Consuming SSL Web service with certificate using oracle SOA 12c

lately , we have received WSDL from client with SSL and certificate and we try to consume this  web service we have faced the following exception :

javax.xml.ws.WebServiceException: javax.net.ssl.SSLKeyException: Hostname verification failed

we quick solve this issue by the following steps :

Servers -> server name -> Configuration SSL tab -> Advanced -> Change Hostname Verification dropdown to None

then we face this exception :

sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

our understand was , we need to import certificate into weblogic keystror and  to do that we went to keystrore tab in weblogic to get the path of trust store and we surprised because the concept in 12c is different about 11g . in 11g you will see physical paths while in 12c became urls .

after some research we understood that we have to add the certificate to system\trust keystore from em

but the error did not change so we back to 11g concept and we try . the steps as follow :

• create key store using keytool
• import Root,intermediate,client certificate to this key store
• adding this commands to file set domainenv                                                                                        set JAVA_OPTIONS=%-Djavax.net.ssl.trustStore=fullpath -Djavax.net.ssl.trustStorepassword=yourpassword
• restart weblogic

and that's all !

Note : after we finish this solution we discovered oracle link that may help to solve first solution issue by the following :

1. Open FMW_HOME/user_projects/domains/WLS_SOA/bin/setDomainEnv.sh.
2. In EXTRA_JAVA_PROPERTIES:
   Replace:

   • -Djavax.net.ssl.trustStore=%WL_HOME%\server\lib\DemoTrust.jks

   With:

   • -Djavax.net.ssl.trustStore=kss://system/trust -Djavax.net.ssl.trustStoreType=kss

but i did not try it so i strongly advice to try this first before go to 11g approach .

Note2 : a i did not include keytool commands to create keystore and import certificate because it's available everywhere .

finally , i would like to thank my colleague Mohannad click here for his support .