Recently I was trying to test a web service. The traffic was over SSL/TLS and everything was fine. As I am better with Burp than SoapUI, I wanted to use Burp as a proxy for SoapUI. This should be an easy matter. Burp will create a custom certificate (signed by its root CA) for each site and effectively Man-in-the-Middle the connection. But this time it was different, I was getting the dreaded
Peer not Authenticated error. This meant that SoapUI did not recognize Burp's custom certificate.
I Googled and found some solutions such as adding Burp's CA to my certificate store (already done), adding it to SoapUI's keystore (didn't work) or using custom versions of SoapUI created for exactly this reason (again didn't work).
After a suitably long period of weeping and gnashing of teeth I achieved salvation.
Here's how to do it:
Set Burp as proxy for SoapUI.
In SoapUI go to
File > Preferences > Proxy Settings.
Modify target address to http from https
2.a. In SoapUI, modify the
2.b. Modify the WSDL and change
wsdl:address locationsimilarly and import it into SoapUI.
Edit Burp's listener and check
Force use of SSLunder
Notice that the
Redirect to portinput field will be automatically populated with 443. If your service endpoint is using a different port, modify that accordingly.
Now you can send requests from SoapUI and intercept them in Burp. Responses will appear in both SoapUI and Burp like any proxied application.
Be sure to remove the
Force use of SSLafter you are done. Otherwise you will be wondering why gmail is available under http in your browser (like
mesomeone I know).