How to call SOAP web service use httpclient with SSL

Question

Please HELP NOW, I want to call a api via SOAP and use httpclient 4.5.5

My Code

static String callApi(String url, String requestXml)
{
    String responseXml = "";        
    CloseableHttpClient httpClient = null;
    HttpPost httpPost;
    try
    {
        httpClient = HttpClients.createDefault();
        httpPost = new HttpPost(url);

        httpPost.setHeader("Content-Type", "text/xml; charset=utf-8");
        httpPost.setHeader("x-ibm-client-id", Config.csp.validKey);

        StringEntity entiry = new StringEntity(requestXml, "UTF-8");

        httpPost.setEntity(entiry);

        HttpResponse response = httpClient.execute(httpPost);

        HttpEntity entity = response.getEntity();
        responseXml = EntityUtils.toString(entity, "UTF-8");

    }
    catch (Exception ex)
    {
        log.error("", ex);
    }
    finally
    {
        try
        {
            if (httpClient != null)
                httpClient.close();
        }
        catch (Exception ex)
        {
            log.error("", ex);
        }
    }
    return responseXml;
}

And when i debug then show error

javax.net.ssl.SSLPeerUnverifiedException: Certificate for <10.xx.xx.xx> doesn't match any of the subject alternative names: [*.domain.vn, domain.vn] at org.apache.http.conn.ssl.SSLConnectionSocketFactory.verifyHostname(SSLConnectionSocketFactory.java:467) ~[httpclient-4.5.5.jar:4.5.5] at org.apache.http.conn.ssl.SSLConnectionSocketFactory.createLayeredSocket(SSLConnectionSocketFactory.java:397) ~[httpclient-4.5.5.jar:4.5.5] at org.apache.http.conn.ssl.SSLConnectionSocketFactory.connectSocket(SSLConnectionSocketFactory.java:355) ~[httpclient-4.5.5.jar:4.5.5] at org.apache.http.impl.conn.DefaultHttpClientConnectionOperator.connect(DefaultHttpClientConnectionOperator.java:142) ~[httpclient-4.5.5.jar:4.5.5] at org.apache.http.impl.conn.PoolingHttpClientConnectionManager.connect(PoolingHttpClientConnectionManager.java:373) ~[httpclient-4.5.5.jar:4.5.5] at org.apache.http.impl.execchain.MainClientExec.establishRoute(MainClientExec.java:381) ~[httpclient-4.5.5.jar:4.5.5] at org.apache.http.impl.execchain.MainClientExec.execute(MainClientExec.java:237) ~[httpclient-4.5.5.jar:4.5.5] at org.apache.http.impl.execchain.ProtocolExec.execute(ProtocolExec.java:185) ~[httpclient-4.5.5.jar:4.5.5] at org.apache.http.impl.execchain.RetryExec.execute(RetryExec.java:89) ~[httpclient-4.5.5.jar:4.5.5] at org.apache.http.impl.execchain.RedirectExec.execute(RedirectExec.java:111) ~[httpclient-4.5.5.jar:4.5.5] at org.apache.http.impl.client.InternalHttpClient.doExecute(InternalHttpClient.java:185) ~[httpclient-4.5.5.jar:4.5.5] at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:83) ~[httpclient-4.5.5.jar:4.5.5] at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:108) ~[httpclient-4.5.5.jar:4.5.5]

Please help. thank so much

I would strongly suggest you use a library that's actually designed for SOAP (such as CXF) rather than mucking about with a library that's only designed for basic HTTP. As for your error: that looks like an invalid SSL certificate — Jeroen Steenbeeke, May 15 '18 at 07:02
see this may help you :https://stackoverflow.com/questions/40806615/soap-request-with-http-client-with-client-certification-connection-timed-out-exc — Amol Raje, May 15 '18 at 07:38
possible [duplicate](https://stackoverflow.com/questions/19517538/ignoring-ssl-certificate-in-apache-httpclient-4-3) — Eugène Adell, May 15 '18 at 07:49
Thank so much your support. @Eugène Adell, yes, that's right. I found the answer for my ask. thank. — chilinh12003, May 16 '18 at 06:59

score 0 · Answer 1 · answered May 15 '18 at 18:38

You're not showing how you call callApi() but I'm guessing you're addressing your host with a 10.xx.xx.xx IP address instead of one of the names contained in its certificate.

You can't do this when host name verification is in force.

Preferably you should change to addressing it by its certificate common name or one of the Subject Alternative Names (SAN). However, if you can't do that, and since the 10.* IP address range is a private network you are probably safe to switch off host name verification for this server-to-server call.

Instead of this...

httpClient = HttpClients.createDefault();

Do this...

httpClient = HttpClients
               .custom()
               .setSSLHostnameVerifier(NoopHostnameVerifier.INSTANCE)
               .build();

The syntax may be slightly different depending on the version of Apache HttpClient that you are using.

THIS DISABLES A SECURITY CONTROL. DON'T DO THIS WHEN CALLING HOSTS ON NETWORKS YOU DO NOT CONTROL.

Thank, i found the answer in the post ([link](https://stackoverflow.com/questions/19517538/ignoring-ssl-certificate-in-apache-httpclient-4-3) — chilinh12003, May 16 '18 at 07:01

How to call SOAP web service use httpclient with SSL

1 Answers1