HTTP JVM does not present X.509 (PKCS12) in SSL handshake

HCL Domino Domino Forum
1

I have a Java agent “WSAgent” that connects to a SOAP WebService provider using javax.xml.soap package.

The WebService requires SSL connection and client certificate (for identification purposes).

The certificate (PKCS12) has been imported into Dominos cacerts using IKEYMAN.

  1. Running the agent from the server console “tell amgr run” works flawlessly. Connection is established, certificate sent to provider, request sent and reponse received.

  2. However! Running the agent from web (ajax/url) does not work. The Domino server reports:

HTTP JVM: SAAJ0008: Bad Response; Forbidden. For more detailed information, please consult error-log-0.xml located in D:/Domino/Data/domino/workspace/logs
HTTP JVM: com.sun.xml.internal.messaging.saaj.SOAPExceptionImpl: com.sun.xml.internal.messaging.saaj.SOAPExceptionImpl: Bad response: (403Forbidden
HTTP JVM: at com.sun.xml.internal.messaging.saaj.client.p2p.HttpSOAPConnection.call(HttpSOAPConnection.java:160)

This proves that the certificate was never sent to the WebService provider.

I need to call the agent from web using a ajax call

A. I have tried calling the “WSAgent” from another agent (ajax/url) using runonserver. → “(403Forbidden”

B. I have tried using the built in “WebServiceConsumer” design element in Domino Designer, but that always raises the “(403Forbidden” error regardles of how I run the agent.

What am I doing wrong?

2

Subject: Related SPRs.

Discussed this offline, but for anyone else reading the forums.

Currently Domino web services don’t support the client authentication mechanism. Related SPRs (in case anyone needs to subscribe to an APAR).

SODY9H6BTM - Relates to Client Authentication using the SOAP classes in Domino.

SODY9GJDBB - Relates to Client Authentication using Web Services (ie. import WSDL) in Domino.

Using the Apache Axis third party jars should act as a work around.