This Blog post is an updated version of
Asela's Blog
Exchanging Certificates with Client and Server.
First step is to create Client Key Store and Client Trust Store. Here I am using Java Keytool, which can be found in JDK bin directory.
1) Create Client ( let's call wso2client ) Key Store (wso2clientkeystore.jks)
keytool -genkey -keyalg RSA -keystore wso2clientkeystore.jks -alias wso2client -dname "CN=wso2client" -validity 3650 -keysize 2048
Provide Store password and Key password.
2) Create Client Certificates.
keytool -export -keyalg RSA -keystore wso2clientkeystore.jks -alias wso2client -file wso2client.cert
3) Create Client Trust Store (wso2clientTrustStore.jks)
keytool -import -file wso2client.cert -alias wso2client -keystore wso2clientTrustStore.jks
Provide Trust store password.
4) Export ESB Server Certificate
keytool -export -keyalg RSA -keystore
/repository/resources/security/wso2carbon.jks -alias wso2carbon -file wso2carbon.cert
Provide wso2carbon store password "wso2carbon"
5) Import Client Certificate wso2client.cert to WSO2 ESB client-trustStore.jks
keytool -import -file wso2client.cert -alias wso2client -keystore
/repository/resources/security/client-truststore.jks
Provide wso2carbon store password "wso2carbon"
6) Import ESB Server Certificate wso2carbon.cert to client-trust store
keytool -import -file wso2carbon.cert -alias wso2carbon -keystore wso2clientTrustStore.jks
Configure WSO2 ESB Server
1) Edit https transportReceiver in axis2.xml, which is located in
/repository/conf/axis2/ folder and Add SSLVerifyClient to require as follows.
2) Restart ESB Server.
Note: This will Enable Mutual SSL for Proxies on https transport in ESB.
Create Test Proxy
Create a test proxy with Following Content
Testing Test Proxy Using SOAP UI
1) Open SOAP UI and create a SOAP UI project using Test Proxy WSDL. ( https://localhost:9443/services/Test?wsdl )
2) Try to Invoke Test Proxy with default configuration.
As shown bellow, it will fail with javax.net.SSLHandshakeException. This is because Soap UI doesn't have wso2client key store and trust store.
3) Let's Add Key store and Trust Store to Project. Open Test Project Properties. -> WS-Security Configuration -> Key Store -> Add Key Store as shown in following picture. -> Select wso2clientkeystore.jks
4) Enter store password for wso2clientkeystore.jks
5) Similarly add Client Trust store to SOAP UI ( An optional step for this tutorial )
6) Select SSL Keystore to wso2clientkeystore.jks.
7) Invoke Request 1 again with SSL configuration.
Now you will be able to invoke Test proxy service with Mutual SSL enabled.
In Next blog, I will discuss how to Enable Mutual SSL only for One proxy.