How to obtain a remote X509 certificate?

Have you ever tried to obtain an X509 certificate from a remote site? This is quite required when you need to write a PHP client to securely access a web service using WSF/PHP. Or may be a Ruby client using WSF/Ruby.
Naaah...!!! this is not only for WSF or for web services stuff. But also if you need simply to encrypt locally and send the file as an attachment to a remote party via mail or to verify a signature of an attachment.
OK. This is how you do it. Simply enter the following command. Here we are going to obtain the google's certificate. Never forget to have openssl installed in your system.

echo | openssl s_client -connect 64.233.161.103:443 2>&1 | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > cert.cert

Note that we are saving the file as cert.cert. You are free to use any file name.
OK. Now by simply replacing the ip address (64.233.161.103) from yours, you can obtain the X509 certificate of your desired site.

Apache Rampart/C 1.2.0 unleashed

Unleashed to secure Apache Axis2/C 1.4.0.
Download Apache Rampart/C here

Key features of the release includes
1. Ability to send and verify UsernameTokens with
- Username and PlainText password
- Username and Digested password

2. Ability to send Timestamp tokens

3. SOAP message encryption
- With derived key support for improved security
- Symmetric and Asymmetric modes of operations
- Support for AES and Tripple DES encryption
- Signature encryption
- Keys encryption

4. SOAP message signature
- XML signature with RSA-SHA1
- Message authentication with HMAC-SHA1
- Signature confirmation support
- SOAP Header signing

5. WS-Security Policy (spec 1.1) based configurations
- Support for both Symmetric as well as Asymmetric policy bindings
- Support for different modes of key identifiers
- Support for different algorithm suites
[Basic128, Basic 192, Basic256, TrippleDES, Basic128Rsa15, Basic192Rsa15,Basic256Rsa15, TripleDesRsa15]
- Support for IssuedToken assertion in client side.
- Support for SAMLToken assertion.

6. Replay detection support
- Easy to use built-in replay detection module
- Ability to deploy a customized replay detection module

7. Different protection orders
- Encrypt before signing
- Sign before encrypting

8. Extensible modules
- Password callback module
- Authentication module
- Credentials module

9. Keys management
- Support for X509 token profile
- Support for Key identifiers, Thumb prints, Issuer/Serial pairs, Embedded and Direct references

10. WS-Secure Conversation Language support (Experimental)
- Establishing Security Context and thereby maintaining a session
- Per message key derivation
- Support for stored securtiy context token

11. WS-Trust Language support (Experimental)
- Security Token Services (STS)
- STS Client
- Server and Client entrophy support

12. SAML Support
- Support for Creation and Processing of SAML Core 1.1 Assertions
- SAML Token as Sign Supporting Token

10. Other
- Easy to use deployment scripts
- A comprehensive set of samples

Writing a secure client in Ruby

WSF/Ruby provides an easy to use API to consume and deploy web services. Adding the Apache Rampart/C features, it also provides SOAP message confidentiality, integrity and authentication.
In the following four easy steps we will show how to write a secure client using WSF/Ruby.

1. Create the policy. Here we need to encrypt using the Basic256Rsa15 algorithm suite and the relavent key information should be identified using the Issuer name and the serial number of the certificate

      
       policy_content = {"encrypt"=> true,
                     "algorithm_suite" => "Basic256Rsa15",
                     "security_token_reference" => "IssuerSerial"}
       policy = WSPolicy.new({"security" => policy_content}

2. Create the security token. Note that the private keys and certificates need to be loaded

  
   security_options = {"private_key" => pvt_key,
                       "receiver_certificate" => rec_cert}
   security_token = WSSecurityToken.new(security_options)

3. Create options for policy and security token. Here the use_wsa=true means that the clinet MUST include WS Addressing header in the message.

  
   options = {"use_wsa" => true,
              "policy" => policy,
              "security_token" => security_token}

4. Request from the service. For this we need to create the client.

  
    client = WSClient.new(options, LOG_FILE)
    res_message = client.request(payload)

The complete source code is as follows.

  
require 'wsf'
require 'rexml/document'

include WSO2::WSF
include WSO2::Util

#This is your pay load
req_payload = << XML
Hello World!
XML

begin
   LOG_FILE = "security_sample.log"
   ACTION = "http://php.axis2.org/samples/echoString"
   END_POINT = "http://localhost:3000/encryption/encryption"

   message_properties = {"to" => END_POINT,
                         "action" => ACTION}

   #Load certificates and keys from the disk
   rec_cert = WSUtil::ws_get_cert_from_file("../keys/bob_cert.cert")
   pvt_key = WSUtil::ws_get_key_from_file("../keys/alice_key.pem")
 
  #The payload or the body of the SOAP message
   payload = WSMessage.new(req_payload,
                           nil,
                           message_properties)

    #Create the security policy
   policy_content = {"encrypt"=> true,
                     "algorithm_suite" => "Basic256Rsa15",
                     "security_token_reference" => "IssuerSerial"}

   policy = WSPolicy.new({"security" => policy_content})

    #Create the security token
   security_options = {"private_key" => pvt_key,
                       "receiver_certificate" => rec_cert}
 
   security_token = WSSecurityToken.new(security_options)

    #Create option for the client
   options = {"use_wsa" => true,
              "policy" => policy,
              "security_token" => security_token}
  
    #Create a client instance
   client = WSClient.new(options, LOG_FILE)

    #Request
   res_message = client.request(payload)

   if not res_message.nil? then
      puts "Received OM: "<< "\n" << res_message.payload_to_s << "\n\n"
      puts "Client invocation SUCCESSFUL !!!"
   else
      puts "Client invocation FAILED !!!"
   end

#If SOAP fault, print the details
rescue WSFault => wsfault
   puts "Client invocation FAILED !!!\n"
   puts "WSFault : "
   puts wsfault.xml
   puts "----------"
   puts wsfault.code
   puts "----------"
   puts wsfault.reason
   puts "----------"
   puts wsfault.role
   puts "----------"
   puts wsfault.detail
   puts "----------"

rescue => exception
   puts "Client invocation FAILED !!!\n"
   puts "Exception : " << exception
end

More security samples can be found here...

WSF/PHP : Creating Business-Conscious IT Solutions

In this article I have shown how to address a typical business communication scenario using WSF/PHP. It also discusses the importance of the message level security and shown how exactly those will be used in a scenario like this. The complete source code is available here.