Configuring Jacorb to use SSL when possible

Hello,

We are using CORBA (without SSL) since nearly two decades and plan to migra=
te to use CORBA SSL.

The problem is: We need to do this migration in a defensive way because we =
cannot *require* both client and server to support SSL.

During our attempts to realize this we were successful to configure our ser=
ver to accept both incoming SSL and non-SSL requests from clients using the=
 following *server* configuration:

jacorb.security.support_ssl=3Don
OASSLPort=3D684
jacorb.ssl.socket_factory=3Dorg.jacorb.security.ssl.sun_jsse.SSLSocketFacto=
ry
jacorb.ssl.server_socket_factory=3Dorg.jacorb.security.ssl.sun_jsse.SSLServ=
erSocketFactory
jacorb.security.ssl.client.supported_options=3D20
jacorb.security.ssl.client.required_options=3D0
jacorb.security.ssl.server.supported_options=3D20
jacorb.security.ssl.server.required_options=3D0
jacorb.security.ssl.corbaloc_ssliop.supported_options=3D1
jacorb.security.ssl.corbaloc_ssliop.required_options=3D0
jacorb.security.keystore=3Dsome-valid-path
jacorb.security.keystore_password=3Dsome-valid-passwd
jacorb.security.jsse.trustees_from_ks=3Don
jacorb.security.ssl.always_open_unsecured_address=3Dtrue

But this is the configuration of a new server that potentially can understa=
nd SSL. We also need to support the case that a *new* client that potential=
ly can form a CORBA-SSL connection, but where the server is still an old on=
e where SSL is not enabled. Of course, such a connection could not expect t=
o be an actual SSL connection, but that is OK: It would be fine if we get t=
he previous insecure connection in this case.

The question is: How should I configure my *new* client so that it can real=
ize an SSL connection with new servers but a still successful (non-secure) =
connection with old servers without two connection attempts? Is this someho=
w possible?

I tried the following *client* configuration:

properties.put("jacorb.security.support_ssl", "on");
properties.put("OASSLPort", "684");
properties.put("jacorb.security.ssl.client.supported_options", "20");
properties.put("jacorb.security.ssl.corbaloc_ssliop.supported_options", "20=
");
properties.put("jacorb.security.ssl.corbaloc_ssliop.required_options", "1");
properties.put("jacorb.ssl.socket_factory", "org.jacorb.security.ssl.sun_js=
se.SSLSocketFactory");
properties.put("jacorb.ssl.server_socket_factory", "org.jacorb.security.ssl=
.sun_jsse.SSLServerSocketFactory");
properties.put("jacorb.security.keystore",  mykeyStore);
properties.put("jacorb.security.keystore_password", mykeyStorePasswd);
properties.put("jacorb.security.jsse.trustees_from_ks", "on");
properties.put("jacorb.security.ssl.always_open_unsecured_address", "true");

and used the

"corbaloc:ssliop:1.2@<servername>:684/NameService"

when connecting to the NameService, where <servername> denotes the actual s=
erver address. But this approach doesn't seem to work unless I *also* activ=
ated SSL on the server as shown above.

I would appreciate if someone could shed some light on how (or whether) it =
is possible to configure the client configuration such that it works *also*=
 with a server that has no SSL activated (in this case effectively falling =
back to a non-SSL connection).

If that is not possible, what is the recommended workaround?

Thanks for your help,


  *   Daniel Kr=FCgler





- confidential -
_______________________________________________
jacorb-developer maillist  -  [email protected]
https://lists.spline.inf.fu-berlin.de/mailman/listinfo/jacorb-developer