Security

Apache Axis2 WS-Security message signing vulnerability (Version 1.5.1)

Note: See the bottom of this page to download the sample code used.

Rampart is the Apache Axis2 module that implements the WS-Security features. To add such features to your Web service, Axis2 provides two different configuration mechanisms. One depends on WS-SecurityPolicy and is the approach that is preferred. The other approach is known as the “parameter based configuration”.

Sample X.509 certificate collection with public/private keys (for Java)

If you want to test your Java application which requires digital certificates, here's a collection of such certificates with associated public/private keys in .jks format (the Java standard format - Java Key Store).

For example, you can use these to test Web services or enable SSL support of a Java server (and clients - if you want).

Java client connecting to an https resource via a proxy server that needs authentication

This doesn't look to be something trivial that you can simply do by passing the URL, proxy server host, port, user name and password to an already available class and getting the connection established.

You are a spammer anyway, even if you are not!

I recently encountered an irritating problem – in fact for the second time. My IP address received from the service provider is blacklisted at Spamhaus. Effect? I send legitimate emails to my clients, they don't receive them. Neither do I receive any warning.

Sri Lanka Telecom (SLT)

jkscertgen : Generate a full set of CA, service and client keys and certificates in Java keystores

You are into Java security. You want to generate some X.509 certificates to test your application (or use in your production environment). Here's a simple X.509 certificate generator script that makes your life very simple. Download and execute, it will do all the following and you get the keys and signed certificates.

Exporting the private key from a jks file (Java keystore)

Some seems to have used complicated mechanisms including writing new software to do so. Here's a simple approach:

1. Import the keystore from JKS to PKCS12

Man-In-The-Middle Phone Calls

It is 10.15 pm here in Colombo and the land phone rang. I picked it up and in two seconds I was connected to the Mobitel (a local mobile phone carrier) customer care service. And the usual song started, computer lady asked me to wait until an agent is free. Here’s the one for me: