Steps to create P12 from PEM file and PEM key Using OpenSSL

OpenSSL> rsa -in uat.key.pem -out uat.key
Enter pass phrase for uat.key.pem:
writing RSA key
OpenSSL> pkcs12 -export -out keystore.pkcs12 -in uat_tls_rp.pem -inkey uat.key
Loading 'screen' into random state - done
Enter Export Password:
Verifying - Enter Export Password:
OpenSSL> exit

From P12 to JKS using Jetty :

C:\CFC>java -cp C:\openssl-0.9.8h-1-bin\bin\jetty-6.1.1.jar org.mortbay.jetty.security.PKCS12Import gtbtest.pkcs12 Test_keystore.jks
Enter input keystore passphrase: global12
Enter output keystore passphrase: global12
Alias 0: 1
Adding key for alias 1

java.lang.ClassCastException: weblogic.net.http.SOAPHttpsURLConnection - Weblogic

While making a HTTP(s) connection to external resource from weblogic server following exception comes because underline API uses weblogic implemntation ..

Caught Exception creating connection: java.lang.ClassCastException: weblogic.net.http.SOAPHttpsURLConnection

to avoid this problem ..

set following flag in the JVM args ..

-DUseSunHttpHandler=true

It will prefer to use sun implementation..

How to read cert from trust store (jks) and use for TLS check with HttpsURLConnection

Following code can help to create SSLSocketfactory for trusted cert by reading custom JKS (If you don't want to put cert in default trust store(cacrets) or don't want to set java system property).

This piece of code will be specific to your application and will not affect other applications if running in same JVM ...

private static String trustStorePasswd = "pass123";
private static String keyfactoryAlgorithm = "SunX509";
private static String sslContextProtocol = "SSL";

SSLContext sslCtx = SSLContext.getInstance(sslContextProtocol);

String sslTrustStore = "./setup/mytrust.jks"; // trust store file

// Create TrustManager
KeyStore trustKs = KeyStore.getInstance("JKS");
trustKs.load(new FileInputStream(sslTrustStore),
trustStorePasswd.toCharArray());
trustKs.load(is,
trustStorePasswd.toCharArray());

TrustManagerFactory tmf = TrustManagerFactory
.getInstance(keyfactoryAlgorithm);

tmf.init(trustKs);

sslCtx.init(null ,tmf.getTrustManagers(), null);

SSLSocketFactory socketFactory = sslCtx.getSocketFactory();


Now next step is to set socket factory into HttpsURLconnection :
HttpsURLconnection httpsconnections;
URL url = new URL("https://mysite.com:3434");
httpsconnections = (HttpsURLConnection) url.openConnection();
httpsconnections.setSSLSocketFactory(socketFactory);

now ur java code is ready to open connection to site and to use .. :)

cheers

Code to Disabling Certificate Validation in an HTTPS Connection HTTPSURLConnection

By default, accessing an HTTPS URL using the URL class results in an exception if the server's certificate chain cannot be validated has not previously been installed in the truststore. If you want to disable the validation of certificates for testing purposes, you need to override the default trust manager with one that trusts all certificates.

// Create a trust manager that does not validate certificate chains
TrustManager[] trustAllCerts = new TrustManager[]{
new X509TrustManager() {
public java.security.cert.X509Certificate[] getAcceptedIssuers() {
return null;
}
public void checkClientTrusted(
java.security.cert.X509Certificate[] certs, String authType) {
}
public void checkServerTrusted(
java.security.cert.X509Certificate[] certs, String authType) {
}
}
};

// Install the all-trusting trust manager
try {
SSLContext sc = SSLContext.getInstance("SSL");
sc.init(null, trustAllCerts, new java.security.SecureRandom());
HttpsURLConnection.setDefaultSSLSocketFactory(sc.getSocketFactory());
} catch (Exception e) {
}

// Now you can access an https URL without having the certificate in the truststore
try {
URL url = new URL("https://hostname/index.html");
} catch (MalformedURLException e) {
}

command to verify pem file from existing utility of weblogic

Following way we can verify cert chain in pem file using weblogic utility :

java -cp C:/weblogic8Lib/weblogic.jar utils.ValidateCertChain -pem mysecure.pem
Certificate chain is invalid

Default key store information for weblogic

If you are connecting to the server you need to know where the key stores live, so here is a table with all the default values in:

Property	Value
Trust store location	%ORACLE_HOME%/weblogic/wlserver_10.3/ server/lib/DemoTrust.jks
Trust store password	DemoTrustKeyStorePassPhrase
Key store location	%ORACLE_HOME%/weblogic/wlserver_10.3/ server/lib/DemoIdentity.jks
Key store password	DemoIdentityKeyStorePassPhrase
Private key password	DemoIdentityPassPhrase

Sample import command :

C:\bea\wlserver_10.0\server\lib>keytool -import -alias local -file C:\SMS\cert\
local-ssl.cer -keystore DemoTrust.jks -storepass DemoTrustKeyStorePassPhrase

SSL debug JVM arguments for weblogic

set these arguments in setDomainEnv.cmd file in the variable JAVA_PROPETIES =

-Dssl.debug=true
-Dweblogic.webservice.client.verbose=true
-Dweblogic.security.SSL.verbose=true
-Dweblogic.StdoutDebugEnabled=true
-Dweblogic.webservice.binding.verbose=true

It will give you more help to debug SSL errors during webservice call on secure connections

And if using javax.net package for SSL then following args is help full :

javax.net.debug=all