I would like do use Atomic Transactions between WCF and Weblogic, but I'm facing many problems to configure it.
I've already turned on the Wsat on Windows and associated it a valid certificate. I also enabled the SSL on IIS and configured the https port.
My main doubts are about the right WCF binding configurations and how and where I import the IIS certificate on Weblogic.
I imported my Wsat certificate in Demo.jks file (Weblogic keystore), but it did not work.
Best regards,
ps: Forgive my poor english :)
Related
i am trying to find a way to enable SSL on SelfHost ServiceStack,
as this requires administrative rights today for using "Net SH", as well as the fact this is "Not Clean" as i need to maintain the Port outside of my application configuration, manage removal if port Change, etc.
any help will be awesome.
thanks.
Configuring ServiceStack HttpListener with SSL is the same as configuring any HttpListener with SSL.
My previous answer contains more details on configuring ServiceStack HttpListener with SSL.
I have WCf service hosted in windows service.
I would want to know how would i make service accessible only through SSL and use certificate provided by certificate issuer(Godaddy,verisign etc).
If you created a WCF-Service you'll be forced to use an Windows IIS Server to host your application. When using an IIS, you can specify the Port and an SSL-Certificate.
To do this, just
add a new Website to your IIS. Make sure, you are using an application pool that supports .NET Framework 4.0.
copy your compiled WCF-Service and all references/files that your services needs to the associated IIS-Site-Folder
Configure the Bindings of this IIS Page. You need an imported SSL-Certificate at this point. If you already imported it, you can choose it from a ListBox within the Bindings-Dialog.
Within that dialog, you can specify the port
Make sure you've opened that port on your firewall
If you delete other bindings (meaning all HTTP Bindings), you can make sure that your service is only reachable through SSL and your specific port.
If you need cheap, good and multidomain/wildcard certificates, please check out StartSSL. In my opinion, they serve you the best.
You can find more information about IIS Configuration here.
Does anyone know if it the IT-Hit WebDav Server (http://www.webdavsystem.com/server) can accept and check client certificates? Perhaps it is something that IIS does for the product when deployed in an IIS?
IT Hit WebDAV Server is based on IIS or HttpListener (two different implementations).
IIS supports client certificates, this means WebDAV Server based on IIS will work fine. All you need to do is setup your IIS.
As I see from this question HttpListener supports client certificates too. If you are missing something to make it work (can not reach some property for example), please contact me.
Context
I developed an application deployed in a Glassfish 3.1. This application is accessed only by https and sometimes it must connect to third-party webservices located out the customers networks. The customer have other applications inside his network; mine is only a new one "service".
Topology approximation
Big-ip F5 is the ssl end point. The customer have in this device the valid certificate
IIS redirects by domain to the respective service
glassfish is the machine with the application (over, of course, a glassfish 3.1)
How it works
When a user try to connect to _https://somedomain the request arrives to the F5 where the SSL encryption ends; now we have a request to _http://somedomain. In the next step F5 redirects this request to the IIS and this, finally, redirects to glassfish. This petitions are successfully processed.
Points of interest
I've full control over glassfish server and S.O. of the vm where it is located. Not other applications are or will be deployed on this server; it's a dedicated server for the app and some services it needs. The Glassfish runs on a VM with a Debian distribution as S.O. This VM is provided by a VM Server but I don't know the brand, model, etc. The glassfish have the default http listeners configuration.
I don't have any more information about network and other devices and i can't access to
any configuration file of any other device. I can't modify any part of the network for my own but maybe ask, suggest or advice for a change. Network's behavior should not change.
Actually users reach the application without problem.
The used certificate is a simple domain certificate trusted by Verysign
The customer have no idea of how to solve this.
The problem
All the third party WS the application must access have an unique https access and, in some cases, the authentication required is mutual (two-way) and here we find the problem. When the application wants to connect to WS with mutual ssl authentication it sends the glassfish local keystore configuration targeted certificate. Customer wants, if possible, use the same cert for incoming and outcoming secure connections. This cert is in the F5 and i can't add to the glassfish keystore because if I do this I would be breaking Verysign contract requirements. I've been looking for a solution at google, here(stackoverflow), jita,... but only incoming traffic solutions I've found. I understand that maybe a SSL proxy is required but I haven't found any example or alternative solution for the outcoming ssl connections.
What I'm asking for
I'm not english speaker (isn't obvious?) and maybe i doesn't use the correct terms in my search terms. I can understand that this context can be a nightmare and hard to solve but I will stand... The first think I need is to know if exists a solution (or solutions) for this problem and if it (or they!) exist where or how can I find it/them. I've prepared different alternatives to negotiate with the customer but I need to known the true. I've spent tones of hours on this.
There are a couple of solutions.
1)pay verisign more money for a second "license/cert". They will be happy to take your money for the "privilege". :)
2)Create a different virtual server listening on 443 which points to a pool that has your client's server address as the pool member. Then on the virtual server, attach a serverssl profile that is configured to use the same cert you are using for the incoming connections. Then the F5 would authenticate with the same cert along with your app server would not need a client cert installed. Also, if they need to initiate a session to you, you would have to setup a virtual server with a clientssl profile that uses the same cert and requires a client cert to connect.
If your destinations may not be static addresses, then an irule(s) would have to be created to deal with that. Can be handled in 10 or later code with a DNS call in the irule and setting a node for the session to go.
I need to set up SSL over Active Directory. I googled a lot but could not found a decent write up about how to do this. Please if you know some good resources about this let me know.
Thanks!
Sounds easy - but I ran into quite a few problems getting trusted connections with SSL working in our environment. The article was about ADAM but is just as applicable for AD. In our environment I couldn't install domain-related services like cert-server, nor act as domain-admin.
I blogged about how I got this working a while back
http://stephbu.wordpress.com/2006/11/29/using-adam-with-asp-net-2-0-activedirectorymembershipprovider/
Dan and Erlend's postings were invaluable.
Took some backflips to get it done.
The Lightweight Directory Access Protocol (LDAP) is used to read from and write to Active Directory. By default, LDAP traffic is transmitted unsecured. You can make LDAP traffic confidential and secure by using Secure Sockets Layer (SSL) / Transport Layer Security (TLS) technology. You can enable LDAP over SSL (LDAPS) by installing a properly formatted certificate from either a Microsoft certification authority (CA) or a non-Microsoft CA according to the guidelines in this article.
http://support.microsoft.com/kb/321051
Can you be more specific. What is the client trying to do? Active directory support ldap over ssl by default. There is nothing that should be done to activate it. It is done in port 636/tcp. http://technet.microsoft.com/en-us/library/bb727063.aspx
The absolute fastest way to install SSL into AD is to load MS certificate services. Once this is installed, all domain controllers will request a new certificate automatically and update themselves...