Chapter 5: Using SSL in Java Clients

Using Java Secure Socket Extension classes

The Java Secure Socket Extension (JSSE) is a set of Java packages that implements SSL and Transport Layer Security, which enables data encryption, server authentication, message integrity, and client authentication. JSSE is a client-side feature, which can be used with EAServer when it has been configured for SSL communication. For more information on SSL, see Chapter 14, “Managing Keys and Certificates.”.

JSSE does not contain any actual cryptographic logic. You must obtain an API package that performs the cryptographic functions, such as Bouncy Castle or Cryptix, which are available free over the Internet.

Setting up your JSSE environment

Download and install the JSSE according to the documentation on the Java Web page. The basic steps are:
- Copy the JSSE JAR files to the jre/lib/ext directory in your JDK installation.
- Edit the jre/lib/security/java.security file in your JDK installation, and add this line:
```
security.provider.2=com.sun.net.ssl.internal.ssl.Provider
```
From the Sun documentation, note the following:
- JSSE 1.0.2 requires JDK 1.2.2 or higher.
- JRE 1.3.1_02 includes the Java plug-in HTML Converter 1.3.1_02, which works best with JDK 1.3.
- JDK/JRE 1.3 or higher is recommended to run HTML applets.
- The Java plug-in HTML Converter is recommended for HTML applet clients.
Download and install the Java Plug-in HTML Converter, either version 1.3.1 or 1.4.

If you install version 1.3.1:
1. Download and install JSSE 1.0.2 in the JDK 1.3.1 jre/lib/ext subdirectory of the JDK installation.
2. Set up jre/lib/security/java.security according to the JSSE 1.0.2 directions.
The JSSE Samples Web page includes samples that create clients using JSSE. Verify that the samples compile and run with your JDK. You must be able to use the Java samples to request the secure VeriSign Web page at https://www.verisign.com.
Start EAServer and connect using EAServer Manager | Certificates folder.
In the User Certificates folder, highlight the Sample 1 Test ID certificate, and select File | Certificate Info. Confirm that the Sample1 Test ID certificate is valid; that is, that the current date falls between the certificate’s Not Valid Before and Not Valid After dates.
From the User Certificates folder, export Sample1 Test ID as a Binary Encoded X509 Certificate (*.crt). For example, save to a file named eas.crt.
Using the Java keytool, import the eas.crt file; for example:
```
keytool -import -file eas.crt -keystore $JAGUAR_JDK13/jre/lib/security/ 
[cacerts | jssecacerts] -trustcacerts
```
To simplify things, use the default certificate store cacerts; the password is “changeit”.
To run a JSSE client application; for example, ClientApp:
1. Create a ClientApp.bat file with these lines:
```
set classpath=%JAGUAR%\java\lib\easclient.jar; \
    %JAGUAR%\java\lib\easj2ee.jar;%classpath%
java -Djava.protocol.handler.pkgs=
   com.sun.net.ssl.internal.www.protocol ClientApp
```
2. Run ClientApp.bat.
If you do not have a Web proxy, remove the Web proxy settings from your client, and enter the server information; for example:
```
iiops://localhost:9001, or
iiops://<host_name>:9001
```
The following steps apply only to HTML applets.
Remove these client ORB properties from your HTML applet client, if appropriate:
- com.sybase.CORBA.WebProxyHost=localhost
- com.sybase.CORBA.WebProxyPort=80
- com.sybase.CORBA.LogFile=.\iiop.log
To access your Web page from a Web browser, enter:
```
http://<host_name>:8080/jssehtml/yourAppClient.html
```
Where yourAppClient.html is your HTML applet client.
In the applet, enter iiops://<host_name>:9001 as the connection parameter, and click Connect.

Sybase recommends using a Web browser that supports the Java Plug-in 1.3.1 or higher and the Java Plug-in Converter 1.3.1 or higher

Configuring ORB settings

Direct IIOP connections using JSSE are not supported.

Tunnelling IIOP through HTTPS (JSSE socket) using HTTP GET requests

IIOP is contained within the HTTP packets.

Set the client URL to iiops://<host_name>:9001.

Set the following client ORB properties. To enable the EAServer message service to access the ORB properties, set the properties using the JMS property names; otherwise, use the CORBA property names.

JMS property	CORBA property	Vale
org.omg.CORBA.ORBClass	org.omg.CORBA.ORBClass	com.sybase.CORBA.ORB
com.sybase.jms.https	com.sybase.CORBA.https	true
com.sybase.jms.useJSSE	com.sybase.CORBA.useJSSE	true
com.sybase.jms.forceSSL	com.sybase.CORBA.forceSSL	true

Tunnelling IIOP through HTTPS (JSSE socket) using HTTP POST requests

IIOP is contained within the HTTP packets.

Set the client URL to iiops://<host_name>:9001

Set the following client ORB properties. To enable the EAServer message service to access the ORB properties, set the properties using the JMS property names; otherwise, use the CORBA property names..

JMS property	CORBA property	Vale
org.omg.CORBA.ORBClass	org.omg.CORBA.ORBClass	com.sybase.CORBA.ORB
com.sybase.jms.https	com.sybase.CORBA.https	true
com.sybase.jms.useJSSE	com.sybase.CORBA.useJSSE	true
com.sybase.jms.forceSSL	com.sybase.CORBA.forceSSL	true
com.sybase.jms.HttpUsePost	com.sybase.CORBA.HttpUsePost	true

Tunnelling IIOP through an HTTPS connect (JSSE socket) using HTTP GET requests

IIOP is contained within the HTTP packets.

Set the client URL to iiops://<host_name>:9001.

Set the following client ORB properties. To enable the EAServer message service to access the ORB properties, set the properties using the JMS property names; otherwise, use the CORBA property names.

JMS property	CORBA property	Vale
org.omg.CORBA.ORBClass	org.omg.CORBA.ORBClass	com.sybase.CORBA.ORB
com.sybase.jms.https	com.sybase.CORBA.https	true
com.sybase.jms.WebProxyHost	com.sybase.CORBA.WebProxyHost	<web_proxy_host_name>
com.sybase.jms.WebProxyPort	com.sybase.CORBA.WebProxyPort	<web_proxy_port>
com.sybase.jms.useJSSE	com.sybase.CORBA.useJSSE	true
com.sybase.jms.forceSSL	com.sybase.CORBA.forceSSL	true

Tunnelling IIOP through an HTTPS connect (JSSE socket) using HTTP POST requests

IIOP is contained within the HTTP packets.

Set the client URL to iiops://<host_name>:9001.

Set the following client ORB properties. To enable the EAServer message service to access the ORB properties, set the properties using the JMS property names; otherwise, use the CORBA property names.

JMS property	CORBA property	Vale
org.omg.CORBA.ORBClass	org.omg.CORBA.ORBClass	com.sybase.CORBA.ORB
com.sybase.jms.https	com.sybase.CORBA.https	true
com.sybase.jms.HttpUsePost	com.sybase.CORBA.HttpUsePost	true
com.sybase.jms.WebProxyHost	com.sybase.CORBA.WebProxyHost	<web_proxy_host_name>
com.sybase.jms.WebProxyPort	com.sybase.CORBA.WebProxyPort	<web_proxy_port>
com.sybase.jms.useJSSE	com.sybase.CORBA.useJSSE	true
com.sybase.jms.forceSSL	com.sybase.CORBA.forceSSL	true

The first time you connect may take a while because JSSE goes through an SSL authentication process.

Using an unsigned JAR

When using an unsigned JAR, your code runs with the default EAServer Manager | Certificates folder, which is fairly restrictive. To improve performance, you can edit Java’s default security policy file using the instructions in Sun’s security documentation. To enable EAServer’s ORB to work in an unsigned environment:

You must grant the ORB permission to read the proxy host settings, using one of these methods:

permission java.util.PropertyPermission “*”, “read”

permission java.util.PropertyPermission “javaplugin.proxy.config.*”, “read”

The ORB may require socket connect permissions to connect to a proxy server.
If you are using the sample test certificate generated by EAServer, the EAServer certificate authority must be installed. You can do this in either the cacerts or the jssecacerts keystore using this syntax:
```
keytool -import -file <file_name> -keystore [cacerts | jssecacerts]
```
The password for the cacerts keystore is “changeit”.

With a signed applet, you do not need to set permissions at the plug-in level. A signed JAR file describes the type of permissions it requires.

Sample security file

You can find a sample JDK security file in the JDK installation, in file jre/lib/security/java.security.

View this book as PDF