X509Certificates - Getting Closer

Found a sample Java servlet that reads client certificates. Loaded it into JDev 10.1.3, configured it for OAS 10.1.2, deployed it successfully to a new OC4J container, and connected to it successfully, but it reported that no client certificate was present. This was a head scratcher, so I reviewed the Java API for the X509Certificate class and the HTTPRequest interface, tried a couple of things, didn't get anything to work, and then somehow ended up on the Sun Developer Network, where I found this post: Obtaining an X509Certificate from a Web App. The post mentions adding the directive "Oc4jExtractSSL On" to the Apache mod_oc4j.conf file. Apparently, you have to explicitly tell the Oracle HTTP Server to pass the client certificate to the OC4J. So I tried it - but still not getting the certificate. But I think I'm getting closer - still googling and hopefully I'll have an answer by the end of the day.

Update: Found another missing piece of the puzzle in an OTN post. Enabled the SSLOptions +ExportCert +StdEnvVars directives in ssl.conf, but the servlet is still not getting the certificates. Posted a plea for help in the OTN OC4J/J2EE forum here. Hope I hear from someone soon.

Another Update: I hate the Metalink interface so much I usually leave it as my last resource, but lo and behold I found Note 256244.1 Sample code to read Client Certificate details in a Servlet/JSP. It links to Note 255965.1 Configuration steps to read Client Certificate details from a Servlet/JSP (sorry - Oracle CSI required to access). The configuration steps have added nothing new to what I've already done with mod_oc4j.conf and ssl.conf. But I thought I'd give the sample code a try. Opened a new application in JDev 10.1.3, changed to the 1.4.2 library, created a servlet, copied and pasted the code, no errors, ran it in the embedded OC4J and got the expected result: A web page stating the connection was not made via HTTPS so no certificate data available. Yippee! Created my deployment descriptors and profile, deployed it to an .EAR, copied the .EAR to the applications directory of my configured OC4J, deployed successfully and all I get is a #@!&^! 404 Page Not Found Error.


Slamming head on desk. . .