是否可以轻松地将客户端证书附加到使用 wsdl2java 生成的 Axis2 存根？我需要根据每个请求动态更改客户端证书，因此简单地将其存储在密钥库中不适用于我们的情况。
我找到了针对非 SOAP 调用执行此操作的示例，但找不到与使用 Axis 客户端存根相关的任何内容。我想，尝试破解 SOAP 调用的 XML 是一种选择，尽管这是一种痛苦的选择！呻吟！
Is it possible to easily attach a client certificate to a Axis2 stub generated using wsdl2java? I need to change the client certificate dynamically on a per-request basis, so simply storing it in the keystore won't work for our case.
I've found examples where this is being done for non-SOAP calls, but could not find anything related to using the Axis client stubs. Trying to hack the XML for the SOAP call is an option I guess, albiet a painful one! Groan!
发布评论
评论（1）
如果您想根据建立的连接更改使用哪个证书，则需要配置
SSLContext来执行此操作，如以下答案中所述：https://stackoverflow.com/a/3713147/372643据我所知，Axis 2 使用 Apache HttpClient 3.x，因此，您需要遵循其配置
SSLContext的方式（如果需要，还需要配置X509KeyManager）。最简单的方法可能是使用
SSLContext配置 Apache HttpClient 的全局https协议处理程序，并使用配置为选择客户端证书的X509KeyManager进行设置您需要（通过chooseClientAlias）。如果颁发者和连接的套接字（可能是远程地址）不足以决定选择哪个证书，您可能需要实现更复杂的逻辑，这几乎不可避免地需要与其余部分仔细同步。您的申请。
编辑：
构建
SSLContext和X509KeyManager后，您需要将它们传递给 Apache HttpClient 3.x。为此，您可以构建自己的 SecureProtocolSocketFactory，它将从此SSLContext构建套接字（通过SSLSocketFactory，请参阅SSLContext方法）。 Apache HttpClient 3.x SSL 指南中提供了示例。避免使用 EasySSLProtocolSocketFactory，因为它不会检查任何服务器证书（从而允许 MITM 攻击）。您还可以尝试 此实现。请注意，您只需要自定义您的
X509KeyManager，您可以使用null初始化您的SSLContext（通过init）其他参数保留默认值（特别是默认信任设置）。然后，使用如下所示为 Apache HttpClient 3.x 全局“安装”此
SecureProtocolSocketFactory：If you want to change which certificate is used depending on which connection is made, you'll need to configure an
SSLContextto do so, as described in this answer: https://stackoverflow.com/a/3713147/372643As far as I know, Axis 2 uses Apache HttpClient 3.x, so you'll need to follow its way of configuring the
SSLContext(andX509KeyManagerif needed).The easiest way might be to configure Apache HttpClient's global
httpsprotocol handler with yourSSLContext, set up with anX509KeyManagerconfigured to choose the client certificate as you require (viachooseClientAlias).If the issuers and the connected
Socket(probably the remote address) are not enough for deciding which certificate to choose, you may need to implement a more complex logic which will almost inevitably require careful synchronization with the rest of your application.EDIT:
Once you've built your
SSLContextandX509KeyManager, you need to pass them to Apache HttpClient 3.x. For this, you can build your own SecureProtocolSocketFactory, which will build the socket from thisSSLContext(via anSSLSocketFactory, seeSSLContextmethods). There are examples in the Apache HttpClient 3.x SSL guide. AvoidEasySSLProtocolSocketFactory, since it won't check any server cert (thereby allowing for MITM attacks). You could also try this implementation.Note that you only really need to customize your
X509KeyManager, you can initialize yourSSLContext(viainit) withnullfor the other parameters to keep the default values (in particular the default trust settings).Then, "install" this
SecureProtocolSocketFactoryglobally for Apache HttpClient 3.x using something like this: