|
Setting up SSL and HTTPS This article will give you pointers on how to enable communication over the Secure Socket Layer and how to enable secure HTTP connections.
Introduction
Certificates and CAs The keytool Obtaining a Certificate Setting up a secure website using HTTPS in Orion Setting up certificate-based client authentication for a secure website Common problems and solutions General SSL debugging 1 Introduction In many cases you want to protect information passed to and from a web site using encryption. You also want to have a way to certify the identy of either the client or the server. For the client it is pretty convenient to identify itself using a username and password, but obviously the server needs some other mechanism to proove that the information you are sending to it actually ends up in the right hands, for example if you send credit card information. HTTPS solves both these problems. It guarantees the identity of the server (and optionally, also the identity of the client) through the usage of certificates as well as provide encryption for the communication. 2 Certificates and CAs First let us familarize ourselves with the concept of an SSL certificate. According to the documentation of Sun's keytool:
To understand this let us discuss the concepts used in the explanation above. Sun also has a glossary available here. 2.1 Public & Private keys In "public key crypto systems", every entity is associated with one public and one private key. When two entities cmmunicate both parties use their own private key and the other sides public key, to make sure that only the two entities can talk to eachother. A public key is essentially a publically available number associated with a particular entity, and everyone who is supposed to communicate securely with the entity should know this number. A private key is also a number, but one that is kept a secret. In a typical public key crypto system, such as DSA, a private key corresponds to exactly one public key. Only the private key can be used to create a signature, but the public key can be used to verfiy the signature. This means that the private/public key combination means that an entity can guarantee that it knows its private key without giving away what it is. 2.2 Digitally Signed If some data is digitally signed it has been stored with the "identity" of an entity, and a signature that proves that entity knows about the data. The data is rendered unforgeable by signing with the entity's private key. 2.3 Identity A known way of addressing an entity. In some systems the identity is the public key, in others it can be anything from a Unix UID to an Email address to an X.509 Distinguished Name. Now, how can a certificate really certify the identity of anyone? The answer is the Certificate Authorities or the CAs. A Certificate Authority is an organization that issues certificates to other organizations that wish to proove their identity. The CA asks the certificate requester to provide information about itself and the CA gives back a certifcate in return. The returned certificate is chained to the root certificate, establishing a chain of trust. In this way someone dealing with a company identifying itself through a certificate issued by a certain CA doesn't have to trust every company, but it is sufficient to trust the root CA. Examples of CAs are Verisign and Thawte. These are root CAs that issue certificates that are chained to their root certificates. There are also CAs that do not provide root certificates but chain to on of the root CA themselves. So if you get a certificate from such a CA, your certificate is linked to the intermediate CA and their certificate is chained to a root certificate. 3 The keytool Provided with the JDK from Sun is a tool to create and handle certificates. The official description of the keytool is this:
The keytool stores all keys and certificates in a keystore, which is normally a file, but could theoretically be something else. It stores private information by a password. For a complete reference to the keytool, please visit Sun's keytool documentation. This provides a very complete guide to the topics discussed in this document. 4 Obtaining a Certificate
The outlines for obtaining a certificate from the most common CA:s are described below for the following CA:s
Getting a Thawte test SSL certificate
Getting a real Thawte SSL certificate Getting a real Verisign certificate 4.1 Getting a Thawte test SSL certificate 4.2 Getting a real Thawte SSL certificate To get a real certificate with Thawte, choose "Other" as the server vendor alternative and visit http://www.thawte.com/html/RETAIL/ssl/index.html. 4.3 Getting a real Verisign certificate 5 Setting up a secure website using HTTPS in Orion
Configuring a secure website can be done through the following steps:
Excerpt from server.xml with the secure web site added:
6 Setting up certificate-based client authentication for a secure website
In order to use certificate based client authentication for a secure website, go through the following steps: 7 Common problems and solutions keytool error: java.security.cert.CertificateException: Unsupported encoding - The keytool is sensitive to whitespace. Try deleting all trailing whitespace, if it still doesn't work, try adding a newline in your certificate reply file. keytool error: KeyPairGenerator not available - This error might indicate that a keytool from an older JDK is being run. Try to fully qualify the path of the keytool belonging to the jdk you use to run Orion. keytool error: Failed to establish chain from reply - The problem with the first command is that keytool can't find the root ca certificates in your keystore and therefore can't build up the certificate chain from your server key to the trusted root certificate authority. keytool -keystore keystore -import -alias cacert -file cacert.cer (keytool -keystore keystore -import -alias intercert -file inter.cer) If you use an intermediate CA keytool -keystore keystore -genkey -keyalg RSA -alias serverkey keytool -keystore keystore -certreq -file my.host.com.csr Get cert from csr then: keytool -keystore keystore -import -file my.host.com.cer -alias serverkey Keytool error: Signature not available - To be written No available certificate corresponds to the SSL cipher suites which are enabled - One known reason is that different passwords has been used for the certificate and the Keystore. In this case, use the Keytool to change the password of the certificate to match the password of the Keystore. 8 General SSL debugging There are a few ways to get some more verbose debug information from the JSSE implementation. To get a list of options start Orion with:
Or if you want to turn on full verbosity, use:
Copyright © 2005 IronFlare AB |