Issues when connecting from SoapUI to HTTPS services may be caused by SoapUI's internal JRE
Background:
SoapUI is a popular tool for testing SOAP services, but users may find that entering an HTTPS endpoint in the "initial WSDL" field leads to cryptic errors about SoapUI's inability to load the WSDL document.
If the web browser and/or the Pega applications running on a system have no issues loading the WSDL, but SoapUI is not loading the WSDL, the problem may be caused by the fact that SoapUI ships with its own Java Runtime Environment, which does not reflect the environment in which the system's other Java applications are running.
Undesirable behavior experienced:
SoapUI is unable to load a WSDL hosted on an HTTPS endpoint.
Possible root causes:
- As of October 2017, the Java Runtime Environment that is provided with SoapUI is Java Version 7. This version of Java does not support connections to services TLS version 1.2 by default, as documented here. TLS is becoming the standard for most services across the globe, and many service providers are "turning off" support for older versions of TLS. When attempting to connect to those services from an un-modified SoapUI installation, the service will reject the connection from SoapUI because it is using a lower version of TLS such as 1.0
- The SOAP services may be using certificates that are not installed on SoapUI's truststore
- (In the case of 2-way ssl) the required client-side keystore is not configured for SoapUI's private JVM
Solving the issue:
Regardless of the error message, it is best to rule out TLS version issues by enabling them in the SoapUI "vm options" file:
- Load the file in <SoapUI install folder>/bin that is named <SoapUI version>.vmoptions
- Add this line to the end of the file: -Dsoapui.https.protocols=TLSv1,TLSv1.1,TLSv1.2
- Save the file
- restart SoapUI
If this did not solve the issue, then the problem may be rooted in the SSL artifacts (certificates / keys), or lack thereof. SoapUI's JRE must be configured to use the truststore and/or keystore required for making the connection. A good summary of this topic is available in this StackOverflow post: https://stackoverflow.com/a/6341566
***Updated by moderator: Lochan to add Group tags***
