[CONF] Apache CXF Documentation > Client HTTP Transport (including SSL support)

[confluence-2]

Client HTTP Transport (including SSL support)

Page commented by Jared Knipp

It should be noted the cipher suites used in your default example will not work with SSL servers that require a higher level of cipher suites, i.e. stronger encryption. I found this out the hard way when a third party server moved from what appeared to be an Apache 1.3 http server to Apache 2.x.

The previous web service endpoint using the example cipher suite filters allowed me to communicate using a dual authentication method where I had to export the endpoint public certificate located in my trust store. When the server / data center change occurred, I could no longer connect as before even after updating the certificate. I received a the following error:

 
2009-10-30 19:37:37:745 INFO  [pool-2-thread-4] [PhaseInterceptorChain] - Interceptor has thrown exception, unwinding now
org.apache.cxf.interceptor.Fault: Could not send Message.
....
Caused by: javax.net.ssl.SSLHandshakeException: Received fatal alert: handshake_failure

Later I found out that the new server expected to communicate over a 3DES SSL cipher suite because the new Apache configuration was set to use strong encryption (see encryption http://httpd.apache.org/docs/2.2/ssl/ssl_howto.html).

 
<!-- 
  Cipher suites filters specify the cipher suite to allow/disallow in SSL communcation  
  Please make sure the server can communicate over the included cipher suites or you may
  experience a handshake_failure.
 -->
<sec:cipherSuitesFilter>
  <sec:include>.*{_}WITH_3DES{_}{*}*.*</sec:include>
  <sec:include>.*{_}EXPORT{_}{*}*.*</sec:include>
  <sec:include>.*{_}EXPORT1024{_}{*}*.*</sec:include>
  <sec:include>.*{_}WITH_DES{_}{*}*.*</sec:include>
  <sec:exclude>.*{_}WITH_NULL{_}{*}*.*</sec:exclude>
  <sec:exclude>.*{_}DH_anon{_}{*}*.*</sec:exclude>
</sec:cipherSuitesFilter>

Change Notification Preferences

View Online | Reply To This