:

  MIID1DCCArygAwIBAgIJAPAlC2JvlPsZMA0GCSqGSIb3DQEBBQUAMIGSMQswCQYD VQQGEwJDQTEQMA4GA1UECBMHT250YXJpbzEQMA4GA1UEBxMHVG9yb250bzERMA8G A1UEChMISW5kaXZpY2ExETAPBgNVBAsTCEluZGl2aWNhMRYwFAYDVQQDEw0xOTIu MTY4LjIuMTg0MSEwHwYJKoZIhvcNAQkBFhJkaXZ5YUBpbmRpdmljYS5jb20wHhcN MTIwMTA2MTYxMTQwWhcNMTMwMTA1MTYxMTQwWjCBkjELMAkGA1UEBhMCQ0ExEDAO BgNVBAgTB09udGFyaW8xEDAOBgNVBAcTB1Rvcm9udG8xETAPBgNVBAoTCEluZGl2 aWNhMREwDwYDVQQLEwhJbmRpdmljYTEWMBQGA1UEAxMNMTkyLjE2OC4yLjE4NDEh MB8GCSqGSIb3DQEJARYSZGl2eWFAaW5kaXZpY2EuY29tMIIBIjANBgkqhkiG9w0B AQEFAAOCAQ8AMIIBCgKCAQEAxY8+fsw2pP4ToHN6XFNli4vOGbt+O/ANsr1A8iJh nCb6cpQ58xF4pvYmETHrAUpv4zpi31SzZvWYI1tMaCEv9IpcX6Kc1B8NB9sLUnhR gyblF37rZ7eMmSAXXeDS0CTtDEJoHOkGxoUdCN6N+vZjJ5+ZONiiuLqZ4x4HwBFr ucIlwl2FkMMSxylg90tttSIyUHGz/p2DvNA2goYih4d89c/FLNpqwku+G3/gnL7U l0OmNuFwJa/qMjy/V1orfpT8egxxh8DMp+fLAv1gjbeoizUs2bHo9kQSbUSp9Cwb VDCol9jGI14cBuuEpWSANx2gTekN1ktoxztFPCh7H3OK/wIDAQABoyswKTAPBgNV HREECDAGhwTAqAK4MAkGA1UdEwQCMAAwCwYDVR0PBAQDAgXgMA0GCSqGSIb3DQEB BQUAA4IBAQALvpU0/5gQedlET2+r2MV0oksTmM2hV677yVsrOnGCOnTcgMZHp5i4 A0B24Ed2iDesX60OAViIocQkOiwYTRnubg5SoWyL1nhmaa/98U6M/re8R/bvq6OK qrzEO6hHOtunJg1HcZDiJZop7R/pM52yRhRoXU6upZEhbPr6Eh+zfysA0TD6uMs7 9k2VeJo++XUvbG3dkVJ9kYhqfx2vC0HiMI4H2eomzl2ymS+R9Kg/9o29K8oCYjDI jWPbl2hmf2cQuC4gG8GUDZi7zJkFsBuJpD6XgpIVK9zNhg1e89eP0nABupIFqBOI iz0C+tRB4z4TezPL6yC7BDMY2nJ/Cg5e 

against what the server actually uses:

 MIICVTCCAb6gAwIBAgIETr3AxTANBgkqhkiG9w0BAQUFADBvMQswCQYDVQQGEwJD QTEQMA4GA1UECBMHT250YXJpbzEQMA4GA1UEBxMHVG9yb250bzERMA8GA1UEChMI SW5kaXZpY2ExETAPBgNVBAsTCEluZGl2aWNhMRYwFAYDVQQDEw0xOTIuMTY4LjIu MTg0MB4XDTExMTExMjAwNDE0MVoXDTIxMTEwOTAwNDE0MVowbzELMAkGA1UEBhMC Q0ExEDAOBgNVBAgTB09udGFyaW8xEDAOBgNVBAcTB1Rvcm9udG8xETAPBgNVBAoT CEluZGl2aWNhMREwDwYDVQQLEwhJbmRpdmljYTEWMBQGA1UEAxMNMTkyLjE2OC4y LjE4NDCBnzANBgkqhkiG9w0BAQEFAAOBjQAwgYkCgYEAzvnBMOM2YpM4Ch0MkesA ryqX3YD8O22kJJrpRuOMyqgt6fKEDxkcGjiEZ7qLfWbzv3eX9DE0nVeS4m65Ucr2 LLZN6iZoqP8J+AmkSXKapIQpX7tZM5UuTDy82vUdOiYJELB3NSJc/4nkZkTaN8Uj h3Ph366kRUP+QWiq2y97KKMCAwEAATANBgkqhkiG9w0BAQUFAAOBgQBFeOQOKq9u 4nq/IUgNpILrhcpiAP5LB49bCXeTCi8Ls51qUCaezceUQKrWM60a6w8FxQF+yopB PSqGMrUBHnvewkThgZbS12t5vOEoXnWjOwiXhMhRsk5i9YUh1QCYfOFF23aXNfRu NLL5svksUHm1IzBJJANnL/YdJHRrR0IEQg== 

Answer 1

 java.security.cert.CertificateException: No subject alternative names present 

It looks like you are connecting using the IP address directly (and not the host name) to a certificate that does not have a subject alternate name record.

This, of course, is related to this question:

• How to add a subject related to ssl certificates?

If you decide not to use the SAN record, but rely on the hostname in CN (which you also configured on the correct IP address of your client), you should also use it to indicate the connection. Maybe your URL builder is creating a URL that still depends on the IP address.

EDIT: (following comments)

As I said in the answer to another question related above, there are (at least) two ways to create a self-signed certificate with Subject Alt Name for Java:

• Using Java 7 keytool
• Using OpenSSL as described here: http://www.crsr.net/Notes/SSL.html

You have chosen the second option (perhaps a little more complicated?). OpenSSL is able to create a PKCS # 12 file ( .p12 ) that Java security providers should be able to use as a keystore directly by default (although keytool in Java 6 and later can convert them to a JKS repository via -importkeystore ). To use them directly, use the storage type "PKCS12" .

To create a PKCS # 12 file with OpenSSL using the result of creating a self-signed certificate (assuming the files are called cert.pem for the certificate and key.pem for the private key):

 openssl pkcs12 -export -in cert.pem -inkey key.pem -out store.p12 

Then configure it in Apache Tomcat using (and restart Tomcat):

 <Connector port="8443" ... scheme="https" secure="true" keystoreFile="/path/to/store.p12" keystorePass="..." keystoreType="PKCS12" sslProtocol="TLS" /> 

To extract the contents of a certificate to a PKCS # 12 file:

 openssl pkcs12 -in store.p12 -nokeys -clcerts | openssl x509 -text -noout 

To verify the certificate, the server actually uses:

 echo "" | openssl s_client -showcerts -connect hostname_or_ip_address:port 

Answer 2

You have a problem with the certificate.

I can open it directly through Windows, and I bet if you open Internet Explorer and enter the web service URL and view the certificate through IE, you should not have any problems.

BUT for some reason, Java cannot parse it.
For example, if I try to read the certificate through the default java libraries:

 public static void main(String[] args) throws Exception{ CertificateFactory f = CertificateFactory.getInstance("X.509"); X509Certificate certificate = (X509Certificate) f.generateCertificate(new FileInputStream("C:\\certificate.pem")); System.out.println(certificate); } 

I get a parsing exception:

 Exception in thread "main" java.security.cert.CertificateException: Could not parse certificate: java.io.IOException: Unsupported encoding at sun.security.provider.X509Factory.engineGenerateCertificate(Unknown Source) at java.security.cert.CertificateFactory.generateCertificate(Unknown Source) at test.Test.main(Test.java:15) Caused by: java.io.IOException: Unsupported encoding at sun.security.provider.X509Factory.base64_to_binary(Unknown Source) ... 3 more 

The problem is decoding from base64.
The Bouncy Castle attempt also did not read it.

I saw before this discrepancy between security libraries and Windows the ability to decode certificates, while Java libraries cannot.

In your case, your certificate cannot be parsed by your web service client that uses java, and the exception that has arisen from CXF wrappers has a pass message regarding alternative object names.

I can’t say what the problem is with your certificate, because I am not very familiar with open ssl.

But if you create (just to verify what I'm saying) a new keystore using java tools, you should have no problem.