soapUI is a great tool for testing web service. However, configuring soapUI to test securied web service have not easy. The only information I can get is this page. Fortuanately, soapUI is an open source tool so I was able to down the code and open it in Eclipse to step through the code. I finally figured out how to make it work:

1. Make sure you installed JCE unlimited strength policy (at the end of this link).
2. soapUI does not import jks or jceks keystores correctly. It needs to be converted to PKCS12 keystore.
3. soapUI failed to recognize the server public key in the keystore (a bug in version 2.02?). Instead, I have to provide it the server private keystore for it to work.

Basically, I configure the keystore in the project level. Create the outgoing and incoming configuration. Then I go to binding to bind the outgoing and incoming WSS configuration.