Question

I need to make a HTTPS call from client. I do not need to send certificates to the server, just need to validate the certificate from the server.

i researched this topic and this is my understanding. Can you please confirm? I do not have a test service yet, against which to verify my code… but still need to meet deadlines.. any advice/input will be helpful.

I added this to my class:

private static String appKeyFile = "/project/src/security/cert_file.jck";  
private static String key = "password";  
static {  
    System.setProperty("javax.net.ssl.keyStore", appKeyFile);  
    System.setProperty("javax.net.ssl.keyStorePassword",key);  
    System.setProperty("javax.net.ssl.keyStoreType","JCEKS");  
}  

And am making the HTTPS call as follows:

config = new DefaultClientConfig();  
client = Client.create(config);  
service = client.resource(UriBuilder.fromUri("https://localhost:8081/TestService").build());  
clientResponse = service.path("rs").path("test").path("getCustomerDetail")  
        .accept(MediaType.APPLICATION_XML)  
        .post(ClientResponse.class, customerRequestType);  

if (clientResponse.getStatus() == Response.Status.OK.getStatusCode()) {   
    custResponseType = clientResponse.getEntity(CustResponseType.class);  
    System.out.println("First Name" + 
    custResponseType.getFirstName());  
}

Is this sufficient from SSL/HTTPS/certs etc point of view (other than debugging)? Is there anything else i need to do,like loading the keystore or initializing the SSLContext?

Answer 1

In case you are using self-signed certificate, you may face issues related to SSL Certificate validation. This link discusses this.