SOAP 请求 - 忽略安全证书
我正在尝试访问位于 https://test.mydomain.com 的服务器上的 Web 服务。我使用低级 SOAP XML 来执行此操作。
不幸的是，该域只有自签名证书，当我访问该网页时，显示错误“请接受此安全证书”以继续。当我发送 SOAP 请求时，我收到了同样的错误消息。
我尝试研究一些有关安全性的 SOAP 标头信息，但我所能找到的只是如何附加 X509 证书。我想做的就是完全忽略/绕过它。
同样，我是在 XML 中执行此操作，因此我正在寻找类似的内容：
<soap:header>
<soap:certificate ignoreInvalid="true" />
</soap:header>
任何帮助将不胜感激，并感谢您的宝贵时间！
I'm trying to access a web service located on my server at https://test.mydomain.com. I'm using low level SOAP XML to do this.
Unfortunately, the domain only has a self-signed certificate, showing the error "Please accept this security certificate" to proceed when I go to the webpage. I'm getting that same error message when I send the SOAP request.
I've tried to research some SOAP header information regarding security, but all I can find is how to attach an X509 certificate. What I'd like to do, would be to completely ignore/bypass it.
Again, I'm doing this in XML so I'm looking for something along these lines:
<soap:header>
<soap:certificate ignoreInvalid="true" />
</soap:header>
Any help would be appreciated and thanks for your time!
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
您的源代码似乎丢失，如果发布一些代码，请使用“代码示例”按钮。
您不能忽略 SSL 中的服务器证书，必须将其添加到信任列表中。
your source code seems to be missing, use "Code Sample" button, if poste some code.
you can not ignore server certificate in SSL, you have to add it to trust list.
这与 SOAP 消息本身无关。它发生在 SSL/TLS 传输层。
因此，这不是通过在 SOAP 消息中放入任何内容来解决的。 SOAP 消息是相同的，无论它是使用自签名证书、受信任证书还是根本不使用此类安全性。
可以通过将自签名证书添加到客户端的受信任根证书集中来解决。该集合的位置取决于您的客户端的编写方式。如果是 Windows/.NET，则它将是 Windows 信任存储。如果是 Java，它将是一些密钥库文件。 FireFox 浏览器维护自己的信任存储区。
This has nothing to do with the SOAP message itself. It is happening at the SSL/TLS transport layer.
Therefore, it is not solved by putting anything in the SOAP message. The SOAP message is the same, regardless of whether it is using a self-signed certificate, a trusted certificate, or no such security at all.
It can be solved by adding the self-signed certificate to the client's set of trusted root certificates. Where that set lives depends on how your client is written. If it is Windows/.NET it will be the Windows trust store. If it is Java it will be some keystore file. The FireFox browser maintains its own trust store.