Securing Web Service Network Traffic With HTTPS/SSL

The use of HTTPS/SSL may be a part of your web services security strategy and details about setting this up are beyond the scope of this document; but, be aware that the use of HTTPS/SSL can be established in either of the following ways:

Application server environment - Setting this up is very specific to your particular application server, but essentially involves exporting the appropriate server certificates and making them available to your client environment.
Rampart WS-Security policy - There are a number of articles, etc. available on the Internet that cover this in more detail.

For client access the end point needs to reflect the protocol and port change, which can be done dynamically at runtime. For instance, client code like this can change the endpoint:

Figure 1. Example of Dynamically Changing the Web Service End Point

// stub is a previously obtained service stub.
  // nHttpsPort is an integer identifying the HTTPS port of
  //   your application server.
  // serviceName is a String identifying the service name.

  ServiceClient client = stub._getServiceClient();

  // Get the end point of the service and convert it to a URL
  final Options options = stub._getServiceClient().getOptions();
  final EndpointReference eprTo = options.getTo();
  final URL urlOriginal = new URL(eprTo.getAddress());

  // Use that URL, plus our service name to construct
  // a new end point.
  final URL urlNew = new URL("https", urlOriginal.getHost(),
    nHttpsPort,
    "/CuramWS2/services/" + serviceName);
  client.setTargetEPR(new EndpointReference(urlNew.toString()));

Your client will need to identify the keystore and password that contains the necessary certificates; e.g.:

System.setProperty("javax.net.ssl.trustStore",
          "C:/keys/server.jks");
        System.setProperty("javax.net.ssl.trustStorePassword",
          "password");

Otherwise, client coding for HTTPS is similar to that of HTTP.

Note: In a WebSphere environment the SSL socket classes are not available by default and you may experience this error:

org.apache.axis2.AxisFault: java.lang.ClassNotFoundException:
   Cannot find the specified class
   com.ibm.websphere.ssl.protocol.SSLSocketFactory

And you should be able to resolve this error with code like this:

Security.setProperty("ssl.SocketFactory.provider",
      "com.ibm.jsse2.SSLSocketFactoryImpl");
    Security.setProperty("ssl.ServerSocketFactory.provider",
      "com.ibm.jsse2.SSLServerSocketFactoryImpl");