UPDATE 14/07/2012: The author of the client has released version 2.5 a short while ago and also a video for using self-signed certificates in the client.
RESTClient is a great little CLI and GUI tool for testing your REST API. I recently pushed a new API up in the office and it runs over SSL. I tried to test it in the RESTClient and got a PeerNotVerified error from Java. First thing I did was go to the SSL tab in RestClient presuming I could tell it to just trust the API…apparently not.
So after a bit of web scouring about how to get Java to trust your site I came across instructions and thought I’d re-post here simplified for anyone who needs to query HTTPS from RESTClient.
These instructions are based on Windows 64-bit and Java being installed into C:Program Files (x86)Java. So you may have to change a few paths but the core things are the same.
Navigate to the website in your browser, click the SSL icon in the address bar and click Certificate Information or Details etc.In the window that pops up, go to the Details tab then click the “Copy to File” button. Click Next until you get to the request for a Filename. Click Browse and navigate to “C:Program Files (x86)Javajre6libsecurity”. Enter the filename to save the certificate as (I suggest the domain name with .cer ending). Finally click Next and Finish.
Now open up a command prompt (if you’ve got Windows security then be sure to run as administrator [right click the shortcut to the command prompt and the option is there]) and enter the following:
cd "C:\Program Files (x86)\Java\jre6"
bin\keytool.exe -noprompt -import -keystore libsecuritycacerts
-alias (put_domain_name_here)
-file libsecurity(name_of_certificate_you_saved_above).cer
The second command should all be on one line. You’ll get asked for a password, if you’ve never touched any Java passwords on your machine before, it’ll probably be the certificate store default which is either changeit or changeme.
That’s it! You should now be able to query your service using HTTPS without any errors.
Hi,
Can you provide me the how to implement security at REST webservices?
Thanks & Regards,
Sriram.
@sriram
What is it you’re looking for exactly?
Tried your steps and still getting the same error (PeerNotVerified). Are there additional steps needed when it’s a two-way SSL? We are using client certificate to authenticate so the certificates need to be passed along with the request to the server.
Sorry for not replying, don’t get notices. I’ve not done two way sorry!
ola, eu Achei bom! mas ! quero mais informaçâo!!
Hi Wade,
I have a requirement that uses pkcs client cert. I was not able to get the client to accept the certificate. Is there any plans in future to support pkcs certificates?
Hello Srinath
I didn’t write the client so I have no idea on future plans. Since writing this I’ve released my own Windows rest client with no SSL issues: http://xcitestudios.com/best-of-the-rest/
Disclaimer: I am the owner of WizTools.org RESTClient featured in this blog.
I released version 2.5 today with improved support for SSL (self-signed certificate and TLS two way authentication). A quick video is also available:
I’ve been exploring for a bit for any high-quality articles or blog posts on this sort of area . Exploring in Yahoo I at last stumbled upon this site. Studying this info So i am glad to exhibit that I’ve a very good uncanny feeling I discovered exactly what I needed. I most certainly will make sure to do not omit this website and give it a glance regularly.