基于SSL客户端证书认证的WebService调用

一、服务端配置

1 证书链cacerts

2 服务器证书及密钥server.jks，密码为"changeit"

二、服务端代码

下面以XFire为例

......
HttpServletRequest request = XFireServletController.getRequest();
X509Certificate[] chain = (X509Certificate[]) request.getAttribute("javax.servlet.request.X509Certificate");
X509Certificate clientcert= chain[0];
String ip= request.getRemoteAddr();
//后面进行客户端证书认证
......

三、客户端配置

1 证书链cacerts

2 客户端证书及密钥client.jks，密码为"changeit"

四、客户端代码

......
System.setProperty("javax.net.ssl.trustStore","/path/cacerts");
System.setProperty("javax.net.ssl.keyStoreType","JKS");  //or "PKCS12"
System.setProperty("javax.net.ssl.keyStore","/path/client.jks"); //or "/path/client.pfx"
System.setProperty("javax.net.ssl.keyStorePassword","changeit");
String wsURL = "https://server/services/PersonalTaxService3";
//后面调用和普通HTTP方式调用相同
......

对于C# .net客户端，参考：https://support.microsoft.com/en-us/kb/895971



参考资料:

Java™ Secure Socket Extension (JSSE) Reference Guide

http://docs.oracle.com/javase/7/docs/technotes/guides/security/jsse/JSSERefGuide.html