Need guidance on X509Certificate, AxisEngine, MessageContext and HttpServletRequest

I'm trying to figure out the problem of null exception of the code below:

Code:

---

MessageContext msgContext = AxisEngine.getCurrentMessageContext();

HttpServletRequest req = (HttpServletRequest)msgContext.getProperty(HTTPConstants.MC_HTTP_SERVLETREQUEST);
 
X509Certificate x509certs[] = (X509Certificate[]) req.getAttribute("javax.servlet.request.X509Certificate");

---

x509certs[] is null. I'm trying to find out why...

Do any1 of you pros out there know where i can get more information on X509Certificate, AxisEngine, MessageContext and HttpServletRequest?

Is there any books or websites teaches people to use it?

I believe the servlet container will store the SSL certificate that was used in making a HTTPS connection as this request attribute on the servlet request object. So if the x509certs[] is null for you, this likely means the request was not invoked over a https connector.

I am not entirely sure if mod_jk (when tomcat is connected to apache) would set this request attribute, or if this is only possible to have set if you invoked the request thru tomcat's HTTPS SSL connector.

See also : Java 2 Platform EE v1.3: Interface ServletRequest

that link is to jdk 1.3, but this part of the servlet api should not have changed.

I don't know a single thing u talking about. HTTPS SSL?
Can u lead me to some material like website, ebook and stuff, where i can study about it?

Certainly,

HTTP Secure - Wikipedia, the free encyclopedia

X.509 - Wikipedia, the free encyclopedia

Apache Tomcat 6.0 - SSL Configuration HOW-TO

and

Java SE Security

Whao... I guess I have a lot reading todo. Gosh, my eye lips is getting heavier and heavier.

Can u tell me what whether I'm right or wrong.

Keystore - stores private key, certificates and certificate chain
Truststore - stores CA in .cer format.

Server-side
------
Normally location of keystore are specified in server.xml
truststore store under cacerts in jsdk/jre/lib/security.
Server do no need to store its own certificate? only need to specified the keystore location?

Client-side
-----------
user specified where to locate the keystore.
what about truststore? For my existing system, it uses a file_trust.jks to store a certificate. The certificate store in file_trust.jks is client-side certificate or server?

In the client program I only found

Code:

---

System.setProperty("javax.net.ssl.trustStore", trustStore);

---

Where else, server-side got

Code:

---

X509Certificate x509certs[] = (X509Certificate[]) req.getAttribute("javax.servlet.request.X509Certificate");

---

I can't find any request.setAttribute(....);

Inside truststore contain .cer, will it automatic access to truststore for X509Certificate? Can it be done like this?