package br.com.nfe;

import java.security.Security;

public class NFeSSL{

    private static final String CAMINHO_CERTIFICADO = "CAMINHO DO SEU ARQUIVO .pfx";
	private static final String SENHA_CERTIFICADO = "SENHA DO SEU CERTIFICADO";
	private static final String CAMINHO_ARQUIVO_CACERTS = "ARQUIVO CACERTS PARA O ESTADO DO SERVIÇO";

	public static void configurar(){
		
		System.setProperty("java.protocol.handler.pkgs", "com.sun.net.ssl.internal.www.protocol");
		Security.addProvider(new com.sun.net.ssl.internal.ssl.Provider());

		System.setProperty("javax.net.ssl.keyStoreType", "PKCS12");

		System.clearProperty("javax.net.ssl.keyStore");
		System.clearProperty("javax.net.ssl.keyStorePassword");
		System.clearProperty("javax.net.ssl.trustStore");

		System.setProperty("javax.net.ssl.keyStore", CAMINHO_CERTIFICADO);
		System.setProperty("javax.net.ssl.keyStorePassword", SENHA_CERTIFICADO);

		System.setProperty("javax.net.ssl.trustStoreType", "JKS");
		System.setProperty("javax.net.ssl.trustStore", CAMINHO_ARQUIVO_CACERTS);
		
	}
}

Contact the Web site administrator if you believe you should be able to view this directory or page without a client certificate, or to obtain a client certificate.
If you already have a client certificate, use your Web browser's security features to ensure that your client certificate is installed properly. (Some Web browsers refer to client certificates as browser or personal certificates.)

Go to Microsoft Product Support Services and perform a title search for the words HTTP and 403.
Open IIS Help, which is accessible in IIS Manager (inetmgr), and search for topics titled About Certificates, Using Certificate Trust Lists, Enabling Client Certificates, and About Custom Error Messages.

public class ConsultaNFE {

    private static final int SSL_PORT = 443;

    public static void main(String[] args) {
        try {
            String codigoDoEstado = "35";
            URL url = new URL("https://nfe.fazenda.sp.gov.br/nfeweb/services/nfeconsulta2.asmx");

            String caminhoDoCertificadoDoCliente = "caminho/certificado.pfx";
            String senhaDoCertificado = "senha";
            String arquivoCacertsGeradoTodosOsEstados = "caminho/nfe-cacerts";

            InputStream entrada = new FileInputStream(caminhoDoCertificadoDoCliente);
            KeyStore ks = KeyStore.getInstance("pkcs12");
            try {
                ks.load(entrada, senhaDoCertificado.toCharArray());
            } catch (IOException e) {
                throw new Exception("Senha do Certificado Digital esta incorreta ou Certificado inválido.");
            }

            String alias = "";
            Enumeration<String> aliasesEnum = ks.aliases();
            while (aliasesEnum.hasMoreElements()) {
                alias = (String) aliasesEnum.nextElement();
                if (ks.isKeyEntry(alias)) {
                    break;
                }
            }
            X509Certificate certificate = (X509Certificate) ks.getCertificate(alias);
            PrivateKey privateKey = (PrivateKey) ks.getKey(alias, senhaDoCertificado.toCharArray());
            SocketFactoryDinamico socketFactoryDinamico = new SocketFactoryDinamico(certificate, privateKey);
            socketFactoryDinamico.setFileCacerts(arquivoCacertsGeradoTodosOsEstados);

            Protocol protocol = new Protocol("https", socketFactoryDinamico, SSL_PORT);
            Protocol.registerProtocol("https", protocol);

            /**
             * Xml de Consulta.
             */
         
            String xml = "<?xml version=\"1.0\" encoding=\"utf-8\"?>"
                    + "<consSitNFe versao=\"2.01\" xmlns=\"http://www.portalfiscal.inf.br/nfe\">"
                    + "<tpAmb>1</tpAmb>"
                    + "<xServ>CONSULTAR</xServ>"
                    + "<chNFe>35120161203931000262550020000260651005925256</chNFe>"
                    + "</consSitNFe>";

            OMElement ome = AXIOMUtil.stringToOM(xml);
            NfeConsulta2Stub.NfeDadosMsg dadosMsg = new NfeConsulta2Stub.NfeDadosMsg();
            dadosMsg.setExtraElement(ome);

            NfeConsulta2Stub.NfeCabecMsg nfeCabecMsg = new NfeConsulta2Stub.NfeCabecMsg();
            /**
             * Código do Estado.
             */
            nfeCabecMsg.setCUF(codigoDoEstado);

            /**
             * Versao do XML
             */
            nfeCabecMsg.setVersaoDados("2.01");
            NfeConsulta2Stub.NfeCabecMsgE nfeCabecMsgE = new NfeConsulta2Stub.NfeCabecMsgE();
            nfeCabecMsgE.setNfeCabecMsg(nfeCabecMsg);

            NfeConsulta2Stub stub = new NfeConsulta2Stub(url.toString());
            NfeConsulta2Stub.NfeConsultaNF2Result result = stub.nfeConsultaNF2(dadosMsg, nfeCabecMsgE);

            info(result.getExtraElement().toString());
        } catch (Exception e) {
            e.printStackTrace();
        }
    }

    private static void info(String log) {
        System.out.println("INFO: " + log);
    }

    private static void error(String log) {
        System.out.println("ERROR: " + log);
    }
}

public class SocketFactoryDinamico implements ProtocolSocketFactory {  
    private SSLContext ssl = null;  
    private X509Certificate certificate;  
    private PrivateKey privateKey;  
    private String fileCacerts;  
  
    public SocketFactoryDinamico(X509Certificate certificate,  
            PrivateKey privateKey) {  
        this.certificate = certificate;  
        this.privateKey = privateKey;  
    }  
  
    private SSLContext createSSLContext() {  
        try {  
            KeyManager[] keyManagers = createKeyManagers();  
            TrustManager[] trustManagers = createTrustManagers();  
            SSLContext sslContext = SSLContext.getInstance("TLS");  
            sslContext.init(keyManagers, trustManagers, null);  
  
            return sslContext;  
        } catch (KeyManagementException e) {  
            error(e.toString());  
        } catch (KeyStoreException e) {  
            error(e.toString());  
        } catch (NoSuchAlgorithmException e) {  
            error(e.toString());  
        } catch (CertificateException e) {  
            error(e.toString());  
        } catch (IOException e) {  
            error(e.toString());  
        }  
        return null;  
    }  
  
    private SSLContext getSSLContext() {  
        if (ssl == null) {  
            ssl = createSSLContext();  
        }  
        return ssl;  
    }  
  
    public Socket createSocket(String host, int port, InetAddress localAddress,  
            int localPort, HttpConnectionParams params) throws IOException,  
            UnknownHostException, ConnectTimeoutException {  
        if (params == null) {  
            throw new IllegalArgumentException("Parameters may not be null");  
        }  
        int timeout = params.getConnectionTimeout();  
        SocketFactory socketfactory = getSSLContext().getSocketFactory();  
        if (timeout == 0) {  
            return socketfactory.createSocket(host, port, localAddress,  
                    localPort);  
        }  
  
        Socket socket = socketfactory.createSocket();  
        SocketAddress localaddr = new InetSocketAddress(localAddress, localPort);  
        SocketAddress remoteaddr = new InetSocketAddress(host, port);  
        socket.bind(localaddr);  
        try {  
            socket.connect(remoteaddr, timeout);  
        } catch (Exception e) {  
            error(e.toString());  
            throw new ConnectTimeoutException("Possível timeout de conexão", e);  
        }  
  
        return socket;  
    }  
  
    public Socket createSocket(String host, int port, InetAddress clientHost,  
            int clientPort) throws IOException, UnknownHostException {  
        return getSSLContext().getSocketFactory().createSocket(host, port,  
                clientHost, clientPort);  
    }  
  
    public Socket createSocket(String host, int port) throws IOException,  
            UnknownHostException {  
        return getSSLContext().getSocketFactory().createSocket(host, port);  
    }  
  
    public Socket createSocket(Socket socket, String host, int port,  
            boolean autoClose) throws IOException, UnknownHostException {  
        return getSSLContext().getSocketFactory().createSocket(socket, host,  
                port, autoClose);  
    }  
  
    public KeyManager[] createKeyManagers() {  
        HSKeyManager keyManager = new HSKeyManager(certificate, privateKey);  
  
        return new KeyManager[] { keyManager };  
    }  
  
    public TrustManager[] createTrustManagers() throws KeyStoreException,  
            NoSuchAlgorithmException, CertificateException, IOException {  
        KeyStore trustStore = KeyStore.getInstance("JKS");  
  
        trustStore.load(new FileInputStream(fileCacerts), "changeit".toCharArray());  
        TrustManagerFactory trustManagerFactory = TrustManagerFactory  
                .getInstance(TrustManagerFactory.getDefaultAlgorithm());  
        trustManagerFactory.init(trustStore);  
        return trustManagerFactory.getTrustManagers();  
    }  
  
    class HSKeyManager implements X509KeyManager {  
  
        private X509Certificate certificate;  
        private PrivateKey privateKey;  
  
        public HSKeyManager(X509Certificate certificate, PrivateKey privateKey) {  
            this.certificate = certificate;  
            this.privateKey = privateKey;  
        }  
  
        public String chooseClientAlias(String[] arg0, Principal[] arg1,  
                Socket arg2) {  
            return certificate.getIssuerDN().getName();  
        }  
  
        public String chooseServerAlias(String arg0, Principal[] arg1,  
                Socket arg2) {  
            return null;  
        }  
  
        public X509Certificate[] getCertificateChain(String arg0) {  
            return new X509Certificate[] { certificate };  
        }  
  
        public String[] getClientAliases(String arg0, Principal[] arg1) {  
            return new String[] { certificate.getIssuerDN().getName() };  
        }  
  
        public PrivateKey getPrivateKey(String arg0) {  
            return privateKey;  
        }  
  
        public String[] getServerAliases(String arg0, Principal[] arg1) {  
            return null;  
        }  
    }  
  
    public void setFileCacerts(String fileCacerts) {  
        this.fileCacerts = fileCacerts;  
    }  
  
    /** 
     * Log Error. 
     * @param log 
     */  
    private static void error(String log) {  
        System.out.println("ERROR: " + log);  
    }  
  
}