Adding SSL to Tomcat 6.0 Axis2 web service and client

If you want to add the SSL security to your web service (in Windows), please follow these steps:

1. Create a self-signed certificate on the server side using the "Keytool" utility found in your Java binary distribution.

keytool -genkey -alias tomcatWSServer -keyalg RSA

This will create a new file .keystore in the user's home directory. You can move it to your desired location.
a. Please note that you should not enter your first name/last name, instead please enter the name of the server on which tomcat is running. The clients who will be validating the certificate will match the name of the server and the name on the certificate to verify the authenticity.
b. Also they will be ensured that the request is coming from the same server as mentioned in the certificate to avoid phishing and other threats.
c. Please use the same password for Certificate and the Keystore both.

2. Enable the HTTPS configuration in the tomcat's server.xml as shown below.
Please note that i have moved the .keystore file under my JDK folder within a directory named as "keystore".

<-- Define a SSL Coyote HTTP/1.1 Connector on port 8443 -->
<!--
<Connector 
           port="8443" maxThreads="200"
           scheme="https" secure="true" SSLEnabled="true"
           keystoreFile="${user.home}/.keystore" keystorePass="changeit"
           clientAuth="false" sslProtocol="TLS"/>
-->

3. Export the self-signed certificate that you created in step#1, so that it can be distributed to the clients.
Command for export:
keytool -export -alias tomcatWSServer -storepass changeit -file server.cer -keystore C:\Program Files\Java\jdk1.6.0_24\keystore\.keystore

This command will generate the certificate with name server.cer. This can be distributed to all the clients who are intending to consume the web service.

3. On the client side, you will have to import this certificate to the truststore and CA Certificate Keystore typically located here:
C:\Program Files\Java\jdk1.6.0_24\jre\lib\security\cacerts

Please note that you have to choose the JRE used by your client application.

You can use the following command to import the certificate to your client's CA keystore:
keytool -import -v -trustcacerts -alias tomcatWSServer -file "C:\MyProjects\Web Service\server.cer" -keystore C:\Progra~1\Java\jdk1.6.0_24\jre\lib\security -keypass changeit -storepass changeit

You can also import using the utility like Keystore Explorer.

4. Your client should be able to now invoke the web service operations and do a successful SSL handshake.