4

Is there a way to "reload" the certificate truststore in JBoss 4.2 without restart?

I am trying to have an EJB call a web service on a remote server with ssl and am seeing a similar problem with SSLHandshakeException as in the article below. What we are attmepting to do is the following and involves three machines, A the JBoss server acting as a web service client to servers B and C.

1) On A, user enters in hostname for B. The machine on A obtains the self-signed certificate of B and installs it in the trust store (via an external shell script).

2) The SSL socket connection is made to B at which it point it seems the certificate store is loaded on this first attempt. The connection is successful and everything works.

3) Again on A, user does the same thing as in 2, the shell script obtains C's certificate and installs it to the trusstore. However, on the attmepted connection to C, it appears (by enabling javax.net.debug=ssl) that the truststore is not "reloaded" and it doesn't find C's certificate and we get SSLHandshakeException.

After restarting JBoss the "updated" truststore is loaded, and the connection to both B and C work.

Would like to do this without restarting JBoss and gather the above scheme isn't correct. If someone could point me to documentation for the correct way to dynamically update truststore it would be very much appreciated.

Problem calling web service from within JBOSS EJB Service

4

2 回答 2

1

这会解决你的问题吗?

http://docs.jboss.org/jbossas/javadoc/4.0.4/security/org/jboss/security/plugins/JaasSecurityDomainMBean.html#reloadKeyAndTrustStore ()

于 2010-12-11T06:27:29.627 回答
0

从安全角度来看,让一个 EJB 将自签名证书(在用户交互时)添加到 Jboss 范围内使用的信任库中并不是一个好主意。

更简洁的解决方案是让您的 Web 服务客户端使用自定义X509TrustManager实现或自定义SSLSocketFactory。在这两种情况下,您都可以自行决定信任哪个证书。这将允许您管理自己的信任库,该信任库仅对该 EJB 和相应的 WS 调用有效。

另见: http: //www.howardism.org/Technical/Java/SelfSignedCerts.html

于 2010-12-15T16:25:23.253 回答