Mailing-List: contact cxf-user-help@incubator.apache.org; run by ezmlm
Precedence: bulk
Reply-To: cxf-user@incubator.apache.org
Received-SPF: pass (athena.apache.org: local policy)
From: "Bc. =?utf-8?q?Ji=C5=99=C3=AD?= =?utf-8?q?_Mikul=C3=A1=C5=A1ek?="
 <jiri.mikulasek@aura.cz>
Organization: AURA
To: cxf-user@incubator.apache.org
Subject: Re: CRL support
Date: Mon, 3 Dec 2007 13:28:10 +0100
User-Agent: KMail/1.9.6
References: <200711281218.09525.jiri.mikulasek@aura.cz>
 <200711282226.38864.jiri.mikulasek@aura.cz>
 <E791F6DA-980E-4BDF-A4B5-2B1BD365CE87@dushin.net>
In-Reply-To: <E791F6DA-980E-4BDF-A4B5-2B1BD365CE87@dushin.net>
MIME-Version: 1.0
Content-Type: text/plain;
  charset="utf-8"
Content-Transfer-Encoding: quoted-printable
Content-Disposition: inline
Message-Id: <200712031328.10530.jiri.mikulasek@aura.cz>

Thanks a lot I will check it out

On Thursday 29 of November 2007 15:24:57 Fred Dushin wrote:
> See the http-conf:trustDecider in
>
> https://svn.apache.org/repos/asf/incubator/cxf/trunk/rt/transports/
> http/src/main/resources/schemas/configuration/http-conf.xsd
>
> You'll need to implement your own
> org.apache.cxf.transport.http.MessageTrustDecider, but this will get
> called when a connection is established.  Unfortunately, because of
> the design of the Sun JSSE, this is not a hook into the handshake,
> but your trust decider should be called before any application data
> is sent down the pipe.  That's the idea, at any rate.
>
> -Fred
>
> On Nov 28, 2007, at 4:26 PM, Bc. Ji=C5=99=C3=AD Mikul=C3=A1=C5=A1ek wrote:
> > thanks, because I really need CRL support is there any way how to
> > handle it on
> > my own - maybe use some interceptor, which will handle it before each
> > connection? If there is such possibility, please can somebody give
> > me few
> > basic hints, where to start what to care and so...?
> >
> > Dne st=C5=99eda 28 listopad 2007 21:32 Fred Dushin napsal(a):
> >> CXF does not have support for CRLs.
> >>
> >> On Nov 28, 2007, at 6:18 AM, Bc. Ji=C5=99=C3=AD Mikul=C3=A1=C5=A1ek wr=
ote:
> >>> Hi all,
> >>> can somebody give me a hint how to configure or program CRL
> >>> (certificate
> >>> revocation list) checking before each SSL handshake.
> >>>
> >>> In detail:
> >>> I have this configuration on client:
> >>> <http-conf:conduit
> >>> 		name=3D"{http://..../}portName.http-conduit">
> >>>
> >>> 		<http-conf:client AllowChunking=3D"false" />
> >>> 		<http-conf:tlsClientParameters secureSocketProtocol=3D"SSL">
> >>> 			<sec:trustManagers>
> >>> 	          		<sec:keyStore type=3D"JKS" password=3D"password"
> >>> 	               		url=3D"someurl"/>
> >>> 	      		</sec:trustManagers>
> >>> 			<sec:keyManagers keyPassword=3D"password">
> >>> 	          		<sec:keyStore type=3D"JKS" password=3D"password"
> >>> 	               		url=3D"someurl"/>
> >>>
> >>> 	  		</sec:keyManagers>
> >>> 		</http-conf:tlsClientParameters>
> >>>
> >>> which causes ssl communication, but before each connection I would
> >>> like to
> >>> check all certificates i keystores for revocation according some
> >>> CRL on
> >>> filesystem
> >>>
> >>>
> >>> thanks for any advice
> >>> --
> >>> Jiri Mikulasek
> >>> ---------------------------------
> >>> Developer
> >>>
> >>> AURA, s.r.o.
> >>> Uvoz 499/56; 602 00 Brno
> >>> ISO 9001 certified company
> >>> AQAP 2110 (=C4=8COS 051622)
> >>> tel./fax: +420 544 508 115
> >>> e-mail:  mikulasek@aura.cz
> >>> http://www.aura.cz
> >>> ---------------------------------


=2D-=20
Jiri Mikulasek
=2D--------------------------------
Developer

AURA, s.r.o.
Uvoz 499/56; 602 00 Brno
ISO 9001 certified company
AQAP 2110 (=C4=8COS 051622)
tel./fax: +420 544 508 115
e-mail: =C2=A0mikulasek@aura.cz
http://www.aura.cz
=2D--------------------------------