Salve a tutti facendo una fatica non indifferente sono riuscito a far funzionare un codice di esempio che mi avevano mandato per creare una comunicazione soap X509.

codice:
//----------------------------------------------------------------------------------------------------------------------------
    private Boolean invioFSE(RegistraEpisodioReq3 request, String nomeFile) throws IOException {
        Boolean ritorno = false;
        Config cnf = new Config();
        String serv = cnf.getDati("service");
        String su = cnf.getDati("signature_user");
        String eu = cnf.getDati("encription_user");
        String fileResponse = cnf.getDati("dirResponse") + "/" + nomeFile;
        ScriviRisposta fileXML = new ScriviRisposta(fileResponse);

        try {
            FSEService3 service = new FSEService3();
            CLFSEServicePort3Type port = service.getCLFSEServiceHttpsSoap12Endpoint();

            org.apache.cxf.endpoint.Client client = ClientProxy.getClient(port);
            org.apache.cxf.endpoint.Endpoint cxfEndpoint = client.getEndpoint();

            client.getRequestContext().put(Message.ENDPOINT_ADDRESS, serv);

            Map<String, Object> inProps = new HashMap<String, Object>();
            inProps.put(WSHandlerConstants.ACTION, WSHandlerConstants.TIMESTAMP + " " + WSHandlerConstants.ENCRYPT + " "
                    + WSHandlerConstants.SIGNATURE);

            inProps.put(WSHandlerConstants.SIG_PROP_FILE, "/ws-security.properties");
            inProps.put(WSHandlerConstants.ENC_SYM_ALGO, "http://www.w3.org/2001/04/xmlenc#aes256-cbc");
            inProps.put(WSHandlerConstants.ENC_KEY_TRANSPORT, "http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p");
            inProps.put(WSHandlerConstants.ENC_PROP_FILE, "ws-security.properties");
            inProps.put(WSHandlerConstants.DEC_PROP_FILE, "ws-security.properties");
            inProps.put(WSHandlerConstants.ENCRYPTION_PARTS, "{Content}{http://www.w3.org/2003/05/soap-envelope}Body;");
            inProps.put(WSHandlerConstants.PW_CALLBACK_CLASS, KeystorePasswordCallback.class.getName());
            WSS4JInInterceptor wssIn = new WSS4JInInterceptor(inProps);
            cxfEndpoint.getInInterceptors().add(wssIn);

            IncomingFaultInterceptor faultInterceptor = new IncomingFaultInterceptor(fileXML);
            cxfEndpoint.getInFaultInterceptors().add(faultInterceptor);

            cxfEndpoint.getOutInterceptors().add(new LoggingInInterceptor());

            Map<String, Object> outProps = new HashMap<String, Object>();
            outProps.put(WSHandlerConstants.ACTION, WSHandlerConstants.TIMESTAMP + " " + WSHandlerConstants.SIGNATURE
                    + " " + WSHandlerConstants.ENCRYPT);

            outProps.put(WSHandlerConstants.SIG_PROP_FILE, "ws-security.properties");
            outProps.put(WSHandlerConstants.SIG_KEY_ID, "DirectReference");
            outProps.put(WSHandlerConstants.SIGNATURE_USER, su);
            // outProps.put(WSHandlerConstants.SIGNATURE_USER, "aaaaaa00a11c000k");
            outProps.put(WSHandlerConstants.PW_CALLBACK_CLASS, KeystorePasswordCallback.class.getName());
            outProps.put(WSHandlerConstants.ENC_SYM_ALGO, "http://www.w3.org/2001/04/xmlenc#aes128-cbc");
            outProps.put(WSHandlerConstants.ENC_KEY_TRANSPORT, "http://www.w3.org/2001/04/xmlenc#rsa-oaep-mgf1p");
            outProps.put(WSHandlerConstants.ENC_PROP_FILE, "ws-security.properties");
            outProps.put(WSHandlerConstants.ENC_KEY_ID, "DirectReference");
            outProps.put(WSHandlerConstants.ENCRYPTION_USER, eu);
            // outProps.put(WSHandlerConstants.ENCRYPTION_USER, "aaaaaa00a11c000k");
            outProps.put(WSHandlerConstants.ENCRYPTION_PARTS,
                    "{Content}{http://www.w3.org/2003/05/soap-envelope}Body;");

            WSS4JOutInterceptor wssOut = new WSS4JOutInterceptor(outProps);
            cxfEndpoint.getOutInterceptors().add(new LoggingOutInterceptor());
            cxfEndpoint.getOutInterceptors().add(wssOut);
            cxfEndpoint.getOutInterceptors().add(new SAAJOutInterceptor());

            // System.out.println("INVIO REQUEST");
            port.registraEpisodio3(request);
    
            // exchange.getIn().setHeader("valido", true);
            ritorno = true;
        } catch (Exception fe) {
            fileXML.senzaSuccesso();
            fileXML.aggErrore("SOAP_007", "Impossibile configurare documento in XML " + fe.toString(), "");
            fileXML.scrivi();
            // exchange.getIn().setHeader("valido", false);
            ritorno = false;
            System.out.println("FINISCO NEL CATCH" + fe.toString());
        }

        return ritorno;
    }
//----------------------------------------------------------------------------------------------------------------------------
Questo codice manda la request che passo (che è un oggetto creato da un xml) e lo manda al web servce.
Ora a funzionare funziona ma ammetto che più lo guardo e più mi sorgono dubbi.
Prima di essere inviato sicuramente viene aggiunto negli header date e simili e poi cifrato ed inviato.
E' possibile secondo voi tirare fuori la request compilata senza impazzire troppo? compilata non cifrata...
Poi il server manda una request, ma non sono riuscito ad accedervi.
Secondo voi come si fa?
Saluti
Rino