Question

Is it possible to run SOAP over https? I got the impression that SOAP has its own security model that allows you to use encryption regardless of the transport mechanism. That being said we want to keep things simple and are wondering if we can just use our existing HTTPS setup in Jetty to make sure the SOAP converation over http is secured.

Answer 1

Yes, you can, see the Transport Methods section on this Wikipedia article.

To quote:

SOAP may also be used over HTTPS (which is the same protocol as HTTP at the application level, but uses an encrypted transport protocol underneath) with either simple or mutual authentication; this is the advocated WS-I method to provide web service security as stated in the WS-I Basic Profile 1.1.