Client Side Authentication question

[Rumpa Giri]

Hello,

We need to post data to a secure URL, but for that they need the client certificate from our side. In the .net code that they have supplied how to do that, I see they have something like adding the client .cer file to the HttpRequest before sending the request.

The .net code looks like following:

    
X509Certificate mycert = X509Certificate.CreateFromCertFile(@"c:\mycert.cer");
req = (HttpWebRequest)WebRequest.Create(url);
req.ClientCertificates.Add(mycert);
req.Method = "POST";
req.ContentType = "text/xml";
int count = req.ClientCertificates.Count;
Stream up = req.GetRequestStream();
StreamWriter sw = new StreamWriter(up);
sw.Write(data);
sw.Flush();
sw.Close();
resp = (HttpWebResponse)req.GetResponse();
Stream s = resp.GetResponseStream();
StreamReader sr = new StreamReader(s);
httpData = sr.ReadToEnd();
sr.Close();
s.Close();
//now do whatever you want with the response
//if an error occurs in processing on the server side
//the httpData string will start with ERR=
}
catch(Exception e)
{
//handle the error here
}
finally
{
if(resp != null) resp.Close();
}
return httpData;
 

When we do HttpsURLConnection we do the following :

    
System.setProperty("javax.net.ssl.keyStore", "clientks.p12");
System.setProperty("javax.net.ssl.keyStorePassword", "changeit");
System.setProperty("javax.net.ssl.keyStoreType", "PKCS12");
 
System.setProperty("javax.net.ssl.trustStore", "cacerts");
System.setProperty("javax.net.ssl.trustStorePassword", "changeit");
 
  
HostnameVerifier hv = new HostnameVerifier() {
    public boolean verify(String urlHostName, SSLSession session) {
       System.out.println("Warning: URL Host: "+urlHostName+" vs. "+session.getPeerHost());
        return true;
    }
};
 
HttpsURLConnection.setDefaultHostnameVerifier(hv);
 

Will this suffice to do a client authentication from our side while posting to the URL?

Thanks in advance,
Rumpa Giri