Menu
▾
▴
ebxmlms-general — General discussions
You can subscribe to this list here.
| 2002 |
Jan
|
Feb
|
Mar
|
Apr
|
May
|
Jun
|
Jul
|
Aug
(1) |
Sep
|
Oct
(20) |
Nov
(11) |
Dec
(27) |
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| 2003 |
Jan
(11) |
Feb
(8) |
Mar
(17) |
Apr
(11) |
May
(9) |
Jun
(30) |
Jul
(18) |
Aug
|
Sep
(4) |
Oct
(34) |
Nov
(83) |
Dec
(28) |
| 2004 |
Jan
(4) |
Feb
|
Mar
(13) |
Apr
(20) |
May
(4) |
Jun
(26) |
Jul
(5) |
Aug
(2) |
Sep
(3) |
Oct
(7) |
Nov
(10) |
Dec
(24) |
| 2005 |
Jan
(7) |
Feb
(44) |
Mar
(9) |
Apr
(16) |
May
(9) |
Jun
(64) |
Jul
(48) |
Aug
(36) |
Sep
(27) |
Oct
(24) |
Nov
(20) |
Dec
(11) |
| 2006 |
Jan
(12) |
Feb
(13) |
Mar
(7) |
Apr
|
May
(16) |
Jun
(5) |
Jul
(2) |
Aug
(7) |
Sep
(19) |
Oct
(5) |
Nov
(9) |
Dec
(13) |
| 2007 |
Jan
(21) |
Feb
(12) |
Mar
(6) |
Apr
|
May
(2) |
Jun
(14) |
Jul
(1) |
Aug
(1) |
Sep
(1) |
Oct
(1) |
Nov
|
Dec
|
| 2008 |
Jan
|
Feb
(1) |
Mar
(2) |
Apr
(5) |
May
(2) |
Jun
(1) |
Jul
(6) |
Aug
|
Sep
(9) |
Oct
(3) |
Nov
(25) |
Dec
(32) |
| 2009 |
Jan
(11) |
Feb
(12) |
Mar
(18) |
Apr
(19) |
May
(31) |
Jun
(23) |
Jul
(35) |
Aug
(7) |
Sep
(2) |
Oct
|
Nov
|
Dec
(8) |
| 2010 |
Jan
(3) |
Feb
(3) |
Mar
(3) |
Apr
|
May
|
Jun
|
Jul
(1) |
Aug
(1) |
Sep
(1) |
Oct
(1) |
Nov
|
Dec
|
| 2013 |
Jan
|
Feb
|
Mar
|
Apr
|
May
|
Jun
|
Jul
|
Aug
|
Sep
|
Oct
|
Nov
(1) |
Dec
|
| 2016 |
Jan
|
Feb
|
Mar
|
Apr
|
May
(1) |
Jun
|
Jul
|
Aug
|
Sep
|
Oct
|
Nov
|
Dec
|
|
From: Tanveer, A. \(NIH/OD\) [C] <tan...@od...> - 2006-05-19 13:05:13
|
Ladislav, =20 Thanks for all the help. Your suggestions earlier did help. We have = complete SSL communication now between 2 Hermes servers running on OC4J = and Tomcat. There was some confusion between the property files that = OC4J/Tomcat and Hermes exposes. The configurations needed to be in sync. = =20 Thanks -- Ashique =20 =20 ________________________________ From: David RR Webber (XML) [mailto:da...@dr...]=20 Sent: Friday, May 19, 2006 9:00 AM To: ebx...@li... Cc: Tanveer, Ashique (NIH/OD) [C] Subject: RE: [FWD: RE: [ebxmlms-general] Configuring SSL and Hermes - = step by step Guide] =20 Ladislav, =20 OK - quick update - we now have this all fully working - many thanks for = the hints and help - it all contributed to figuring out all the various = parts. =20 We should be going into pre-production testing next week - and at that = point we can share the installation documentation public link once its = live with details of all that is needed to get this setup. =20 Thanks, DW =20 -------- Original Message -------- Subject: RE: [FWD: RE: [ebxmlms-general] Configuring SSL and Hermes - step by step Guide] From: Ladislav Urban <lad...@we...> Date: Thu, May 18, 2006 10:30 pm To: ebxmlms-general <ebx...@li...>, "Tanveer, Ashique (NIH/OD) [C]" <tan...@od...> =09 Could you please write detail error message from logs? =09 =09 On Mon, 2006-05-15 at 16:54 -0400, Tanveer, Ashique (NIH/OD) [C] wrote: > Ladislav, >=20 > =20 >=20 > Will you be able to send me your complete msh_properties.xml file and > also tell me if using the NullHostVerifier is enough to turn off host > verification. >=20 > I keep getting the error: Hostname should be <120.123.134.111> >=20 > =20 >=20 > Any help will be hugely appreciated. >=20 > Thanks so much in advance >=20 > =20 >=20 > = |------------------------------------------------------------------------= ----------- >=20 > | Ashique Tanveer >=20 > | Booz | Allen | Hamilton >=20 > | >=20 > | Contractor, eRA Project, National Institute Of Health >=20 > | Off: 301-451-1772 | Fax: 925-889-3635 >=20 > | Email: tan...@od..., tan...@ba...=20 >=20 > = |------------------------------------------------------------------------= ----------- >=20 >=20 > =20 > = ______________________________________________________________________ > From: David RR Webber (XML) [mailto:da...@dr...]=20 > Sent: Monday, May 15, 2006 8:41 AM > To: Tanveer, Ashique (NIH/OD) [C] > Subject: [FWD: RE: [ebxmlms-general] Configuring SSL and Hermes - = step > by step Guide] >=20 >=20 > =20 >=20 > =20 >=20 > =20 > =20 > -------- Original Message -------- > Subject: RE: [ebxmlms-general] Configuring SSL and Hermes - > step by > step Guide > From: Ladislav Urban <lad...@we...> > Date: Mon, May 08, 2006 3:25 pm > To: ebx...@li... > =20 > Hello Ashique, > we use SSL configuration for hermes. You can set it up the > same way as > for tomcat.=20 > Are you going to use selfsigned certs? > =20 > 1st Step > create generate keys in keystores of both tomcats. The = kystore > is > usually in root directory of the tomcat and its name > is .keystore > =20 > example: > keytool -genkey -keyalg "RSA" -dname "cn=3Dcompany1, = ou=3Dcompany, > o=3Dcompany1, c=3DUS" -keystore ./.keystore -alias tomcat = -keypass > password222 -storepass password222 > =20 > =20 > 2nd Step: > =20 > Configuration of msh.properties.xml > <SSL> > =20 > = <HostnameVerifier>com.webswell.hermes.NullHostVerifier</HostnameVerifier>= > <TrustedAnchor> > <!-- Trust keystore for SSL Server Authentication --> > <KeyStore> > <Path>/usr/local/Webswell/jakarta-tomcat</Path> > <File>.keystore</File> > <Password>password222</Password> > </KeyStore> > </TrustedAnchor> > <ClientAuth> > <URL></URL> > <KeyStore> > <Path></Path> > <File></File> > <Alias></Alias> > <Password></Password> > </KeyStore> > </ClientAuth> > </SSL> > =20 > =20 > As you can see we do have null host verifier. It switch off > verification > of host name in http request against host name in = credentials. > I can > send you the java code. > =20 > 3rd Step=20 > =20 > Export public part of the generated keys from both keystores. > This will > create the selfsigned certificate files. > keytool -export -alias tomcat -keystore ./.keystore > -storepass > password222 -file ./company1.cer > =20 > =20 > and import the certificates to the opposite keystore. > =20 > Ladislav=20 > =20 > On Mon, 2006-05-08 at 12:53 -0400, Tanveer, Ashique (NIH/OD) > [C] wrote: > > =20 > >=20 > > I guess I am looking for something like a = =C3=A2=E2'=AC=C5"SSL > configuration with > > Hermes for dummies=C3=A2=E2'=AC=C2=9D. Assuming I have two = Hermes server > running on > > Tomcat server, what are the steps (generate the = certificate, > keystore > > etc,?) to have both Hermes communicate via SSL. I assume > some > > configuration needed on the tomcat as well as hermes > properties files? > > Any tips would help. > >=20 > > =20 > >=20 > > Thanks > >=20 > > -- Ashique > >=20 > > =20 > >=20 > > > = |------------------------------------------------------------------------= ----------- > >=20 > > | Ashique Tanveer > >=20 > > | Booz | Allen | Hamilton > >=20 > > | > >=20 > > | Contractor, eRA Project, National Institute Of Health > >=20 > > | Off: 301-451-1772 | Fax: 925-889-3635 > >=20 > > | Email: tan...@od..., tan...@ba...=20 > >=20 > > > = |------------------------------------------------------------------------= ----------- > >=20 > >=20 > > =20 > > > = ______________________________________________________________________ > > From: David RR Webber (XML) [mailto:da...@dr...]=20 > > Sent: Monday, May 08, 2006 12:33 PM > > To: ebx...@li... > > Subject: [ebxmlms-general] Configuring SSL and Hermes - = step > by step > > Guide > >=20 > >=20 > > =20 > >=20 > > Team, > >=20 > >=20 > > =20 > >=20 > >=20 > > Does anyone have any notes they can share on setting up > Hermes <-> > > Hermes using SSL? > >=20 > >=20 > > =20 > >=20 > >=20 > > The Hermes docs are not forthcoming on this - so would be > helpful to > > have something available. > >=20 > >=20 > > =20 > >=20 > >=20 > > More to the point - if you succeeded in getting this = working > - can you > > share the steps you=20 > >=20 > >=20 > > had to go thru?! > >=20 > >=20 > > =20 > >=20 > >=20 > > Thanks, DW > >=20 > >=20 > > ------------------------------------------------------- > Using Tomcat > > but need to do more? Need to support web services, = security? > Get stuff > > done quickly with pre-integrated technology to make your = job > easier > > Download IBM WebSphere Application Server v.1.0.1 based on > Apache > > Geronimo > > > = http://sel.as-us.falkag.net/sel?cmd=3Dlnk&kid=3D120709&bid=3D263057&dat=3D= 121642 _______________________________________________ ebxmlms-general = mailing list ebx...@li... = https://lists.sourceforge.net/lists/listinfo/ebxmlms-general=20 > >=20 > >=20 > --=20 > Ladislav Urban > CEO > Webswell Inc. > 1333 Howe Avenue, Suite 100 > Sacramento, 95825 CA > email: lad...@we... > phone: +1 (916) 290-2040 > fax: +1 (916) 921-2850 > http://www.webswell.com > =20 > =20 > =20 > ------------------------------------------------------- > Using Tomcat but need to do more? Need to support web > services, security? > Get stuff done quickly with pre-integrated technology to make > your job easier > Download IBM WebSphere Application Server v.1.0.1 based on > Apache Geronimo > = http://sel.as-us.falkag.net/sel?cmd=3Dlnk&kid=3D120709&bid=3D263057&dat=3D= 121642 > _______________________________________________ > ebxmlms-general mailing list > ebx...@li... > https://lists.sourceforge.net/lists/listinfo/ebxmlms-general=20 > =20 --=20 Ladislav Urban CEO Webswell Inc. 1333 Howe Avenue, Suite 100 Sacramento, 95825 CA email: lad...@we... phone: +1 (916) 290-2040 fax: +1 (916) 921-2850 http://www.webswell.com =09 =09 =09 ------------------------------------------------------- Using Tomcat but need to do more? Need to support web services, = security? Get stuff done quickly with pre-integrated technology to make your job = easier Download IBM WebSphere Application Server v.1.0.1 based on Apache = Geronimo = http://sel.as-us.falkag.net/sel?cmd=3Dlnk&kid=3D120709&bid=3D263057&dat=3D= 121642 _______________________________________________ ebxmlms-general mailing list ebx...@li... https://lists.sourceforge.net/lists/listinfo/ebxmlms-general=20 |
|
From: David RR W. \(XML\) <da...@dr...> - 2006-05-19 13:00:37
|
<div>Ladislav,</div> <div> </div> <div>OK - quick update - we now have this all fully working - many thanks for the hints and help - it all contributed to figuring out all the various parts.</div> <div> </div> <div>We should be going into pre-production testing next week - and at that point we can share the installation documentation public link once its live with details of all that is needed to get this setup.</div> <div> </div> <div>Thanks, DW<BR></div> <DIV id=wmMessageComp name="wmMessageComp"><BR><BR> <BLOCKQUOTE style="PADDING-LEFT: 8px; MARGIN-LEFT: 8px; BORDER-LEFT: blue 2px solid">-------- Original Message --------<BR>Subject: RE: [FWD: RE: [ebxmlms-general] Configuring SSL and Hermes -<BR>step by step Guide]<BR>From: Ladislav Urban <lad...@we...><BR>Date: Thu, May 18, 2006 10:30 pm<BR>To: ebxmlms-general <ebx...@li...>, "Tanveer,<BR>Ashique (NIH/OD) [C]" <tan...@od...><BR><BR>Could you please write detail error message from logs?<BR><BR><BR>On Mon, 2006-05-15 at 16:54 -0400, Tanveer, Ashique (NIH/OD) [C] wrote:<BR>> Ladislav,<BR>> <BR>> <BR>> <BR>> Will you be able to send me your complete msh_properties.xml file and<BR>> also tell me if using the NullHostVerifier is enough to turn off host<BR>> verification.<BR>> <BR>> I keep getting the error: Hostname should be <120.123.134.111><BR>> <BR>> <BR>> <BR>> Any help will be hugely appreciated.<BR>> <BR>> Thanks so much in advance<BR>> <BR>> <BR>> <BR>> |-----------------------------------------------------------------------------------<BR>> <BR>> | Ashique Tanveer<BR>> <BR>> | Booz | Allen | Hamilton<BR>> <BR>> |<BR>> <BR>> | Contractor, eRA Project, National Institute Of Health<BR>> <BR>> | Off: 301-451-1772 | Fax: 925-889-3635<BR>> <BR>> | Email: tan...@od..., tan...@ba... <BR>> <BR>> |-----------------------------------------------------------------------------------<BR>> <BR>> <BR>> <BR>> ______________________________________________________________________<BR>> From: David RR Webber (XML) [mailto:da...@dr...] <BR>> Sent: Monday, May 15, 2006 8:41 AM<BR>> To: Tanveer, Ashique (NIH/OD) [C]<BR>> Subject: [FWD: RE: [ebxmlms-general] Configuring SSL and Hermes - step<BR>> by step Guide]<BR>> <BR>> <BR>> <BR>> <BR>> <BR>> <BR>> <BR>> <BR>> -------- Original Message --------<BR>> Subject: RE: [ebxmlms-general] Configuring SSL and Hermes -<BR>> step by<BR>> step Guide<BR>> From: Ladislav Urban <lad...@we...><BR>> Date: Mon, May 08, 2006 3:25 pm<BR>> To: ebx...@li...<BR>> <BR>> Hello Ashique,<BR>> we use SSL configuration for hermes. You can set it up the<BR>> same way as<BR>> for tomcat. <BR>> Are you going to use selfsigned certs?<BR>> <BR>> 1st Step<BR>> create generate keys in keystores of both tomcats. The kystore<BR>> is<BR>> usually in root directory of the tomcat and its name<BR>> is .keystore<BR>> <BR>> example:<BR>> keytool -genkey -keyalg "RSA" -dname "cn=company1, ou=company,<BR>> o=company1, c=US" -keystore ./.keystore -alias tomcat -keypass<BR>> password222 -storepass password222<BR>> <BR>> <BR>> 2nd Step:<BR>> <BR>> Configuration of msh.properties.xml<BR>> <SSL><BR>> <BR>> <HostnameVerifier>com.webswell.hermes.NullHostVerifier</HostnameVerifier><BR>> <TrustedAnchor><BR>> <!-- Trust keystore for SSL Server Authentication --><BR>> <KeyStore><BR>> <Path>/usr/local/Webswell/jakarta-tomcat</Path><BR>> <File>.keystore</File><BR>> <Password>password222</Password><BR>> </KeyStore><BR>> </TrustedAnchor><BR>> <ClientAuth><BR>> <URL></URL><BR>> <KeyStore><BR>> <Path></Path><BR>> <File></File><BR>> <Alias></Alias><BR>> <Password></Password><BR>> </KeyStore><BR>> </ClientAuth><BR>> </SSL><BR>> <BR>> <BR>> As you can see we do have null host verifier. It switch off<BR>> verification<BR>> of host name in http request against host name in credentials.<BR>> I can<BR>> send you the java code.<BR>> <BR>> 3rd Step <BR>> <BR>> Export public part of the generated keys from both keystores.<BR>> This will<BR>> create the selfsigned certificate files.<BR>> keytool -export -alias tomcat -keystore ./.keystore<BR>> -storepass<BR>> password222 -file ./company1.cer<BR>> <BR>> <BR>> and import the certificates to the opposite keystore.<BR>> <BR>> Ladislav <BR>> <BR>> On Mon, 2006-05-08 at 12:53 -0400, Tanveer, Ashique (NIH/OD)<BR>> [C] wrote:<BR>> > <BR>> > <BR>> > I guess I am looking for something like a “SSL<BR>> configuration with<BR>> > Hermes for dummies”. Assuming I have two Hermes server<BR>> running on<BR>> > Tomcat server, what are the steps (generate the certificate,<BR>> keystore<BR>> > etc,?) to have both Hermes communicate via SSL. I assume<BR>> some<BR>> > configuration needed on the tomcat as well as hermes<BR>> properties files?<BR>> > Any tips would help.<BR>> > <BR>> > <BR>> > <BR>> > Thanks<BR>> > <BR>> > -- Ashique<BR>> > <BR>> > <BR>> > <BR>> ><BR>> |-----------------------------------------------------------------------------------<BR>> > <BR>> > | Ashique Tanveer<BR>> > <BR>> > | Booz | Allen | Hamilton<BR>> > <BR>> > |<BR>> > <BR>> > | Contractor, eRA Project, National Institute Of Health<BR>> > <BR>> > | Off: 301-451-1772 | Fax: 925-889-3635<BR>> > <BR>> > | Email: tan...@od..., tan...@ba... <BR>> > <BR>> ><BR>> |-----------------------------------------------------------------------------------<BR>> > <BR>> > <BR>> > <BR>> ><BR>> ______________________________________________________________________<BR>> > From: David RR Webber (XML) [mailto:da...@dr...] <BR>> > Sent: Monday, May 08, 2006 12:33 PM<BR>> > To: ebx...@li...<BR>> > Subject: [ebxmlms-general] Configuring SSL and Hermes - step<BR>> by step<BR>> > Guide<BR>> > <BR>> > <BR>> > <BR>> > <BR>> > Team,<BR>> > <BR>> > <BR>> > <BR>> > <BR>> > <BR>> > Does anyone have any notes they can share on setting up<BR>> Hermes <-><BR>> > Hermes using SSL?<BR>> > <BR>> > <BR>> > <BR>> > <BR>> > <BR>> > The Hermes docs are not forthcoming on this - so would be<BR>> helpful to<BR>> > have something available.<BR>> > <BR>> > <BR>> > <BR>> > <BR>> > <BR>> > More to the point - if you succeeded in getting this working<BR>> - can you<BR>> > share the steps you <BR>> > <BR>> > <BR>> > had to go thru?!<BR>> > <BR>> > <BR>> > <BR>> > <BR>> > <BR>> > Thanks, DW<BR>> > <BR>> > <BR>> > -------------------------------------------------------<BR>> Using Tomcat<BR>> > but need to do more? Need to support web services, security?<BR>> Get stuff<BR>> > done quickly with pre-integrated technology to make your job<BR>> easier<BR>> > Download IBM WebSphere Application Server v.1.0.1 based on<BR>> Apache<BR>> > Geronimo<BR>> ><BR>> http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642 _______________________________________________ ebxmlms-general mailing list ebx...@li... https://lists.sourceforge.net/lists/listinfo/ebxmlms-general <BR>> > <BR>> > <BR>> -- <BR>> Ladislav Urban<BR>> CEO<BR>> Webswell Inc.<BR>> 1333 Howe Avenue, Suite 100<BR>> Sacramento, 95825 CA<BR>> email: lad...@we...<BR>> phone: +1 (916) 290-2040<BR>> fax: +1 (916) 921-2850<BR>> http://www.webswell.com<BR>> <BR>> <BR>> <BR>> -------------------------------------------------------<BR>> Using Tomcat but need to do more? Need to support web<BR>> services, security?<BR>> Get stuff done quickly with pre-integrated technology to make<BR>> your job easier<BR>> Download IBM WebSphere Application Server v.1.0.1 based on<BR>> Apache Geronimo<BR>> http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642<BR>> _______________________________________________<BR>> ebxmlms-general mailing list<BR>> ebx...@li...<BR>> https://lists.sourceforge.net/lists/listinfo/ebxmlms-general <BR>> <BR>-- <BR>Ladislav Urban<BR>CEO<BR>Webswell Inc.<BR>1333 Howe Avenue, Suite 100<BR>Sacramento, 95825 CA<BR>email: lad...@we...<BR>phone: +1 (916) 290-2040<BR>fax: +1 (916) 921-2850<BR>http://www.webswell.com<BR><BR><BR><BR>-------------------------------------------------------<BR>Using Tomcat but need to do more? Need to support web services, security?<BR>Get stuff done quickly with pre-integrated technology to make your job easier<BR>Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo<BR>http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642<BR>_______________________________________________<BR>ebxmlms-general mailing list<BR>ebx...@li...<BR>https://lists.sourceforge.net/lists/listinfo/ebxmlms-general </BLOCKQUOTE></DIV> |
|
From: Ladislav U. <lad...@we...> - 2006-05-19 02:33:34
|
Could you please write detail error message from logs? On Mon, 2006-05-15 at 16:54 -0400, Tanveer, Ashique (NIH/OD) [C] wrote: > Ladislav, > > > > Will you be able to send me your complete msh_properties.xml file and > also tell me if using the NullHostVerifier is enough to turn off host > verification. > > I keep getting the error: Hostname should be <120.123.134.111> > > > > Any help will be hugely appreciated. > > Thanks so much in advance > > > > |----------------------------------------------------------------------------------- > > | Ashique Tanveer > > | Booz | Allen | Hamilton > > | > > | Contractor, eRA Project, National Institute Of Health > > | Off: 301-451-1772 | Fax: 925-889-3635 > > | Email: tan...@od..., tan...@ba... > > |----------------------------------------------------------------------------------- > > > > ______________________________________________________________________ > From: David RR Webber (XML) [mailto:da...@dr...] > Sent: Monday, May 15, 2006 8:41 AM > To: Tanveer, Ashique (NIH/OD) [C] > Subject: [FWD: RE: [ebxmlms-general] Configuring SSL and Hermes - step > by step Guide] > > > > > > > > > -------- Original Message -------- > Subject: RE: [ebxmlms-general] Configuring SSL and Hermes - > step by > step Guide > From: Ladislav Urban <lad...@we...> > Date: Mon, May 08, 2006 3:25 pm > To: ebx...@li... > > Hello Ashique, > we use SSL configuration for hermes. You can set it up the > same way as > for tomcat. > Are you going to use selfsigned certs? > > 1st Step > create generate keys in keystores of both tomcats. The kystore > is > usually in root directory of the tomcat and its name > is .keystore > > example: > keytool -genkey -keyalg "RSA" -dname "cn=company1, ou=company, > o=company1, c=US" -keystore ./.keystore -alias tomcat -keypass > password222 -storepass password222 > > > 2nd Step: > > Configuration of msh.properties.xml > <SSL> > > <HostnameVerifier>com.webswell.hermes.NullHostVerifier</HostnameVerifier> > <TrustedAnchor> > <!-- Trust keystore for SSL Server Authentication --> > <KeyStore> > <Path>/usr/local/Webswell/jakarta-tomcat</Path> > <File>.keystore</File> > <Password>password222</Password> > </KeyStore> > </TrustedAnchor> > <ClientAuth> > <URL></URL> > <KeyStore> > <Path></Path> > <File></File> > <Alias></Alias> > <Password></Password> > </KeyStore> > </ClientAuth> > </SSL> > > > As you can see we do have null host verifier. It switch off > verification > of host name in http request against host name in credentials. > I can > send you the java code. > > 3rd Step > > Export public part of the generated keys from both keystores. > This will > create the selfsigned certificate files. > keytool -export -alias tomcat -keystore ./.keystore > -storepass > password222 -file ./company1.cer > > > and import the certificates to the opposite keystore. > > Ladislav > > On Mon, 2006-05-08 at 12:53 -0400, Tanveer, Ashique (NIH/OD) > [C] wrote: > > > > > > I guess I am looking for something like a “SSL > configuration with > > Hermes for dummiesâ€. Assuming I have two Hermes server > running on > > Tomcat server, what are the steps (generate the certificate, > keystore > > etc,?) to have both Hermes communicate via SSL. I assume > some > > configuration needed on the tomcat as well as hermes > properties files? > > Any tips would help. > > > > > > > > Thanks > > > > -- Ashique > > > > > > > > > |----------------------------------------------------------------------------------- > > > > | Ashique Tanveer > > > > | Booz | Allen | Hamilton > > > > | > > > > | Contractor, eRA Project, National Institute Of Health > > > > | Off: 301-451-1772 | Fax: 925-889-3635 > > > > | Email: tan...@od..., tan...@ba... > > > > > |----------------------------------------------------------------------------------- > > > > > > > > > ______________________________________________________________________ > > From: David RR Webber (XML) [mailto:da...@dr...] > > Sent: Monday, May 08, 2006 12:33 PM > > To: ebx...@li... > > Subject: [ebxmlms-general] Configuring SSL and Hermes - step > by step > > Guide > > > > > > > > > > Team, > > > > > > > > > > > > Does anyone have any notes they can share on setting up > Hermes <-> > > Hermes using SSL? > > > > > > > > > > > > The Hermes docs are not forthcoming on this - so would be > helpful to > > have something available. > > > > > > > > > > > > More to the point - if you succeeded in getting this working > - can you > > share the steps you > > > > > > had to go thru?! > > > > > > > > > > > > Thanks, DW > > > > > > ------------------------------------------------------- > Using Tomcat > > but need to do more? Need to support web services, security? > Get stuff > > done quickly with pre-integrated technology to make your job > easier > > Download IBM WebSphere Application Server v.1.0.1 based on > Apache > > Geronimo > > > http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642 _______________________________________________ ebxmlms-general mailing list ebx...@li... https://lists.sourceforge.net/lists/listinfo/ebxmlms-general > > > > > -- > Ladislav Urban > CEO > Webswell Inc. > 1333 Howe Avenue, Suite 100 > Sacramento, 95825 CA > email: lad...@we... > phone: +1 (916) 290-2040 > fax: +1 (916) 921-2850 > http://www.webswell.com > > > > ------------------------------------------------------- > Using Tomcat but need to do more? Need to support web > services, security? > Get stuff done quickly with pre-integrated technology to make > your job easier > Download IBM WebSphere Application Server v.1.0.1 based on > Apache Geronimo > http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642 > _______________________________________________ > ebxmlms-general mailing list > ebx...@li... > https://lists.sourceforge.net/lists/listinfo/ebxmlms-general > -- Ladislav Urban CEO Webswell Inc. 1333 Howe Avenue, Suite 100 Sacramento, 95825 CA email: lad...@we... phone: +1 (916) 290-2040 fax: +1 (916) 921-2850 http://www.webswell.com |
|
From: Ladislav U. <lad...@we...> - 2006-05-19 02:31:16
|
Hello Ashique,
this is complete msh_properties.xml file:
<?xml version="1.0" encoding="UTF-8"?>
<Property>
<MSH>
<Log>
<!-- ExternalProperties optionally points to an external file for
configuring LOG4J. If specified, the following parameters
(LogPath, LogFile, etc) will not be used -->
<ExternalProperties>/usr/local/Webswell_company/jakarta-tomcat-company/bin/log4j.properties</ExternalProperties>
<!-- empty path: user.home -->
<LogPath>/usr/local/Webswell_company/all_logs</LogPath>
<LogFile>ebxmlms_company.log</LogFile>
<!--
0: all
1: info, warn, error
2: warn, error
3: error
4: no log
-->
<LogLevel>0</LogLevel>
<!-- For rolling log files, maximum file size per log file,
-1: one single big file -->
<MaxFileSize>10000</MaxFileSize>
</Log>
<Config>
<!-- The URL of MSH (The URL of MSH to external systems) -->
<!-- Keep trailing slash after context path to avoid unexpected
problems
with some application servers -->
<!-- <URL>http://66.202.95.174:19998/company/</URL> -->
<URL>http://localhost:19998/company/</URL>
<AuthenticationFile>/usr/local/Webswell_company/ebxmlms/msh_passwd</AuthenticationFile>
<!-- Optional property specifying the implementation class name of
hk.hku.cecid.phoenix.message.handler.ToUrlResolver which
maps a <ToPartyId> to a physical URL for sending message -->
<ToUrlResolver>hk.hku.cecid.phoenix.message.handler.ToUrlResolverImpl</ToUrlResolver>
<!-- Optional property specifying the implementation class name of
hk.hku.cecid.phoenix.pki.CertResolver which
returns an array of java.security.cert.Certificate's based on
the identity information in the received EbxmlMessage -->
<!-- <CertResolver></CertResolver> -->
<!-- Optional property controlling whether a positive
acknowledgment
message will be generated if the sender successfully sends a
message -->
<PositiveAcknowledgment>false</PositiveAcknowledgment>
<!-- Optional property controlling whether an error message being
sent
back to the sender is augmented with the original message as
a MIME payload -->
<AugmentedErrorMessage>true</AugmentedErrorMessage>
<!-- Optional property controlling the content transfer encoding
used
in payload while sending in HTTP -->
<ContentTransferEncoding>binary</ContentTransferEncoding>
<!-- Optional property defining the delivery interval
<DeliveryInterval>5000</DeliveryInterval>
-->
</Config>
<!-- uncomment to use web proxy for outgoing HTTP connections
<Proxy>
<Host>127.0.0.1</Host>
<Port>8282</Port>
</Proxy>
-->
<Mail>
<SMTP>
<!-- Mail server for sending messages -->
<!--<Host>smtp.clevernet.cz</Host> This is blocked on home network-->
<Host>smtp.sbcglobal.yahoo.com</Host>
<!-- <User>tes...@we...</User> This is blocked on
home network -->
<User>hu...@sb...</User>
<!-- <Password>testaccount1</Password> -->
<Password>hulibrk123</Password>
</SMTP>
<!-- Uncomment the following property to watch the debugging
information
from JavaMail library -->
<Debug>false</Debug>
<Poll>
<Protocol>pop3</Protocol>
<Host>pop3.clevernet.cz</Host>
<Port>110</Port>
<Folder>INBOX</Folder>
<User>tes...@we...</User>
<Password>testaccount1</Password>
<MonitorInterval>20000</MonitorInterval>
<!-- optional property for forcing the MSH to change the subtype
of
incoming SOAP messages to "multipart/related" -->
<ForceChangeSubType>true</ForceChangeSubType>
</Poll>
<SMIME>
<Encryption>
<KeyStore>
<Path>/usr/local/Webswell_company/webswellbroker</Path>
<File>.keystore</File>
<Password>password111</Password>
</KeyStore>
</Encryption>
<Decryption>
<KeyStore>
<Path>/usr/local/Webswell_company/webswellbroker</Path>
<File>.keystore</File>
<Alias></Alias>
<Password>password111</Password>
</KeyStore>
</Decryption>
</SMIME>
</Mail>
<DigitalSignature>
<TrustedAnchor>
<KeyStore>
<Path>/usr/local/Webswell_company/webswellbroker</Path>
<File>.keystore</File>
<Password>password111</Password>
</KeyStore>
</TrustedAnchor>
<AckSign>
<KeyStore>
<Alias>partner_sign</Alias>
<Path>/usr/local/Webswell_company/webswellbroker</Path>
<File>.keystore</File>
<Password>password111</Password>
</KeyStore>
</AckSign>
</DigitalSignature>
<SSL>
<!-- Optional property specifying the implementation class name of
com.sun.net.ssl.HostnameVerifier from JSSE 1.0 which handle
the case
when the URL's hostname and the server's identification
hostname
mismatch-->
<HostnameVerifier>com.webswell.hermes.NullHostVerifier</HostnameVerifier>
<TrustedAnchor>
<!-- Trust keystore for SSL Server Authentication -->
<KeyStore>
<Path>/usr/local/Webswell_company/jakarta-tomcat-company</Path>
<File>.keystore</File>
<Password>password789</Password>
</KeyStore>
</TrustedAnchor>
<ClientAuth>
<URL></URL>
<KeyStore>
<Path></Path>
<File></File>
<Alias></Alias>
<Password></Password>
</KeyStore>
</ClientAuth>
</SSL>
<Persistent>
<Database>
<!-- JDBC database driver used in MSH -->
<Driver>org.postgresql.Driver</Driver>
<!-- <Driver>org.hsqldb.jdbcDriver</Driver> -->
<!-- <Driver>org.gjt.mm.mysql.Driver</Driver> -->
<!-- Database user name -->
<User>buyer</User>
<!-- Database password -->
<Password>cecid</Password>
<!-- Database URL -->
<URL>jdbc:postgresql://localhost:9224/company</URL>
<!-- <URL>jdbc:hsqldb:/path/databasename</URL> -->
<!-- <URL>jdbc:mysql://path/msh</URL> -->
<!-- Configure database transaction isolation level. Valid
settings are:
READ_COMMITTED, READ_UNCOMMITTED, REPEATABLE_READ and
SERIALIZABLE
-->
<TransactionIsolationLevel>READ_COMMITTED</TransactionIsolationLevel>
<!-- Number of initial database connections in the connection
pool -->
<InitialConnections>30</InitialConnections>
<!-- Maximum number of database connections allowed in the
database
pool. Enter the value of 0 if unlimited number of
connections
are allowed -->
<MaximumConnections>300</MaximumConnections>
<!-- Maximum period of time in milliseonds to wait for an
available
connection -->
<MaximumWait>20000</MaximumWait>
<!-- Maximum idle time for a connection object to be considered
valid
in the connection pool -->
<MaximumIdle>60000</MaximumIdle>
</Database>
<!-- Repository location for storing ebXML messages persistently
-->
<MessageRepository>/usr/local/Webswell_company/ebxmlms/repository</MessageRepository>
<!-- Maximum number of files in a single directory -->
<MaxFiles>1000</MaxFiles>
<!-- File name for MSH backup -->
<BackupFile>/usr/local/Webswell_company/ebxmlms/MSHBackup.zip</BackupFile>
<!-- Directory where the archived data are placed -->
<ArchiveDirectory>/usr/local/Webswell_company/msh_archive</ArchiveDirectory>
</Persistent>
<!-- Default message repository for MessageListener used in MSH -->
<MessageListener>
<TrustedRepository>/usr/local/Webswell_company/ebxmlms/trustedRepository1;/usr/local/Webswell_company/ebxmlms/trustedRepository2</TrustedRepository>
<ObjectStore>/usr/local/Webswell_company/ebxmlms/objectStore</ObjectStore>
</MessageListener>
<!-- Optional Property to allow the user to use customized delivery
mechanism
<Delivery>
<DeliveryHandler>class.name</DeliveryHandler>
<RetryInterval>1000</RetryInterval>
<MaximumRetry>3</MaximumRetry>
</Delivery>
-->
</MSH>
</Property>
On Mon, 2006-05-15 at 16:54 -0400, Tanveer, Ashique (NIH/OD) [C] wrote:
> Ladislav,
>
>
>
> Will you be able to send me your complete msh_properties.xml file and
> also tell me if using the NullHostVerifier is enough to turn off host
> verification.
>
> I keep getting the error: Hostname should be <120.123.134.111>
>
>
>
> Any help will be hugely appreciated.
>
> Thanks so much in advance
>
>
>
> |-----------------------------------------------------------------------------------
>
> | Ashique Tanveer
>
> | Booz | Allen | Hamilton
>
> |
>
> | Contractor, eRA Project, National Institute Of Health
>
> | Off: 301-451-1772 | Fax: 925-889-3635
>
> | Email: tan...@od..., tan...@ba...
>
> |-----------------------------------------------------------------------------------
>
>
>
> ______________________________________________________________________
> From: David RR Webber (XML) [mailto:da...@dr...]
> Sent: Monday, May 15, 2006 8:41 AM
> To: Tanveer, Ashique (NIH/OD) [C]
> Subject: [FWD: RE: [ebxmlms-general] Configuring SSL and Hermes - step
> by step Guide]
>
>
>
>
>
>
>
>
> -------- Original Message --------
> Subject: RE: [ebxmlms-general] Configuring SSL and Hermes -
> step by
> step Guide
> From: Ladislav Urban <lad...@we...>
> Date: Mon, May 08, 2006 3:25 pm
> To: ebx...@li...
>
> Hello Ashique,
> we use SSL configuration for hermes. You can set it up the
> same way as
> for tomcat.
> Are you going to use selfsigned certs?
>
> 1st Step
> create generate keys in keystores of both tomcats. The kystore
> is
> usually in root directory of the tomcat and its name
> is .keystore
>
> example:
> keytool -genkey -keyalg "RSA" -dname "cn=company1, ou=company,
> o=company1, c=US" -keystore ./.keystore -alias tomcat -keypass
> password222 -storepass password222
>
>
> 2nd Step:
>
> Configuration of msh.properties.xml
> <SSL>
>
> <HostnameVerifier>com.webswell.hermes.NullHostVerifier</HostnameVerifier>
> <TrustedAnchor>
> <!-- Trust keystore for SSL Server Authentication -->
> <KeyStore>
> <Path>/usr/local/Webswell/jakarta-tomcat</Path>
> <File>.keystore</File>
> <Password>password222</Password>
> </KeyStore>
> </TrustedAnchor>
> <ClientAuth>
> <URL></URL>
> <KeyStore>
> <Path></Path>
> <File></File>
> <Alias></Alias>
> <Password></Password>
> </KeyStore>
> </ClientAuth>
> </SSL>
>
>
> As you can see we do have null host verifier. It switch off
> verification
> of host name in http request against host name in credentials.
> I can
> send you the java code.
>
> 3rd Step
>
> Export public part of the generated keys from both keystores.
> This will
> create the selfsigned certificate files.
> keytool -export -alias tomcat -keystore ./.keystore
> -storepass
> password222 -file ./company1.cer
>
>
> and import the certificates to the opposite keystore.
>
> Ladislav
>
> On Mon, 2006-05-08 at 12:53 -0400, Tanveer, Ashique (NIH/OD)
> [C] wrote:
> >
> >
> > I guess I am looking for something like a “SSL
> configuration with
> > Hermes for dummiesâ€. Assuming I have two Hermes server
> running on
> > Tomcat server, what are the steps (generate the certificate,
> keystore
> > etc,?) to have both Hermes communicate via SSL. I assume
> some
> > configuration needed on the tomcat as well as hermes
> properties files?
> > Any tips would help.
> >
> >
> >
> > Thanks
> >
> > -- Ashique
> >
> >
> >
> >
> |-----------------------------------------------------------------------------------
> >
> > | Ashique Tanveer
> >
> > | Booz | Allen | Hamilton
> >
> > |
> >
> > | Contractor, eRA Project, National Institute Of Health
> >
> > | Off: 301-451-1772 | Fax: 925-889-3635
> >
> > | Email: tan...@od..., tan...@ba...
> >
> >
> |-----------------------------------------------------------------------------------
> >
> >
> >
> >
> ______________________________________________________________________
> > From: David RR Webber (XML) [mailto:da...@dr...]
> > Sent: Monday, May 08, 2006 12:33 PM
> > To: ebx...@li...
> > Subject: [ebxmlms-general] Configuring SSL and Hermes - step
> by step
> > Guide
> >
> >
> >
> >
> > Team,
> >
> >
> >
> >
> >
> > Does anyone have any notes they can share on setting up
> Hermes <->
> > Hermes using SSL?
> >
> >
> >
> >
> >
> > The Hermes docs are not forthcoming on this - so would be
> helpful to
> > have something available.
> >
> >
> >
> >
> >
> > More to the point - if you succeeded in getting this working
> - can you
> > share the steps you
> >
> >
> > had to go thru?!
> >
> >
> >
> >
> >
> > Thanks, DW
> >
> >
> > -------------------------------------------------------
> Using Tomcat
> > but need to do more? Need to support web services, security?
> Get stuff
> > done quickly with pre-integrated technology to make your job
> easier
> > Download IBM WebSphere Application Server v.1.0.1 based on
> Apache
> > Geronimo
> >
> http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642 _______________________________________________ ebxmlms-general mailing list ebx...@li... https://lists.sourceforge.net/lists/listinfo/ebxmlms-general
> >
> >
> --
> Ladislav Urban
> CEO
> Webswell Inc.
> 1333 Howe Avenue, Suite 100
> Sacramento, 95825 CA
> email: lad...@we...
> phone: +1 (916) 290-2040
> fax: +1 (916) 921-2850
> http://www.webswell.com
>
>
>
> -------------------------------------------------------
> Using Tomcat but need to do more? Need to support web
> services, security?
> Get stuff done quickly with pre-integrated technology to make
> your job easier
> Download IBM WebSphere Application Server v.1.0.1 based on
> Apache Geronimo
> http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642
> _______________________________________________
> ebxmlms-general mailing list
> ebx...@li...
> https://lists.sourceforge.net/lists/listinfo/ebxmlms-general
>
--
Ladislav Urban
CEO
Webswell Inc.
1333 Howe Avenue, Suite 100
Sacramento, 95825 CA
email: lad...@we...
phone: +1 (916) 290-2040
fax: +1 (916) 921-2850
http://www.webswell.com
|
|
From: David RR W. \(XML\) <da...@dr...> - 2006-05-17 13:27:11
|
<div><A href="https://www.godaddy.com/gdshop/ssl/ssl_opensource.asp">https://www.godaddy.com/gdshop/ssl/ssl_opensource.asp</A></div> <div> </div> <div>A nice little perk here!</div> <div> </div> <div>DW</div> |
|
From: Tanveer, A. \(NIH/OD\) [C] <tan...@od...> - 2006-05-15 12:54:38
|
Ladislav,
=20
I tried your suggestion to turn off HostName verifier but it still is
throwing an exception. The exception looks like:
=20
Info: using property file in
/C:/mshtest/app-config/msh_client.properties.xml
java.io.IOException: HTTPS hostname wrong: should be <165.112.122.219>
at sun.net.www.protocol.https.HttpsClient.b(DashoA12275)
at
sun.net.www.protocol.https.HttpsClient.afterConnect(DashoA12275)
at
sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect(Da
shoA12275)
at
sun.net.www.protocol.http.HttpURLConnection.getOutputStream(HttpURLConne
ction.java:569)
=20
=20
Here is what I did based on your suggestion.
=20
1) I modified the msh_properties.xml to include the
HostnameVerifier tag. My XML file looks like this:
=20
=20
<HostnameVerifier>com.webswell.hermes.NullHostVerifier</HostnameVerifier
> =20
=20
<DigitalSignature>
<TrustedAnchor>
<KeyStore>
=20
<Path>C:/Software/Development/j2sdk1.4.2_08/jre/lib/security/</Path>
<File>nihs2s.ks</File>
<Password>changeit</Password>
</KeyStore>
</TrustedAnchor>
<AckSign>
<KeyStore>
=20
<Path>C:/Software/Development/j2sdk1.4.2_08/jre/lib/security/</Path>
<File>nihs2s.ks</File>
<Algorithm>RSA</Algorithm>
<Alias>nihs2s</Alias>
<Password>changeit</Password>
</KeyStore>
</AckSign>
=20
2) I Copied your verifier.jar file under OC4J's
webapps/msh/WEB-INF/lib. That is where msh.jar and rest of the deployed
msh jar files are.
(We are using OC4J standalone for this particular deployment)
=20
Then I restarted back my OC4J. When deplying/launching msh, I saw the
exception in my OC4J log file.
=20
Any clue?
Thanks
-- Ashique
=20
------------------------------------------------------------------------
------------------------------------------------------------------------
-----------------------
From: "Ladislav Urban" <lad...@we...>
Date: Tue, May 09, 2006 2:45 pm
To: ebxmlms-develop <ebx...@li...>, "Tanveer,
Ashique (NIH/OD) [C]" <tan...@od...>
This code will turn off the verification. You can use code from
verifier.jar that is in an attachment
This is section from msh.properties.xml
You have to have verifier.jar in directory in tomcat with other hermes
classes.
If you have some problems with it let me know
<SSL>
<HostnameVerifier>com.webswell.hermes.NullHostVerifier</HostnameVerifier
>
=20
|-----------------------------------------------------------------------
------------
| Ashique Tanveer
| Booz | Allen | Hamilton
|
| Contractor, eRA Project, National Institute Of Health
| Off: 301-451-1772 | Fax: 925-889-3635
| Email: tan...@od..., tan...@ba...=20
|-----------------------------------------------------------------------
------------
=20
|
|
From: Ladislav U. <lad...@we...> - 2006-05-09 19:05:19
|
|
From: Ladislav U. <lad...@we...> - 2006-05-09 18:38:30
|
Hello Ashique, this problem in SSL handshake seems to me due missing trusted certificated in local keystore. Could you please send me list of aliases from both keystores? You can get them by similar command keytool -list -keystore ./.keystore -storepass password456 On Tue, 2006-05-09 at 08:21 -0400, Tanveer, Ashique (NIH/OD) [C] wrote: > > When I Deploy Hermes on Tomcat with SSL turned on, I get an exception. > With non-SSL port everything works fine. But as soon as I specify the > SSL port in the msh*.properties file (under the <URL> ....</URL> tag), I > get the exception. I will appreciate any help on this. > > 2006-05-09 08:16:16,613 INFO Thread-3 gov.nih.cgaprefimpl.RequestManager > - Regis > tering with the msh at: https://localhost:8443/msh/ > 2006-05-09 08:16:16,643 INFO Thread-3 > gov.nih.cgaprefimpl.ExchangeMessageListene > r - Creating an ExchangeMessageListener > javax.net.ssl.SSLHandshakeException: > sun.security.validator.ValidatorException: > No trusted certificate found > at com.sun.net.ssl.internal.ssl.BaseSSLSocketImpl.a(DashoA12275) > at com.sun.net.ssl.internal.ssl.SSLSocketImpl.a(DashoA12275) > at com.sun.net.ssl.internal.ssl.SSLSocketImpl.a(DashoA12275) > at com.sun.net.ssl.internal.ssl.SunJSSE_az.a(DashoA12275) > at com.sun.net.ssl.internal.ssl.SunJSSE_az.a(DashoA12275) > at com.sun.net.ssl.internal.ssl.SunJSSE_ax.a(DashoA12275) > at com.sun.net.ssl.internal.ssl.SSLSocketImpl.a(DashoA12275) > at com.sun.net.ssl.internal.ssl.SSLSocketImpl.j(DashoA12275)at > com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(DashoA12275) > at sun.net.www.protocol.https.HttpsClient.afterConnect(DashoA12275) at > sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect > (DashoA12275) at > sun.net.www.protocol.http.HttpURLConnection.getOutputStream(HttpURLCo > nnection.java:569) at > sun.net.www.protocol.https.HttpsURLConnectionImpl.getOutputStream(Das > hoA12275) at > hk.hku.cecid.phoenix.message.handler.Request.sendCommand(UnknownSour ce) > at hk.hku.cecid.phoenix.message.handler.Request.sendMessageServiceHandle > > Thanks > |----------------------------------------------------------------------- > ----| Ashique Tanveer > | Booz | Allen | Hamilton > | > | Contractor, eRA Project, National Institute Of Health > | Off: 301-451-1772 > | Fax: 925-889-3635 > | Email: tan...@od..., tan...@ba... > |----------------------------------------------------------------------- > ---------Original Message----- > From: Tanveer, Ashique (NIH/OD) [C] > Sent: Monday, May 08, 2006 4:05 PM > To: 'ebx...@li...' > Subject: RE: [ebxmlms-general] Configuring SSL and Hermes - step by > stepGuide > > Ladislav, > > Here are couple of questions. You may be able to help with this. > > 1) In your configuration what port address you specified in > msh.properties and msh_client.properties file under <URL> ...</URL>. I > assume it has to be the SSL port of Tomcat. Right? > > > 2) I understood that I will generate two sets of keystores (and 2 sets > of certificates to be imported into the other party's keystore). > > In your email you asked to modify msh*.propeties file to specify the > keystore name/password there. But how does the tomcat configuration come > into picture? Or is that not a necessary step? Typically I would specify > the keystore name/password in the Tomcat server.xml under the > <Connector>...</Connector> tag. Is that not necessary to do when I am > running hermes in SSL mode? Only modifying the hermes properties > (msh*.properties) is sufficient? > > I am just trying to understand difference or relationship between > tomcat's configuration for SSL (in its server.xml) and Hermes' SSL > configuration (in msh*.properties files). > > Thanks again for your time and help. > > |----------------------------------------------------------------------- > ----| Ashique Tanveer > | Booz | Allen | Hamilton > | > | Contractor, eRA Project, National Institute Of Health > | Off: 301-451-1772 > | Fax: 925-889-3635 > | Email: tan...@od..., tan...@ba... > | Learn Java, Teach Java, Talk Java, Join a JUG > | http://servlet.java.sun.com/jugs/north_america/usa/maryland/rockville > |----------------------------------------------------------------------- > ---- > > -----Original Message----- > From: Ladislav Urban [mailto:lad...@we...] > Sent: Monday, May 08, 2006 3:25 PM > To: ebx...@li... > Subject: RE: [ebxmlms-general] Configuring SSL and Hermes - step by > stepGuide > > Hello Ashique, > we use SSL configuration for hermes. You can set it up the same way as > for tomcat. > Are you going to use selfsigned certs? > > 1st Step > create generate keys in keystores of both tomcats. The kystore is > usually in root directory of the tomcat and its name is .keystore > > example: > keytool -genkey -keyalg "RSA" -dname "cn=company1, ou=company, > o=company1, c=US" -keystore ./.keystore -alias tomcat -keypass > password222 -storepass password222 > > > 2nd Step: > > Configuration of msh.properties.xml > <SSL> > > <HostnameVerifier>com.webswell.hermes.NullHostVerifier</HostnameVerifier > > > <TrustedAnchor> > <!-- Trust keystore for SSL Server Authentication --> > <KeyStore> > <Path>/usr/local/Webswell/jakarta-tomcat</Path> > <File>.keystore</File> > <Password>password222</Password> > </KeyStore> > </TrustedAnchor> > <ClientAuth> > <URL></URL> > <KeyStore> > <Path></Path> > <File></File> > <Alias></Alias> > <Password></Password> > </KeyStore> > </ClientAuth> > </SSL> > > > As you can see we do have null host verifier. It switch off verification > of host name in http request against host name in credentials. I can > send you the java code. > > 3rd Step > > Export public part of the generated keys from both keystores. This will > create the selfsigned certificate files. > keytool -export -alias tomcat -keystore ./.keystore -storepass > password222 -file ./company1.cer > > > and import the certificates to the opposite keystore. > > Ladislav > > On Mon, 2006-05-08 at 12:53 -0400, Tanveer, Ashique (NIH/OD) [C] wrote: > > > > > > I guess I am looking for something like a "SSL configuration with > > Hermes for dummies". Assuming I have two Hermes server running on > > Tomcat server, what are the steps (generate the certificate, keystore > > etc,?) to have both Hermes communicate via SSL. I assume some > > configuration needed on the tomcat as well as hermes properties files? > > Any tips would help. > > > > > > > > Thanks > > > > -- Ashique > > > > > > > > > |----------------------------------------------------------------------- > ------------ > > > > | Ashique Tanveer > > > > | Booz | Allen | Hamilton > > > > | > > > > | Contractor, eRA Project, National Institute Of Health > > > > | Off: 301-451-1772 | Fax: 925-889-3635 > > > > | Email: tan...@od..., tan...@ba... > > > > > |----------------------------------------------------------------------- > ------------ > > > > > > > > ______________________________________________________________________ > > From: David RR Webber (XML) [mailto:da...@dr...] > > Sent: Monday, May 08, 2006 12:33 PM > > To: ebx...@li... > > Subject: [ebxmlms-general] Configuring SSL and Hermes - step by step > > Guide > > > > > > > > > > Team, > > > > > > > > > > > > Does anyone have any notes they can share on setting up Hermes <-> > > Hermes using SSL? > > > > > > > > > > > > The Hermes docs are not forthcoming on this - so would be helpful to > > have something available. > > > > > > > > > > > > More to the point - if you succeeded in getting this working - can you > > share the steps you > > > > > > had to go thru?! > > > > > > > > > > > > Thanks, DW > > > > > > ------------------------------------------------------- Using Tomcat > > but need to do more? Need to support web services, security? Get stuff > > done quickly with pre-integrated technology to make your job easier > > Download IBM WebSphere Application Server v.1.0.1 based on Apache > > Geronimo > > > http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642 > _______________________________________________ ebxmlms-general mailing > list ebx...@li... > https://lists.sourceforge.net/lists/listinfo/ebxmlms-general > > > > > -- > Ladislav Urban > CEO > Webswell Inc. > 1333 Howe Avenue, Suite 100 > Sacramento, 95825 CA > email: lad...@we... > phone: +1 (916) 290-2040 > fax: +1 (916) 921-2850 > http://www.webswell.com > > > > ------------------------------------------------------- > Using Tomcat but need to do more? Need to support web services, > security? > Get stuff done quickly with pre-integrated technology to make your job > easier > Download IBM WebSphere Application Server v.1.0.1 based on Apache > Geronimo > http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642 > _______________________________________________ > ebxmlms-general mailing list > ebx...@li... > https://lists.sourceforge.net/lists/listinfo/ebxmlms-general > > > ------------------------------------------------------- > Using Tomcat but need to do more? Need to support web services, security? > Get stuff done quickly with pre-integrated technology to make your job easier > Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo > http://sel.as-us.falkag.net/sel?cmd=lnk&kid0709&bid&3057&dat1642 > _______________________________________________ > ebxmlms-general mailing list > ebx...@li... > https://lists.sourceforge.net/lists/listinfo/ebxmlms-general > -- Ladislav Urban CEO Webswell Inc. 1333 Howe Avenue, Suite 100 Sacramento, 95825 CA email: lad...@we... phone: +1 (916) 290-2040 fax: +1 (916) 921-2850 http://www.webswell.com |
|
From: Tanveer, A. \(NIH/OD\) [C] <tan...@od...> - 2006-05-09 12:22:11
|
When I Deploy Hermes on Tomcat with SSL turned on, I get an exception.
With non-SSL port everything works fine. But as soon as I specify the
SSL port in the msh*.properties file (under the <URL> ....</URL> tag), I
get the exception. I will appreciate any help on this.
2006-05-09 08:16:16,613 INFO Thread-3 gov.nih.cgaprefimpl.RequestManager
- Regis
tering with the msh at: https://localhost:8443/msh/
2006-05-09 08:16:16,643 INFO Thread-3
gov.nih.cgaprefimpl.ExchangeMessageListene
r - Creating an ExchangeMessageListener
javax.net.ssl.SSLHandshakeException:
sun.security.validator.ValidatorException:
No trusted certificate found
at com.sun.net.ssl.internal.ssl.BaseSSLSocketImpl.a(DashoA12275)
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.a(DashoA12275)
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.a(DashoA12275)
at com.sun.net.ssl.internal.ssl.SunJSSE_az.a(DashoA12275)
at com.sun.net.ssl.internal.ssl.SunJSSE_az.a(DashoA12275)
at com.sun.net.ssl.internal.ssl.SunJSSE_ax.a(DashoA12275)
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.a(DashoA12275)
at com.sun.net.ssl.internal.ssl.SSLSocketImpl.j(DashoA12275)at
com.sun.net.ssl.internal.ssl.SSLSocketImpl.startHandshake(DashoA12275)
at sun.net.www.protocol.https.HttpsClient.afterConnect(DashoA12275) at
sun.net.www.protocol.https.AbstractDelegateHttpsURLConnection.connect
(DashoA12275) at
sun.net.www.protocol.http.HttpURLConnection.getOutputStream(HttpURLCo
nnection.java:569) at
sun.net.www.protocol.https.HttpsURLConnectionImpl.getOutputStream(Das
hoA12275) at
hk.hku.cecid.phoenix.message.handler.Request.sendCommand(UnknownSour ce)
at hk.hku.cecid.phoenix.message.handler.Request.sendMessageServiceHandle
Thanks
|-----------------------------------------------------------------------
----| Ashique Tanveer
| Booz | Allen | Hamilton=20
|
| Contractor, eRA Project, National Institute Of Health
| Off: 301-451-1772
| Fax: 925-889-3635
| Email: tan...@od..., tan...@ba...=20
|-----------------------------------------------------------------------
---------Original Message-----
From: Tanveer, Ashique (NIH/OD) [C]=20
Sent: Monday, May 08, 2006 4:05 PM
To: 'ebx...@li...'
Subject: RE: [ebxmlms-general] Configuring SSL and Hermes - step by
stepGuide
Ladislav,
Here are couple of questions. You may be able to help with this.
1) In your configuration what port address you specified in
msh.properties and msh_client.properties file under <URL> ...</URL>. I
assume it has to be the SSL port of Tomcat. Right?
2) I understood that I will generate two sets of keystores (and 2 sets
of certificates to be imported into the other party's keystore).
In your email you asked to modify msh*.propeties file to specify the
keystore name/password there. But how does the tomcat configuration come
into picture? Or is that not a necessary step? Typically I would specify
the keystore name/password in the Tomcat server.xml under the
<Connector>...</Connector> tag. Is that not necessary to do when I am
running hermes in SSL mode? Only modifying the hermes properties
(msh*.properties) is sufficient?
I am just trying to understand difference or relationship between
tomcat's configuration for SSL (in its server.xml) and Hermes' SSL
configuration (in msh*.properties files).
Thanks again for your time and help.
|-----------------------------------------------------------------------
----| Ashique Tanveer
| Booz | Allen | Hamilton=20
|
| Contractor, eRA Project, National Institute Of Health
| Off: 301-451-1772
| Fax: 925-889-3635
| Email: tan...@od..., tan...@ba...=20
| Learn Java, Teach Java, Talk Java, Join a JUG
| http://servlet.java.sun.com/jugs/north_america/usa/maryland/rockville
|-----------------------------------------------------------------------
----
-----Original Message-----
From: Ladislav Urban [mailto:lad...@we...]=20
Sent: Monday, May 08, 2006 3:25 PM
To: ebx...@li...
Subject: RE: [ebxmlms-general] Configuring SSL and Hermes - step by
stepGuide
Hello Ashique,
we use SSL configuration for hermes. You can set it up the same way as
for tomcat.=20
Are you going to use selfsigned certs?
1st Step
create generate keys in keystores of both tomcats. The kystore is
usually in root directory of the tomcat and its name is .keystore
example:
keytool -genkey -keyalg "RSA" -dname "cn=3Dcompany1, ou=3Dcompany,
o=3Dcompany1, c=3DUS" -keystore ./.keystore -alias tomcat -keypass
password222 -storepass password222
2nd Step:
Configuration of msh.properties.xml
<SSL>
<HostnameVerifier>com.webswell.hermes.NullHostVerifier</HostnameVerifier
>
<TrustedAnchor>
<!-- Trust keystore for SSL Server Authentication -->
<KeyStore>
<Path>/usr/local/Webswell/jakarta-tomcat</Path>
<File>.keystore</File>
<Password>password222</Password>
</KeyStore>
</TrustedAnchor>
<ClientAuth>
<URL></URL>
<KeyStore>
<Path></Path>
<File></File>
<Alias></Alias>
<Password></Password>
</KeyStore>
</ClientAuth>
</SSL>
As you can see we do have null host verifier. It switch off verification
of host name in http request against host name in credentials. I can
send you the java code.
3rd Step=20
Export public part of the generated keys from both keystores. This will
create the selfsigned certificate files.
keytool -export -alias tomcat -keystore ./.keystore -storepass
password222 -file ./company1.cer
and import the certificates to the opposite keystore.
Ladislav=20
On Mon, 2006-05-08 at 12:53 -0400, Tanveer, Ashique (NIH/OD) [C] wrote:
> =20
>=20
> I guess I am looking for something like a "SSL configuration with
> Hermes for dummies". Assuming I have two Hermes server running on
> Tomcat server, what are the steps (generate the certificate, keystore
> etc,?) to have both Hermes communicate via SSL. I assume some
> configuration needed on the tomcat as well as hermes properties files?
> Any tips would help.
>=20
> =20
>=20
> Thanks
>=20
> -- Ashique
>=20
> =20
>=20
>
|-----------------------------------------------------------------------
------------
>=20
> | Ashique Tanveer
>=20
> | Booz | Allen | Hamilton
>=20
> |
>=20
> | Contractor, eRA Project, National Institute Of Health
>=20
> | Off: 301-451-1772 | Fax: 925-889-3635
>=20
> | Email: tan...@od..., tan...@ba...=20
>=20
>
|-----------------------------------------------------------------------
------------
>=20
>=20
> =20
> ______________________________________________________________________
> From: David RR Webber (XML) [mailto:da...@dr...]=20
> Sent: Monday, May 08, 2006 12:33 PM
> To: ebx...@li...
> Subject: [ebxmlms-general] Configuring SSL and Hermes - step by step
> Guide
>=20
>=20
> =20
>=20
> Team,
>=20
>=20
> =20
>=20
>=20
> Does anyone have any notes they can share on setting up Hermes <->
> Hermes using SSL?
>=20
>=20
> =20
>=20
>=20
> The Hermes docs are not forthcoming on this - so would be helpful to
> have something available.
>=20
>=20
> =20
>=20
>=20
> More to the point - if you succeeded in getting this working - can you
> share the steps you=20
>=20
>=20
> had to go thru?!
>=20
>=20
> =20
>=20
>=20
> Thanks, DW
>=20
>=20
> ------------------------------------------------------- Using Tomcat
> but need to do more? Need to support web services, security? Get stuff
> done quickly with pre-integrated technology to make your job easier
> Download IBM WebSphere Application Server v.1.0.1 based on Apache
> Geronimo
>
http://sel.as-us.falkag.net/sel?cmd=3Dlnk&kid=3D120709&bid=3D263057&dat=3D=
121642
_______________________________________________ ebxmlms-general mailing
list ebx...@li...
https://lists.sourceforge.net/lists/listinfo/ebxmlms-general=20
>=20
>=20
--=20
Ladislav Urban
CEO
Webswell Inc.
1333 Howe Avenue, Suite 100
Sacramento, 95825 CA
email: lad...@we...
phone: +1 (916) 290-2040
fax: +1 (916) 921-2850
http://www.webswell.com
-------------------------------------------------------
Using Tomcat but need to do more? Need to support web services,
security?
Get stuff done quickly with pre-integrated technology to make your job
easier
Download IBM WebSphere Application Server v.1.0.1 based on Apache
Geronimo
http://sel.as-us.falkag.net/sel?cmd=3Dlnk&kid=3D120709&bid=3D263057&dat=3D=
121642
_______________________________________________
ebxmlms-general mailing list
ebx...@li...
https://lists.sourceforge.net/lists/listinfo/ebxmlms-general
|
|
From: Lucia M. <lme...@cs...> - 2006-05-09 06:54:50
|
I want to ususcribe to this mailing list Plese delete my address!!!! Lucia |
|
From: Tanveer, A. \(NIH/OD\) [C] <tan...@od...> - 2006-05-08 20:04:45
|
Ladislav, Here are couple of questions. You may be able to help with this. 1) In your configuration what port address you specified in msh.properties and msh_client.properties file under <URL> ...</URL>. I assume it has to be the SSL port of Tomcat. Right? 2) I understood that I will generate two sets of keystores (and 2 sets of certificates to be imported into the other party's keystore). In your email you asked to modify msh*.propeties file to specify the keystore name/password there. But how does the tomcat configuration come into picture? Or is that not a necessary step? Typically I would specify the keystore name/password in the Tomcat server.xml under the <Connector>...</Connector> tag. Is that not necessary to do when I am running hermes in SSL mode? Only modifying the hermes properties (msh*.properties) is sufficient? I am just trying to understand difference or relationship between tomcat's configuration for SSL (in its server.xml) and Hermes' SSL configuration (in msh*.properties files). Thanks again for your time and help. |----------------------------------------------------------------------- ----| Ashique Tanveer | Booz | Allen | Hamilton=20 | | Contractor, eRA Project, National Institute Of Health | Off: 301-451-1772 | Fax: 925-889-3635 | Email: tan...@od..., tan...@ba...=20 | Learn Java, Teach Java, Talk Java, Join a JUG | http://servlet.java.sun.com/jugs/north_america/usa/maryland/rockville |----------------------------------------------------------------------- ---- -----Original Message----- From: Ladislav Urban [mailto:lad...@we...]=20 Sent: Monday, May 08, 2006 3:25 PM To: ebx...@li... Subject: RE: [ebxmlms-general] Configuring SSL and Hermes - step by stepGuide Hello Ashique, we use SSL configuration for hermes. You can set it up the same way as for tomcat.=20 Are you going to use selfsigned certs? 1st Step create generate keys in keystores of both tomcats. The kystore is usually in root directory of the tomcat and its name is .keystore example: keytool -genkey -keyalg "RSA" -dname "cn=3Dcompany1, ou=3Dcompany, o=3Dcompany1, c=3DUS" -keystore ./.keystore -alias tomcat -keypass password222 -storepass password222 2nd Step: Configuration of msh.properties.xml <SSL> <HostnameVerifier>com.webswell.hermes.NullHostVerifier</HostnameVerifier > <TrustedAnchor> <!-- Trust keystore for SSL Server Authentication --> <KeyStore> <Path>/usr/local/Webswell/jakarta-tomcat</Path> <File>.keystore</File> <Password>password222</Password> </KeyStore> </TrustedAnchor> <ClientAuth> <URL></URL> <KeyStore> <Path></Path> <File></File> <Alias></Alias> <Password></Password> </KeyStore> </ClientAuth> </SSL> As you can see we do have null host verifier. It switch off verification of host name in http request against host name in credentials. I can send you the java code. 3rd Step=20 Export public part of the generated keys from both keystores. This will create the selfsigned certificate files. keytool -export -alias tomcat -keystore ./.keystore -storepass password222 -file ./company1.cer and import the certificates to the opposite keystore. Ladislav=20 On Mon, 2006-05-08 at 12:53 -0400, Tanveer, Ashique (NIH/OD) [C] wrote: > =20 >=20 > I guess I am looking for something like a "SSL configuration with > Hermes for dummies". Assuming I have two Hermes server running on > Tomcat server, what are the steps (generate the certificate, keystore > etc,?) to have both Hermes communicate via SSL. I assume some > configuration needed on the tomcat as well as hermes properties files? > Any tips would help. >=20 > =20 >=20 > Thanks >=20 > -- Ashique >=20 > =20 >=20 > |----------------------------------------------------------------------- ------------ >=20 > | Ashique Tanveer >=20 > | Booz | Allen | Hamilton >=20 > | >=20 > | Contractor, eRA Project, National Institute Of Health >=20 > | Off: 301-451-1772 | Fax: 925-889-3635 >=20 > | Email: tan...@od..., tan...@ba...=20 >=20 > |----------------------------------------------------------------------- ------------ >=20 >=20 > =20 > ______________________________________________________________________ > From: David RR Webber (XML) [mailto:da...@dr...]=20 > Sent: Monday, May 08, 2006 12:33 PM > To: ebx...@li... > Subject: [ebxmlms-general] Configuring SSL and Hermes - step by step > Guide >=20 >=20 > =20 >=20 > Team, >=20 >=20 > =20 >=20 >=20 > Does anyone have any notes they can share on setting up Hermes <-> > Hermes using SSL? >=20 >=20 > =20 >=20 >=20 > The Hermes docs are not forthcoming on this - so would be helpful to > have something available. >=20 >=20 > =20 >=20 >=20 > More to the point - if you succeeded in getting this working - can you > share the steps you=20 >=20 >=20 > had to go thru?! >=20 >=20 > =20 >=20 >=20 > Thanks, DW >=20 >=20 > ------------------------------------------------------- Using Tomcat > but need to do more? Need to support web services, security? Get stuff > done quickly with pre-integrated technology to make your job easier > Download IBM WebSphere Application Server v.1.0.1 based on Apache > Geronimo > http://sel.as-us.falkag.net/sel?cmd=3Dlnk&kid=3D120709&bid=3D263057&dat=3D= 121642 _______________________________________________ ebxmlms-general mailing list ebx...@li... https://lists.sourceforge.net/lists/listinfo/ebxmlms-general=20 >=20 >=20 --=20 Ladislav Urban CEO Webswell Inc. 1333 Howe Avenue, Suite 100 Sacramento, 95825 CA email: lad...@we... phone: +1 (916) 290-2040 fax: +1 (916) 921-2850 http://www.webswell.com ------------------------------------------------------- Using Tomcat but need to do more? Need to support web services, security? Get stuff done quickly with pre-integrated technology to make your job easier Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo http://sel.as-us.falkag.net/sel?cmd=3Dlnk&kid=3D120709&bid=3D263057&dat=3D= 121642 _______________________________________________ ebxmlms-general mailing list ebx...@li... https://lists.sourceforge.net/lists/listinfo/ebxmlms-general |
|
From: Tanveer, A. \(NIH/OD\) [C] <tan...@od...> - 2006-05-08 19:31:21
|
Ladislav, Thanks for the prompt answer. Yes (for now at least) we will be using self signed certificates. I sort of followed the same instructions but perhaps I did not import the generated certificates correctly into the other party's keystore. I will try your steps as you described. Thanks again for the help. I really appreciate your time. |----------------------------------------------------------------------- ----| Ashique Tanveer | Booz | Allen | Hamilton=20 | | Contractor, eRA Project, National Institute Of Health | Off: 301-451-1772 | Fax: 925-889-3635 | Email: tan...@od..., tan...@ba...=20 | Learn Java, Teach Java, Talk Java, Join a JUG | http://servlet.java.sun.com/jugs/north_america/usa/maryland/rockville |----------------------------------------------------------------------- ---------Original Message----- From: Ladislav Urban [mailto:lad...@we...]=20 Sent: Monday, May 08, 2006 3:25 PM To: ebx...@li... Subject: RE: [ebxmlms-general] Configuring SSL and Hermes - step by stepGuide Hello Ashique, we use SSL configuration for hermes. You can set it up the same way as for tomcat.=20 Are you going to use selfsigned certs? 1st Step create generate keys in keystores of both tomcats. The kystore is usually in root directory of the tomcat and its name is .keystore example: keytool -genkey -keyalg "RSA" -dname "cn=3Dcompany1, ou=3Dcompany, o=3Dcompany1, c=3DUS" -keystore ./.keystore -alias tomcat -keypass password222 -storepass password222 2nd Step: Configuration of msh.properties.xml <SSL> <HostnameVerifier>com.webswell.hermes.NullHostVerifier</HostnameVerifier > <TrustedAnchor> <!-- Trust keystore for SSL Server Authentication --> <KeyStore> <Path>/usr/local/Webswell/jakarta-tomcat</Path> <File>.keystore</File> <Password>password222</Password> </KeyStore> </TrustedAnchor> <ClientAuth> <URL></URL> <KeyStore> <Path></Path> <File></File> <Alias></Alias> <Password></Password> </KeyStore> </ClientAuth> </SSL> As you can see we do have null host verifier. It switch off verification of host name in http request against host name in credentials. I can send you the java code. 3rd Step=20 Export public part of the generated keys from both keystores. This will create the selfsigned certificate files. keytool -export -alias tomcat -keystore ./.keystore -storepass password222 -file ./company1.cer and import the certificates to the opposite keystore. Ladislav=20 On Mon, 2006-05-08 at 12:53 -0400, Tanveer, Ashique (NIH/OD) [C] wrote: > =20 >=20 > I guess I am looking for something like a "SSL configuration with > Hermes for dummies". Assuming I have two Hermes server running on > Tomcat server, what are the steps (generate the certificate, keystore > etc,?) to have both Hermes communicate via SSL. I assume some > configuration needed on the tomcat as well as hermes properties files? > Any tips would help. >=20 > =20 >=20 > Thanks >=20 > -- Ashique >=20 > =20 >=20 > |----------------------------------------------------------------------- ------------ >=20 > | Ashique Tanveer >=20 > | Booz | Allen | Hamilton >=20 > | >=20 > | Contractor, eRA Project, National Institute Of Health >=20 > | Off: 301-451-1772 | Fax: 925-889-3635 >=20 > | Email: tan...@od..., tan...@ba...=20 >=20 > |----------------------------------------------------------------------- ------------ >=20 >=20 > =20 > ______________________________________________________________________ > From: David RR Webber (XML) [mailto:da...@dr...]=20 > Sent: Monday, May 08, 2006 12:33 PM > To: ebx...@li... > Subject: [ebxmlms-general] Configuring SSL and Hermes - step by step > Guide >=20 >=20 > =20 >=20 > Team, >=20 >=20 > =20 >=20 >=20 > Does anyone have any notes they can share on setting up Hermes <-> > Hermes using SSL? >=20 >=20 > =20 >=20 >=20 > The Hermes docs are not forthcoming on this - so would be helpful to > have something available. >=20 >=20 > =20 >=20 >=20 > More to the point - if you succeeded in getting this working - can you > share the steps you=20 >=20 >=20 > had to go thru?! >=20 >=20 > =20 >=20 >=20 > Thanks, DW >=20 >=20 > ------------------------------------------------------- Using Tomcat > but need to do more? Need to support web services, security? Get stuff > done quickly with pre-integrated technology to make your job easier > Download IBM WebSphere Application Server v.1.0.1 based on Apache > Geronimo > http://sel.as-us.falkag.net/sel?cmd=3Dlnk&kid=3D120709&bid=3D263057&dat=3D= 121642 _______________________________________________ ebxmlms-general mailing list ebx...@li... https://lists.sourceforge.net/lists/listinfo/ebxmlms-general=20 >=20 >=20 --=20 Ladislav Urban CEO Webswell Inc. 1333 Howe Avenue, Suite 100 Sacramento, 95825 CA email: lad...@we... phone: +1 (916) 290-2040 fax: +1 (916) 921-2850 http://www.webswell.com ------------------------------------------------------- Using Tomcat but need to do more? Need to support web services, security? Get stuff done quickly with pre-integrated technology to make your job easier Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo http://sel.as-us.falkag.net/sel?cmd=3Dlnk&kid=3D120709&bid=3D263057&dat=3D= 121642 _______________________________________________ ebxmlms-general mailing list ebx...@li... https://lists.sourceforge.net/lists/listinfo/ebxmlms-general |
|
From: Ladislav U. <lad...@we...> - 2006-05-08 19:25:27
|
Hello Ashique,
we use SSL configuration for hermes. You can set it up the same way as
for tomcat.
Are you going to use selfsigned certs?
1st Step
create generate keys in keystores of both tomcats. The kystore is
usually in root directory of the tomcat and its name is .keystore
example:
keytool -genkey -keyalg "RSA" -dname "cn=company1, ou=company,
o=company1, c=US" -keystore ./.keystore -alias tomcat -keypass
password222 -storepass password222
2nd Step:
Configuration of msh.properties.xml
<SSL>
<HostnameVerifier>com.webswell.hermes.NullHostVerifier</HostnameVerifier>
<TrustedAnchor>
<!-- Trust keystore for SSL Server Authentication -->
<KeyStore>
<Path>/usr/local/Webswell/jakarta-tomcat</Path>
<File>.keystore</File>
<Password>password222</Password>
</KeyStore>
</TrustedAnchor>
<ClientAuth>
<URL></URL>
<KeyStore>
<Path></Path>
<File></File>
<Alias></Alias>
<Password></Password>
</KeyStore>
</ClientAuth>
</SSL>
As you can see we do have null host verifier. It switch off verification
of host name in http request against host name in credentials. I can
send you the java code.
3rd Step
Export public part of the generated keys from both keystores. This will
create the selfsigned certificate files.
keytool -export -alias tomcat -keystore ./.keystore -storepass
password222 -file ./company1.cer
and import the certificates to the opposite keystore.
Ladislav
On Mon, 2006-05-08 at 12:53 -0400, Tanveer, Ashique (NIH/OD) [C] wrote:
>
>
> I guess I am looking for something like a “SSL configuration with
> Hermes for dummies”. Assuming I have two Hermes server running on
> Tomcat server, what are the steps (generate the certificate, keystore
> etc,?) to have both Hermes communicate via SSL. I assume some
> configuration needed on the tomcat as well as hermes properties files?
> Any tips would help.
>
>
>
> Thanks
>
> -- Ashique
>
>
>
> |-----------------------------------------------------------------------------------
>
> | Ashique Tanveer
>
> | Booz | Allen | Hamilton
>
> |
>
> | Contractor, eRA Project, National Institute Of Health
>
> | Off: 301-451-1772 | Fax: 925-889-3635
>
> | Email: tan...@od..., tan...@ba...
>
> |-----------------------------------------------------------------------------------
>
>
>
> ______________________________________________________________________
> From: David RR Webber (XML) [mailto:da...@dr...]
> Sent: Monday, May 08, 2006 12:33 PM
> To: ebx...@li...
> Subject: [ebxmlms-general] Configuring SSL and Hermes - step by step
> Guide
>
>
>
>
> Team,
>
>
>
>
>
> Does anyone have any notes they can share on setting up Hermes <->
> Hermes using SSL?
>
>
>
>
>
> The Hermes docs are not forthcoming on this - so would be helpful to
> have something available.
>
>
>
>
>
> More to the point - if you succeeded in getting this working - can you
> share the steps you
>
>
> had to go thru?!
>
>
>
>
>
> Thanks, DW
>
>
> ------------------------------------------------------- Using Tomcat
> but need to do more? Need to support web services, security? Get stuff
> done quickly with pre-integrated technology to make your job easier
> Download IBM WebSphere Application Server v.1.0.1 based on Apache
> Geronimo
> http://sel.as-us.falkag.net/sel?cmd=lnk&kid=120709&bid=263057&dat=121642 _______________________________________________ ebxmlms-general mailing list ebx...@li... https://lists.sourceforge.net/lists/listinfo/ebxmlms-general
>
>
--
Ladislav Urban
CEO
Webswell Inc.
1333 Howe Avenue, Suite 100
Sacramento, 95825 CA
email: lad...@we...
phone: +1 (916) 290-2040
fax: +1 (916) 921-2850
http://www.webswell.com
|
|
From: Tanveer, A. \(NIH/OD\) [C] <tan...@od...> - 2006-05-08 16:53:24
|
=20 I guess I am looking for something like a "SSL configuration with Hermes for dummies". Assuming I have two Hermes server running on Tomcat server, what are the steps (generate the certificate, keystore etc,?) to have both Hermes communicate via SSL. I assume some configuration needed on the tomcat as well as hermes properties files? Any tips would help. =20 Thanks -- Ashique =20 |----------------------------------------------------------------------- ------------ | Ashique Tanveer | Booz | Allen | Hamilton | | Contractor, eRA Project, National Institute Of Health | Off: 301-451-1772 | Fax: 925-889-3635 | Email: tan...@od..., tan...@ba...=20 |----------------------------------------------------------------------- ------------ ________________________________ From: David RR Webber (XML) [mailto:da...@dr...]=20 Sent: Monday, May 08, 2006 12:33 PM To: ebx...@li... Subject: [ebxmlms-general] Configuring SSL and Hermes - step by step Guide =20 Team, =20 Does anyone have any notes they can share on setting up Hermes <-> Hermes using SSL? =20 The Hermes docs are not forthcoming on this - so would be helpful to have something available. =20 More to the point - if you succeeded in getting this working - can you share the steps you=20 had to go thru?! =20 Thanks, DW ------------------------------------------------------- Using Tomcat but need to do more? Need to support web services, security? Get stuff done quickly with pre-integrated technology to make your job easier Download IBM WebSphere Application Server v.1.0.1 based on Apache Geronimo http://sel.as-us.falkag.net/sel?cmd=3Dlnk&kid=3D120709&bid=3D263057&dat=3D= 121642 _______________________________________________ ebxmlms-general mailing list ebx...@li... https://lists.sourceforge.net/lists/listinfo/ebxmlms-general=20 |
|
From: David RR W. \(XML\) <da...@dr...> - 2006-05-08 16:32:58
|
<div>Team,</div> <div> </div> <div>Does anyone have any notes they can share on setting up Hermes <-> Hermes using SSL?</div> <div> </div> <div>The Hermes docs are not forthcoming on this - so would be helpful to have something available.</div> <div> </div> <div>More to the point - if you succeeded in getting this working - can you share the steps you </div> <div>had to go thru?!</div> <div> </div> <div>Thanks, DW</div> |
|
From: Amir K. <am...@de...> - 2006-05-08 10:33:51
|
Hi,
I've struggled to get this working but right now I have the webapp
deployed in tomcat. I am using MySQL and have imported the schema(s).
What I've found is that I can send a loop back test to the server. and I
see a file appear in the repository folders, however when deserializing
the XML back to an object the AS2 engine seems to have a problem with
classcasting.
e.g.
2006-05-08 11:04:45 [Thread-6 ] <DEBUG> <AS2 Message
[20060508-110432-34101@127.0.0.1, From: Sender, To: Receiver] is being
captured>
2006-05-08 11:04:45 [Thread-6 ] <DEBUG> <Clearing cache of AS2
Message [20060508-110432-34101@127.0.0.1, From: Sender, To: Receiver]: true>
2006-05-08 11:04:46 [Thread-7 ] <ERROR> <Outgoing message task failure>
java.lang.ClassCastException
at
hk.hku.cecid.edi.as2.dao.RepositoryDataSourceDVO.getContent(RepositoryDataSourceDVO.java:34)
at
hk.hku.cecid.edi.as2.module.OutgoingMessageTask.execute(OutgoingMessageTask.java:75)
at
hk.hku.cecid.piazza.commons.module.ActiveThread.run(ActiveThread.java:90)
at
hk.hku.cecid.piazza.commons.module.ActiveTaskModule.execute(ActiveTaskModule.java:150)
at
hk.hku.cecid.piazza.commons.module.ActiveModule.run(ActiveModule.java:205)
at java.lang.Thread.run(Thread.java:534)
2006-05-08 11:05:32 [-Processor24] <INFO > <Message Receiver received
request - From: Sender, To: Receiver, Number of Messages: -1>
2006-05-08 11:05:46 [Thread-7 ] <ERROR> <Outgoing message task failure>
hk.hku.cecid.edi.as2.AS2Exception: No repository found for outgoing AS2
message: 20060508-110432-34101@127.0.0.1
at
hk.hku.cecid.edi.as2.module.OutgoingMessageTask.execute(OutgoingMessageTask.java:112)
at
hk.hku.cecid.piazza.commons.module.ActiveThread.run(ActiveThread.java:90)
at
hk.hku.cecid.piazza.commons.module.ActiveTaskModule.execute(ActiveTaskModule.java:150)
at
hk.hku.cecid.piazza.commons.module.ActiveModule.run(ActiveModule.java:205)
at java.lang.Thread.run(Thread.java:534)
Looking in the database the message table is empty (unsure why we have
this if we are persisting to the file system??). Looking in the file
system i see
as2-incoming-repository <-- empty after message send.
as2-message-repository <- messages appear in here
as2-outgoing-repository <-- empty
Here is the run log (from client)
[amir@khan server_test]$ ./loopback.sh as2
- Module 'Corvus Partnership' initialized successfully.
Start sending AS2 loopback test case.
Sent AS2 loopback test case with returned message ID
20060508-110432-34101@127.0.0.1.
Start checking the received list.
No messages.
End checking the received list.
============================
AS2 loop back test finished.
============================
[amir@khan server_test]$
|
|
From: Steven H. <sh...@te...> - 2006-03-30 22:05:24
|
I got an email from them after a day or so with the pricing in it. But I don't think I'm allowed to share it. A summary is, the 'appliance' is reasonable, but I would consider the enterprise license price per CPU 'eye watering'. _____ From: ebx...@li... [mailto:ebx...@li...] On Behalf Of David RR Webber (XML) Sent: Friday, March 31, 2006 5:50 AM To: ebx...@li... Cc: David (NIH/OD) Webber; ebxmlms-general; Vladimir Alexovic; Ladislav Urban Subject: [ebxmlms-general] Hermes 2 sales support / pricing Has anyone heard anything from the sales folks at iASPEC http://www.iaspec.com/ ? I sent an email last week requesting information on pricing and support options - but I have not heard anything back. My client is keenly interested in discovering what options are available for Hermes 2. At minimum an acknowledgement of my message would be nice, and a guesstimate of when such sales information might be forthcoming... Thanks, DW ------------------------------------------------------- This SF.Net email is sponsored by xPML, a groundbreaking scripting language that extends applications into web and mobile media. Attend the live webcast and join the prime developer group breaking into this new coding territory! http://sel.as-us.falkag.net/sel?cmd=lnk&kid=110944&bid=241720&dat=121642 _______________________________________________ ebxmlms-general mailing list ebx...@li... https://lists.sourceforge.net/lists/listinfo/ebxmlms-general |
|
From: David RR W. \(XML\) <da...@dr...> - 2006-03-30 18:50:13
|
<div>Has anyone heard anything from the sales folks at iASPEC <A href="http://www.iaspec.com/">http://www.iaspec.com/</A> ?</div> <div> </div> <div>I sent an email last week requesting information on pricing and support options - but I have not heard anything back.</div> <div> </div> <div>My client is keenly interested in discovering what options are available for Hermes 2.</div> <div> </div> <div>At minimum an acknowledgement of my message would be nice, and a guesstimate of when such sales information might be forthcoming...</div> <div> </div> <div>Thanks, DW</div> |
|
From: David RR W. \(XML\) <da...@dr...> - 2006-03-30 18:45:23
|
<div>Team,</div> <div> </div> <div>Based on our benchmarking using the Hermes 2 loopback test - it appears that for large payload the AXIS based httpSend is 10x faster than the current Hermes 1 JAXM based httpSend.</div> <div> </div> <div>A 15Mbyte payload took less than 2 minutes to transfer - whereas with Hermes 1 this would take upwards of 15 to 20 minutes.</div> <div> </div> <div>The question therefore arises - looking at the Hermes 1 delivery code - it uses httpSend() class.</div> <div> </div> <div>Since this seems to do a complete hand-off to JAXM (which uses the slow sendmail based MIME) and simply return at that point - how feasible is it to create a wrapper method - that would instead use the AXIS send function as a plug-in replacement?</div> <div> </div> <div>Doing this would allow Hermes 1 and Hermes 2 to both use AXIS as the SOAP messaging layer - and obviously also give a 10x performance boost to Hermes 1.</div> <div> </div> <div>Can anyone who has worked with AXIS suggest if this is indeed feasible (obviously Hermes 2 is the example).</div> <div> </div> <div>Thoughts?</div> <div> </div> <div>DW</div> |
|
From: Dorris T. <cw...@ce...> - 2006-03-23 04:26:09
|
*Hermes Messaging Gateway v2.0 Enterprise Edition Available* Hong Kong SAR, Peoples Republic of China -- March 23, 2006 - Center for E-Commerce Infrastructure Development (CECID), The University of Hong Kong (HKU) and iASPEC Technologies announce the release of Hermes Messaging Gateway v2.0 Enterprise Edition (Hermes 2 EE). With the GPL community edition released last December, this non-GPL enterprise edition comes with additional features including an installation wizard, message status query capabilities, and a Web-based administrative tool for easy configuration and management of the messaging gateway. Full documentation - an installation guide, configuration guide, admin tool user guide, plug-in development guide and technical reference of Hermes 2 -- is bundled with the Enterprise Edition, along with iASPEC's Silver Support Service. The whole package helps users to get Hermes up and running more quickly and to develop applications efficiently. It also frees OEMs and service providers from GPL's requirement of distributing their proprietary source code. Hermes 2 EE can be obtained through iASPEC Technologies (http://www.iaspec.com/Hermes2.htm). Completed Drummond Group's AS2 Interoperability Testing AS-1Q05 (http://ebusinessready.org/as2.html), Hermes 2 enables real-time communication through HTTP or HTTPS to transmit data over the Internet. Besides, it provides security for the transport payload through Secure Multi-Purpose Internet Mail Extensions (S/MIME), digital signatures and encryption, while reliability and non-repudiation are achieved through the use of receipts. It operates as a Java web application. The ebXML Messaging Service (ebMS) and AS2 messaging capabilities are facilitated by the corresponding plug-ins, which can be easily developed by users through Hermes' Simple Plug-in Architecture specification. The messaging operation uses a database with JDBC connectivity to keep track of the messaging status. About CECID (www.cecid.hku.hk <http://www.cecid.hku.hk/index.php>) Established in January 2002, Center for E-Commerce Infrastructure Development (CECID) at the University of Hong Kong conducts e-commerce research and development with the vision of helping organizations increase their competitiveness in the global economy. CECID develops e-commerce enabling technologies, participates in important international e-commerce initiatives, as well as supports e-commerce standardization for Hong Kong and the Asia Pacific Region. With projects primarily funded by the Hong Kong Government's Innovation and Technology Commission, CECID also takes on the mission to transfer knowledge and technology to the community. Besides organizing forums and seminars, the Center licenses its R&D results through the University of Hong Kong to IT industry. Its acclaimed e-commerce technology, Hermes, has penetrated over 80 economies and won the Best Infrastructure and Communication Application of the Linux Business Award 2005 as well as Certificates of Merit of the Asia-Pacific ICT Awards 2004 and HK Computer Society IT Excellence Award 2004. About iASPEC (www.iaspec.com <http://www.iaspec.com>) iASPEC is an IT consulting and software services firm headquartered in Hong Kong. Since its founding in 1988, the Company has built a solid reputation with proven track records in serving its local and international customers. The Company has subsidiaries and associated firms in Mainland China and the United States of America. Leveraging on the combined strength of its multi-location operations, iASPEC provides innovative software products, high-quality IT consulting and professional services to its clients in these expanded regions. PR Contacts for Press and Analysts: Dorris Tai (cw...@ce...) Business Manager Center for E-Commerce Infrastructure Development (CECID) Dept. of Computer Science The University of Hong Kong Tel: +852 2859 2818 Fax: +852 2547 4611 URL: http://www.cecid.hku.hk |
|
From: David RR W. \(XML\) <da...@dr...> - 2006-03-17 19:37:52
|
<div>Sleuthing into the whole process of H1 -> ApacheSOAP -> H1 with 20MB payloads.</div> <div> </div> <div>Our analysis shows that the H1 httpSend class completes quickly.</div> <div> </div> <div>So - on the receiving end - we have a 20 minute wait - with little CPU, disk i/o or network traffic.</div> <div> </div> <div>The only thing I can think of is that there is a ton of memory allocation going on....</div> <div> </div> <div>Could it be that H1 is allocating memory in blocks - when it receives content from ApacheSOAP - above a certain size - and that this is cuasing the huge performance bottleneck?</div> <div> </div> <div>Alternatively - is there something in Apache itself that needs to be tweeked?</div> <div> </div> <div>Thanks, DW</div> |
|
From: David RR W. \(XML\) <da...@dr...> - 2006-03-17 17:10:08
|
<div>Folks,</div> <div> </div> <div>We've spent this week profiling Hermes 1.0.1 interchanges.</div> <div> </div> <div>If you are sending payloads under 2MB - then everything works well.</div> <div> </div> <div>Transmission and handling times are in a few seconds range.</div> <div> </div> <div>However - for the 20MB payload we have something very strange is </div> <div>happening.</div> <div> </div> <div>Hermes takes only a few seconds to both package the payload, and then inititiate the httpSend, and similarly - when it receives it - just a few seconds to handle the incoming message.</div> <div> </div> <div>In between however - the machine sits there for TWENTY MINUTES - doing nothing of much at all - almost no CPU use, and no disk I/O, little network activity. Eventually the payload crosses over the Apache SOAP interface and is delivered.</div> <div> </div> <div>Using just a plain WSDL SOAP send - then the same payload takes only a minute to transfer.</div> <div> </div> <div>It's almost as if there is some delay timer somewhere?</div> <div> </div> <div>Has anyone experienced this with Hermes / Apache? Is there some parameter to set somewhere to remove this huge delay? Apache or Hermes settings?</div> <div> </div> <div>Can anyone suggest somewhere to look / change to isolate the problem area?</div> <div> </div> <div>We've traced all the execution classes and methods we think make sense - and all seem normal.</div> <div> </div> <div>What are we missing here?</div> <div> </div> <div>Thanks, DW</div> <div> </div> |
|
From: Patrick Y. <kc...@ce...> - 2006-03-03 06:28:33
|
Hello, You are right that the Monitor is a client application. In the Hermes architecture, the application will not get the ebMS acknowledgement message. Our rationale is that, the ebMS acknowledgement message is only for the decision of the message handler (i.e. Hermes), the application should not get that. Instead, in Hermes, the application can turn on the so-called "positive acknowledgement" in the configuration file in order to get a status update message from Hermes, which notifies the application on the status of the sent message. Hope this helps. Regards, Patrick Yee Center for E-Commerce Infrastructure Development Making E-Commerce Everyday Commerce Arjan Huijzer wrote: > Hi all, > > I have just installed Hermes 1.0 and am trying to send some messages. > I have the foillowing setup: > - Hermes installation at http://localhost:8080/msh/ > - Monitor client app for http://localhost:8080/msh/ > - Hermes installation at http://localhost:9080/msh/ > - Monitor client app for http://localhost:9080/msh/ > > When I send a message between the two Hermes installations with > Reliable Messaging I cannot see the Acknowledgement message in either > Monitor app. In the log files I can see that the acknowledgement > message is sent. On the file system, the acknowledgement message is > persisted (for both Hermes installations). > > My question is: how can I get the ack messages to display in my > Monitor applications? > > Thanks in advance for any help, > > Arjan Huijzer > Capgemini |
|
From: Arjan H. <hu...@gm...> - 2006-02-20 13:07:39
|
Hi all, I have just installed Hermes 1.0 and am trying to send some messages. I hav= e the foillowing setup: - Hermes installation at http://localhost:8080/msh/ - Monitor client app for http://localhost:8080/msh/ - Hermes installation at http://localhost:9080/msh/ - Monitor client app for http://localhost:9080/msh/ When I send a message between the two Hermes installations with Reliable Messaging I cannot see the Acknowledgement message in either Monitor app. I= n the log files I can see that the acknowledgement message is sent. On the file system, the acknowledgement message is persisted (for both Hermes installations). My question is: how can I get the ack messages to display in my Monitor applications? Thanks in advance for any help, Arjan Huijzer Capgemini |
|
From: Patrick Y. <kc...@ce...> - 2006-02-16 08:39:13
|
hi... i believe this is a hermes2 question, am i right? if so, please go to discussion list at cec...@go.... you may subscribe to the list at http://groups.google.com/group/cecid-hermes2. Regards, Patrick Yee Center for E-Commerce Infrastructure Development Making E-Commerce Everyday Commerce Christopher Gorge Marges wrote: >I couldn't find the source for the loopback test. There is only the >corvus-loopback-test.jar file in the binary zip file. Also where >could I get a sample of a partnership xml file to be used for setting >up partnerships? > > >------------------------------------------------------- >This SF.net email is sponsored by: Splunk Inc. Do you grep through log files >for problems? Stop! Download the new AJAX search engine that makes >searching your log files as easy as surfing the web. DOWNLOAD SPLUNK! >http://sel.as-us.falkag.net/sel?cmd_______________________________________________ >ebxmlms-general mailing list >ebx...@li... >https://lists.sourceforge.net/lists/listinfo/ebxmlms-general > > > |
266 messages has been excluded from this view by a project administrator.
