Appreciate your valuable feedback.

You’ve laid out your options nicely. One and four are essentially the same, though. If validation is an issue in #4 you could always use your own validator.

Any of your options will work but there are two other possibilities to consider. The first is to map users to groups and groups to roles. Protect your web service using the roles and then only users in your group are authorized to use the web service. That would solve the anybody-signed-by-the-CA-has-access problem.

The other option is to have a look at WebLogic’s built-in certificate registry. It’s like a reverse CRL lookup in that only certificates present in the registry are accepted. Here’s a snippet from the WLS docs:

“The WebLogic Server Certificate Registry is an out-of-the-box CertPath provider that allows the administrator to configure a list of trusted end certificates via the Administration Console. The Certificate Registry is a builder/validator. The selection criteria can be EndCertificateSelector, SubjectDNSelector, IssuerDNSerialNumberSelector, or SubjectKeyIdentifier. The certificate chain that is returned has only the end certificate. When it validates a chain, it makes sure only that the end certificate is registered; no further checking is done.”

So, really, I think your decision comes down to how do you want to administer users? Adding certs to trust stores requires file system access while a WLS admin can add a user to the registry or a group via WLS Console. If you use an external user store you’d add/remove users as appropriate for the product.

HTH,

Mike

What is the best approach for restricting access to your webservice to specific clients only? There seem to be a few options, some more restrictive than others:

1. Clients use self-signed certs. They share their self-signed certs with us out-of-band and we import them into our truststore. We remove all other certs (CAs, intermediaries) from our truststore, so now only those clients can connect whose end-entity, self-signed certs are in our truststore.

2. client uses a CA-signed cert. We add the CA to our trust store (if it’s not already there by default). But now anyone with a cert issued by that CA can connect. This is the most basic option.

3. Our internal CA signs the client’s cert. (The clients submit the CSR to our CA.) Our truststore contains only our internal CA’s cert. So now only those clients can connect that have certs issued by our CA.

4. The client uses a cert issued by another CA. We add the client’s end-entity cert into our truststore. The truststore doesn’t contain any CA/intermediary certs, it contains only client end-entity certs. Would this even work when our service performs cert path validation, as the end-entity issuing CA certs will not be in our truststore?

Any suggestions would be appreciated. Thanks!

You’ll get that error unless the CN for your certificate happens to be “localhost” which it is not. Basically, it’s working as it should. The browser is warning you that while you requested website “localhost,” the site presented its ID as “abc.com” or whatever your certificate’s CN is.

To make the error go away you can add an exception (which you normally wouldn’t want to do) or use DNS to route “abc.com” to the machine where you’re running WebLogic. Then, you can go to https://abc.com:7002/console and the browser won’t complain.

HTH,

Mike

Security certificate problems may indicate an attempt to fool you or intercept any data you send to the server.”
—————————
No warnings display in the console as well
could you please help me on this?

Thanks,
asi

Yes, each client needs a certificate to present to the web service. They could even be the same certificate if you wish. It doesn’t matter as long as the web service trusts the signer of the client cert.

DNS doesn’t matter for the client certificate. In fact, in the article the client certificate is for a user named “Spongebob.” However, a server could have its own certificate such as “bank.com.” It’s very common for middleware to use such certs for client authentication to other services.

HTH,

Mike

if I have two java runtime (exactly duplicate), but in different servers, trying to access a web service using mutual SSL.

1> do I need DNS name for my client runtime – or I could just give my client any name I like;
2> do I need to have a certificate for each of my client runtime?

Thanks

Thanks for the encouragement!

Your question inspired me to write “Certificate to User Mapping in WebLogic” (http://monduke.com/2009/05/12/certificate-to-user-mapping-in-weblogic/).

Thanks, and feel free to comment either here or there if I didn’t answer your question.

To my knowledge, the 8.1 plugin doesn’t support two-way SSL. I don’t know about WLS 9.x.

thanks.