title: SOAPUi and keystore
body: <p>Recently, i had to enhance SOAP communications between me and a web service.
  After creating a private key file on my server and after CSR was created/sent, a certificate  file was received in PEM format.</p>
  
  <p>I want to test it in SOAPUi but it keeps saying that <strong>Error: Access is Denied. Client SSL Certificate Required</strong>.</p>
  
  <p>Here what i did :</p>
  
  <ul>
  <li><p>Certificate conversion</p>
  
  <pre><code>openssl pkcs12 -export -out **certif.p12** -inkey **myprivatekey.pem** -in **Certificate-received.pem**
  </code></pre></li>
  <li><p>Keystore import</p>
  
  <pre><code>keytool -importkeystore -deststorepass **changeit** -destkeypass **changeit** -destkeystore **pierrejks.jks** -srckeystore **certif.p12** -srcstoretype PKCS12 -srcstorepass **tenzin** -alias 1
  </code></pre></li>
  </ul>
  
  <p>In SOAPUi,</p>
  
  <p>I went to <strong>preferences</strong> and in <strong>SSL Settings</strong> Tab, </p>
  
  <ul>
  <li><p>keystore was set to be pierrejks.jks </p></li>
  <li><p>keystore password provided :  <strong>changeit</strong></p></li>
  <li><p>requires client authentication was ticked.</p></li>
  </ul>
  
  <p>On the project now ( Right click on project's root then Show Project View), i went to <strong>WS-Security Configurations</strong>, <strong>keystore</strong> tab to add a new source. </p>
  
  <ul>
  <li>Source is the path to <strong>pierrejks.jks</strong> file</li>
  <li>Password is <strong>changeit</strong></li>
  <li>Defaults Alias is set to pierrealias</li>
  <li>No Alias Password provided</li>
  </ul>
  
  <p>After filling these information, <strong>status</strong> became ok</p>
  
  <p>In the <strong>Outgoing WS-Security Configurations</strong>, a configuration was added with a new <strong>WSS-Entry Encryption</strong>.</p>
  
  <ul>
  <li>Configuration Name is <strong>pierreconf</strong></li>
  <li>WSS Entry type is <strong>Encryption</strong></li>
  <li>Keystore choosen is <strong>pierrejks.jks</strong></li>
  <li>Alias is <strong>1</strong></li>
  <li>password is <strong>changeit</strong></li>
  </ul>
  
  <p>Finally, a request is made with <strong>pierreconf</strong> Outgoing WSS profile and this is were i have the error. 
  At this moment, if i understand correctly, RAW tab shows that it is encrypted :</p>
  
  <pre><code>POST https://gsxapi.apple.com/gsx-ws/services/emea/iphone HTTP/1.1
  Accept-Encoding: gzip,deflate
  Content-Type: text/xml;charset=UTF-8
  SOAPAction: "urn:authenticate"
  Content-Length: 3047
  Host: gsxapi.apple.com
  Connection: Keep-Alive
  User-Agent: Apache-HttpClient/4.1.1 (java 1.5)
  
      &lt;soapenv:Envelope xmlns:glob="http://gsxws.apple.com/elements/global" xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/"&gt;
         &lt;soapenv:Header&gt;&lt;wsse:Security xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsu="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-utility-1.0.xsd"&gt;&lt;xenc:EncryptedKey Id="EK-974B3C3F270F85DA2A143289398095719" xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"&gt;&lt;xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p"/&gt;&lt;ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#"&gt;&lt;wsse:SecurityTokenReference&gt;&lt;ds:X509Data&gt;&lt;ds:X509IssuerSerial&gt;&lt;ds:X509IssuerName&gt;C=US,O=Apple Inc.,OU=Certification Authority,CN=Apple Corporate External Authentication CA 1&lt;/ds:X509IssuerName&gt;&lt;ds:X509SerialNumber&gt;6119460251051586160&lt;/ds:X509SerialNumber&gt;&lt;/ds:X509IssuerSerial&gt;&lt;/ds:X509Data&gt;&lt;/wsse:SecurityTokenReference&gt;&lt;/ds:KeyInfo&gt;&lt;xenc:CipherData&gt;&lt;xenc:CipherValue&gt;yWIQ5aWqy50ba/kaw3mLYyvpBL8S+mcQnkZri8q6deJXoNFZm+TGOry9ds5VCbsYzpgjAYGFRZxnEfnAirFDqojUgbthc6E/YeG15y1GShiBZrBB3U5KVk6ZIqRaOAVSBMCG5DXosFDz0I/MrToMA8MvX5A26pgp6siM6fhfVRLfFPDCJQOQJw3gr2G3IUnu0t4jf2BIs4FPObtOZSN1ou+w3ny2meL2F0VhT2UPDbZ46EKwHiY7Az9RVt0MocWRRQSR9FU4h6zqziWbUC95OrzrKXrbo01La8UDZ4mykQXqg==&lt;/xenc:CipherValue&gt;&lt;/xenc:CipherData&gt;&lt;xenc:ReferenceList&gt;&lt;xenc:DataReference URI="#ED-974B3C3F270F85DA2A143289398095720"/&gt;&lt;/xenc:ReferenceList&gt;&lt;/xenc:EncryptedKey&gt;&lt;/wsse:Security&gt;&lt;/soapenv:Header&gt;
         &lt;soapenv:Body&gt;&lt;xenc:EncryptedData Id="ED-974B3C3F270F85DA2A143289398095720" Type="http://www.w3.org/2001/04/xmlenc#Content" xmlns:xenc="http://www.w3.org/2001/04/xmlenc#"&gt;&lt;xenc:EncryptionMethod Algorithm="http://www.w3.org/2001/04/xmlenc#aes128-cbc"/&gt;&lt;ds:KeyInfo xmlns:ds="http://www.w3.org/2000/09/xmldsig#"&gt;&lt;wsse:SecurityTokenReference wsse11:TokenType="http://docs.oasis-open.org/wss/oasis-wss-soap-message-security-1.1#EncryptedKey" xmlns:wsse="http://docs.oasis-open.org/wss/2004/01/oasis-200401-wss-wssecurity-secext-1.0.xsd" xmlns:wsse11="http://docs.oasis-open.org/wss/oasis-wss-wssecurity-secext-1.1.xsd"&gt;&lt;wsse:Reference URI="#EK-974B3C3F270F85DA2A143289398095719"/&gt;&lt;/wsse:SecurityTokenReference&gt;&lt;/ds:KeyInfo&gt;&lt;xenc:CipherData&gt;&lt;xenc:CipherValue&gt;cYyhZSw7/XR9Gtj7+lzkwwilTlpuAHVYdT+v8WeofYo48j8K0CReBIdeUI3pfWQ+cEj1D+VQO1k7e6fCsDuK7vZfrCG2qrYDlJmChnDrR7Tr5QSpC/ES3ohnYFqRrNnaOAhgjrqtDevww/S0dUKxmAFEbY18rvbF+l1T32da53zo1b9mN+sD9oKdWq7w+1eJHZOpJ4WQuMcdHp9DqAxizu4nc4FX65myZieI2qoWTzKGqeNMbqqyFFVpQ0iqI+7sT5Rh9Qc/Sw9pZMHxx3x856+PH/4PExTj/00f7rzhy6MhxEFavHksBraeGU6Ctd+xRMaA4Y/ZXGytf6M9C5j0v2SDqAFtwtj9Sky2uRzsXlNwmjinI29SsGAcOOBvyB7+Ff8rSATR3snMgvuNN3l0GsLDP1tzqz7vhHkCeKtsRCC8xtOqsZsz9QEmB31Gz3QMilsmsyhjdZ5QUsc+VU/HJhON2pzk7xL+V8zupc/uDoeg9AS38lti2nid5WDLAdG8j1IAU7ox/tJnAs7NTti9XN2nTcHf9u7laQfEm7i4VaLkn6hHsXf7JTE5GBkTF2sbR0cpSnIi2fYbHlU6EIugTgwU0875enhRQiyHhb84QByTfxig0bXaMCMnHDkdjH41+HoKu5SGxoPOyKp/JDpQaPY3J56RFrp0j8tRlqpUYIU=&lt;/xenc:CipherValue&gt;&lt;/xenc:CipherData&gt;&lt;/xenc:EncryptedData&gt;&lt;/soapenv:Body&gt;
      &lt;/soapenv:Envelope&gt;
  </code></pre>
  
  <p>Return message is </p>
  
  <pre><code>HTTP/1.1 401 Access Denied
  Connection: close
  Content-Length: 57
  Content-Type: text/html
  Cache-Control: no-cache,no-store
  Pragma: no-cache
  
  Error: Access is Denied. Client SSL Certificate Required.
  </code></pre>
  
  <p>How to use SSL is not clear to me at the moment.</p>
  
  <p>I'm sure i did some mistakes, can someone point me in the right direction ?</p>