Common Issue with Certificates created on Windows

One of the common issues faced when dealing with certificates for doing SSL communication or WS-Security is that the certificates created on windows does not work on Linux. This is due to the addition of Windows Specific characters to the certificate. I have seen so many users struggle to get SSL/HTTPS working due to this problem.

So easiest thing to do, if you want to run a client with HTTPS on Linux with a certificate created on windows, just do a dos2unix on the certificate.  :)

This should help you save a lot of time.

How to get the service's X509 certificate?

Many PHP developers who are trying to write a secure PHP client using WSF/PHP, find it a bit difficult to understand "How to obtain the certificate of the service". The service certificate is required to encrypt the content and/or verify the service's signature. The X509 certificate used by the service can be hosted somewhere by the service writer, so that it can be easily downloaded. But in some cases it is not. We are supposed to extract it. This will tell you how to do that.

Calling https service with WSClient

Past few days I saw several users have raised the question, how to call https services from WSClient. In order to call such kind of services, you need to have the server's Certificate Authoritys Certificate (CACert), and specify it in the construction of WSClient,

$client = new WSClient(array("to" => "https://somehost.com/somewhere/service",
"CACert" => "cert.pem"));

If for some reason you don't have the servers CACert you can use the server's certificate itself as the CACert. In order to obtain the server's certificate use the following command, (assuming you already have openssl installed)

openssl s_client -connect somehost.com:443
Note: you should change the somehost.com:443 to the servers name and port.

Then extract out the text between "-----BEGIN CERTIFICATE-----" to "-----END CERTIFICATE-----"(inclusive of those two lines too) and save them in a file (cert.pem),

This way your server will be validated and will do the service call securely.