Using javax.xml.ws.Endpoint with HTTPS

Question

I am working on a project to manage lighting and heating in buildings. The backend (written in Java) will run on the Mac Mini and must be accessible via SOAP.

I want to keep the complexity of this project to a minimum, because I don’t want everyone who used it to have to configure the application server. So so far I have been working with javax.xml.ws.Endpoint:

Endpoint endpoint = Endpoint.create(frontendInterface); String uri = "http://"+config.getHost()+":"+config.getPort()+config.getPath(); endpoint.publish(uri); 

This works surprisingly well (hey, when was the last time you saw something in Java working with only three lines of code?), But now I'm looking for a way to use HTTPS instead of HTTP.

Is there a way to do this without using an application server or is there another way to protect this connection?

Hi Marek

Answer 1

For server:

 SSLContext ssl = SSLContext.getInstance("TLS"); KeyManagerFactory keyFactory = KeyManagerFactory .getInstance(KeyManagerFactory.getDefaultAlgorithm()); KeyStore store = KeyStore.getInstance("JKS"); store.load(new FileInputStream(keystoreFile),keyPass.toCharArray()); keyFactory.init(store, keyPass.toCharArray()); TrustManagerFactory trustFactory = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm()); trustFactory.init(store); ssl.init(keyFactory.getKeyManagers(), trustFactory.getTrustManagers(), new SecureRandom()); HttpsConfigurator configurator = new HttpsConfigurator(ssl); HttpsServer httpsServer = HttpsServer.create(new InetSocketAddress(hostname, port), port); httpsServer.setHttpsConfigurator(configurator); HttpContext httpContext = httpsServer.createContext(uri); httpsServer.start(); endpoint.publish(httpContext); 

For the client, make sure you do this:

 System.setProperty("javax.net.ssl.trustStore", "path"); System.setProperty("javax.net.ssl.keyStore", "password"); System.setProperty("javax.net.ssl.keyStorePassword", "password"); System.setProperty("javax.net.ssl.keyStoreType", "JKS"); //done to prevent CN verification in client keystore HttpsURLConnection.setDefaultHostnameVerifier(new HostnameVerifier() { @Override public boolean verify(String hostname, SSLSession session) { return true; } });