Re: Secure Jini and Tomcat
Jeff Hyatt-Steel <[email protected]> Tue, 15 May 2007 17:28:35 +0100
| Newsgroups | gmane.comp.java.sun.javaspaces |
|---|---|
| Message-ID | <[email protected]> |
Hi
Thanks everyone for their ideas, at this time I'd like to get tomcat working
if possible as there is a lot of other stuff which is already working which
I'd rather not change, the same for running it in Bantam, although if I
really can't get things working I may go back to these options.
In Answer to Mark Brouwers questions, (in reverse order as the first one is
the longest):
> Also you could set a breakpoint at line 99 of the same class to see the
>certificate chain being validated as I don't think for secure Jini ERI
>you can get that information out by just configuring logging.
I tried this and got this a certificate chain of length 1 containing:
chain[0] = "[
[
Version: V1
Subject: CN=test
Signature Algorithm: SHA1withDSA, OID = 1.2.840.10040.4.3
Key: SunPKCS11-Solaris DSA public key, 1024 bits (id 21855680, session
object
)
y:
688353494477040055886724953396420660078645197995066454805773711614581607370
5923533943439361704669798182589249686325472439389076038001868315282877413874
5594
6185813397532363145452236441169333050723499828802567913395931108822419824573
1576
3777545907256614609666724123530979847991234337496537431722611965462347842
p:
178011905478542266528237562450159990145232156369120674273274450314442865788
7370207706126952521234630795671567847784664499706507709207278570500096683881
4403
4129745221171818506047231150039301079959358067395348717066319802262019714966
5241
35060945913707594956514672855690606794135837542707371727429551343320695239
q: 864205495604807476120572616017955259175325408501
g:
174068207532402095185811980123523436538604490794561350978495831040599953488
4558231478515974089409507253077970949157594923683005742524387610370844734671
8014
8876118103083043754985190983472601550494691329488083395492313850000361646482
6446
08492304078721818959999056496097769368017749273708962006689187956744210730
Validity: [From: Fri Apr 20 15:51:44 BST 2007,
To: Thu Apr 20 15:51:44 BST 2017]
Issuer: CN=test
SerialNumber: [ 4628d380]
]
Algorithm: [SHA1withDSA]
Signature:
0000: 30 2C 02 14 73 56 1E 2E 3A 7E 41 02 87 22 CA 1E 0,..sV..:.A.."..
0010: A9 78 C9 35 28 D8 BF A4 02 14 43 1B 94 E4 B8 66 .x.5(.....C....f
0020: 79 63 2A 7E 94 BC 09 CC E9 D3 E5 80 B0 2F yc*........../
]"
Which matches the server certificate of:
Keystore type: jks
Keystore provider: SUN
Your keystore contains 1 entry
Alias name: server
Creation date: Apr 20, 2007
Entry type: keyEntry
Certificate chain length: 1
Certificate[1]:
Owner: CN=test
Issuer: CN=test
Serial number: 4628d380
Valid from: Fri Apr 20 15:51:44 BST 2007 until: Thu Apr 20 15:51:44 BST 2017
Certificate fingerprints:
MD5: D9:41:09:02:D3:5B:53:A4:38:D6:AC:8A:51:46:B0:E8
SHA1: E7:07:9D:D0:6A:6F:67:4C:E3:89:D2:04:35:03:B2:97:E1:93:4D:64
*******************************************
*******************************************
>Something else you might try is to set a breakpoint at line 141 of
>net.jini.jeri.ssl.FilterX509TrustManager (JTSK 2.1) and inspect the
>trustmanager factory with a debugger to see which keystore it uses for
>trust related questions.
I tried this but couldn't seem to find the trustmanager factory and the
trustmanager variable was null.
>Also you talk about configuring security related stuff through
>server.xml, the JTSK based implementation is configured through system
>properties as mentioned in
>http://java.sun.com/products/jini/2.1/doc/api/net/jini/jeri/ssl/package->su
mmary.html.
>Could it be possible the configuration of certificates used for trust
>verification by Tomcat results in a different view as the view of
>secure Jini ERI, i.e. they are using a different certificate store.
The link provided didn't work however loking at
http://java.sun.com/j2se/1.5.0/docs/api/
I couldn't find anything on trust or key stores but I do use:
-Djava.security.auth.login.config=/ssl.login
And the ssl.login file:
XXx.XXX.XXX.XXX {
com.sun.security.auth.module.KeyStoreLoginModule required
keyStoreAlias="client"
keyStoreURL="file:///absoluteFilePath/keystore"
keyStorePasswordURL="file:/// absoluteFilePath/password";
};
Although as far as I am aware this is for the Login Context that is used to
authenticate the client.
> Did you try running Tomcat with logging set to FINER/FINEST for the
>logger net.jini.jeri.ssl.client and what was the outcome of that.
I hadn't originally but I have now and haven't found anything, however the
section where it breaks is here and the equivalent section from it working
outside of tomcat is below it.
with active []
and idle []
returns null
May 15, 2007 4:09:37 PM net.jini.jeri.ssl.Utilities getClientSSLContextInfo
FINEST: get client SSL context for CallContext[
SslEndpoint[test.XXX.net:8090]
clientSubject=Subject@191d7bd5
clientAuthRequired=false
clientPrincipals=[CN=test-web]
serverPrincipals=null
cipherSuites=[SSL_RSA_WITH_RC4_128_MD5, SSL_RSA_WITH_RC4_128_SHA,
TLS_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_RSA_WITH_AES_128_CBC_SHA,
TLS_DHE_DSS_WITH_AES_128_CBC_SHA, SSL_RSA_WITH_3DES_EDE_CBC_SHA,
SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA, SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA,
SSL_RSA_WITH_DES_CBC_SHA, SSL_DHE_RSA_WITH_DES_CBC_SHA,
SSL_DHE_DSS_WITH_DES_CBC_SHA, SSL_RSA_EXPORT_WITH_RC4_40_MD5,
SSL_RSA_EXPORT_WITH_DES40_CBC_SHA, SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA,
SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA, SSL_RSA_WITH_NULL_MD5,
SSL_RSA_WITH_NULL_SHA, SSL_DH_anon_WITH_RC4_128_MD5,
TLS_DH_anon_WITH_AES_128_CBC_SHA, SSL_DH_anon_WITH_3DES_EDE_CBC_SHA,
SSL_DH_anon_WITH_DES_CBC_SHA, SSL_DH_anon_EXPORT_WITH_RC4_40_MD5,
SSL_DH_anon_EXPORT_WITH_DES40_CBC_SHA]
integrity=required
]
returns new javax.net.ssl.SSLContext@42a6cdf5
May 15, 2007 4:09:37 PM net.jini.jeri.ssl.SslConnection establishCallContext
FAILED: new connection for CallContext[
SslEndpoint[test.XXX.net:8090]
clientSubject=Subject@191d7bd5
clientAuthRequired=false
clientPrincipals=[CN=test-web]
serverPrincipals=null
cipherSuites=[SSL_RSA_WITH_RC4_128_MD5, SSL_RSA_WITH_RC4_128_SHA,
TLS_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_RSA_WITH_AES_128_CBC_SHA,
TLS_DHE_DSS_WITH_AES_128_CBC_SHA, SSL_RSA_WITH_3DES_EDE_CBC_SHA,
SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA, SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA,
SSL_RSA_WITH_DES_CBC_SHA, SSL_DHE_RSA_WITH_DES_CBC_SHA,
SSL_DHE_DSS_WITH_DES_CBC_SHA, SSL_RSA_EXPORT_WITH_RC4_40_MD5,
SSL_RSA_EXPORT_WITH_DES40_CBC_SHA, SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA,
SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA, SSL_RSA_WITH_NULL_MD5,
SSL_RSA_WITH_NULL_SHA, SSL_DH_anon_WITH_RC4_128_MD5,
TLS_DH_anon_WITH_AES_128_CBC_SHA, SSL_DH_anon_WITH_3DES_EDE_CBC_SHA,
SSL_DH_anon_WITH_DES_CBC_SHA, SSL_DH_anon_EXPORT_WITH_RC4_40_MD5,
SSL_DH_anon_EXPORT_WITH_DES40_CBC_SHA]
integrity=required
]
throws
net.jini.io.UnsupportedConstraintException:
sun.security.validator.ValidatorException: PKIX path building failed:
sun.security.provider.certpath.SunCertPathBuilderException: unable to find
valid certification path to requested target
at
net.jini.jeri.ssl.SslConnection.establishCallContext(SslConnection.java:195)
at
net.jini.jeri.ssl.SslEndpointImpl.connect(SslEndpointImpl.java:847)
at
net.jini.jeri.connection.ConnectionManager.connect(ConnectionManager.java:22
8)
at
net.jini.jeri.connection.ConnectionManager$ReqIterator.next(ConnectionManage
r.java:629)
at
net.jini.jeri.BasicObjectEndpoint$1.next(BasicObjectEndpoint.java:371)
at
net.jini.jeri.BasicInvocationHandler.invokeRemoteMethodOnce(BasicInvocationH
andler.java:708) ....
For comparison here is the output of the stand alone version:
with active []
and idle []
returns null
May 15, 2007 4:16:40 PM net.jini.jeri.ssl.Utilities getClientSSLContextInfo
FINEST: get client SSL context for CallContext[
SslEndpoint[test.XXX.net:8090]
clientSubject=Subject@4963f7a1
clientAuthRequired=false
clientPrincipals=[CN=test-web]
serverPrincipals=null
cipherSuites=[SSL_RSA_WITH_RC4_128_MD5, SSL_RSA_WITH_RC4_128_SHA,
TLS_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_RSA_WITH_AES_128_CBC_SHA,
TLS_DHE_DSS_WITH_AES_128_CBC_SHA, SSL_RSA_WITH_3DES_EDE_CBC_SHA,
SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA, SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA,
SSL_RSA_WITH_DES_CBC_SHA, SSL_DHE_RSA_WITH_DES_CBC_SHA,
SSL_DHE_DSS_WITH_DES_CBC_SHA, SSL_RSA_EXPORT_WITH_RC4_40_MD5,
SSL_RSA_EXPORT_WITH_DES40_CBC_SHA, SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA,
SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA, SSL_RSA_WITH_NULL_MD5,
SSL_RSA_WITH_NULL_SHA, SSL_DH_anon_WITH_RC4_128_MD5,
TLS_DH_anon_WITH_AES_128_CBC_SHA, SSL_DH_anon_WITH_3DES_EDE_CBC_SHA,
SSL_DH_anon_WITH_DES_CBC_SHA, SSL_DH_anon_EXPORT_WITH_RC4_40_MD5,
SSL_DH_anon_EXPORT_WITH_DES40_CBC_SHA]
integrity=required
]
returns new javax.net.ssl.SSLContext@4d8ce14a
May 15, 2007 4:16:40 PM net.jini.jeri.ssl.FilterX509TrustManager
checkServerTrusted
FINE: check server trusted succeeds for auth type DHE_DSS
chain [[
[
Version: V1
Subject: CN=test
Signature Algorithm: SHA1withDSA, OID = 1.2.840.10040.4.3
Key: SunPKCS11-Solaris DSA public key, 1024 bits (id 12748096, session
object)
y:
6883534944770400558867249533964206600786451979950664548057737116145816073705
9235339434393617046697981825892496863254724393890760380018683152828774138745
5946185813397532363145452236441169333050723499828802567913395931108822419824
5731576377754590725661460966672412353097984799123433749653743172261196546234
7842
p:
1780119054785422665282375624501599901452321563691206742732744503144428657887
3702077061269525212346307956715678477846644997065077092072785705000966838814
4034129745221171818506047231150039301079959358067395348717066319802262019714
9665241350609459137075949565146728556906067941358375427073717274295513433206
95239
q: 864205495604807476120572616017955259175325408501
g:
1740682075324020951858119801235234365386044907945613509784958310405999534884
5582314785159740894095072530779709491575949236830057425243876103708447346718
0148876118103083043754985190983472601550494691329488083395492313850000361646
4826446084923040787218189599990564960977693680177492737089620066891879567442
10730
Validity: [From: Fri Apr 20 15:51:44 BST 2007,
To: Thu Apr 20 15:51:44 BST 2017]
Issuer: CN=test
SerialNumber: [ 4628d380]
]
Algorithm: [SHA1withDSA]
Signature:
0000: 30 2C 02 14 73 56 1E 2E 3A 7E 41 02 87 22 CA 1E 0,..sV..:.A.."..
0010: A9 78 C9 35 28 D8 BF A4 02 14 43 1B 94 E4 B8 66 .x.5(.....C....f
0020: 79 63 2A 7E 94 BC 09 CC E9 D3 E5 80 B0 2F yc*........../
]]
May 15, 2007 4:16:40 PM net.jini.jeri.ssl.ClientAuthManager
chooseClientAlias
FINE: choose client alias for key types [RSA, DSA]
and issuers [CN=test-web, CN=test]
returns 4628d370@cn=test-web
May 15, 2007 4:16:40 PM net.jini.jeri.ssl.SslConnection establishCallContext
FINE: new connection for CallContext[
SslEndpoint[test.XXX.net:8090]
clientSubject=Subject@4963f7a1
clientAuthRequired=false
clientPrincipals=[CN=test-web]
serverPrincipals=null
cipherSuites=[SSL_RSA_WITH_RC4_128_MD5, SSL_RSA_WITH_RC4_128_SHA,
TLS_RSA_WITH_AES_128_CBC_SHA, TLS_DHE_RSA_WITH_AES_128_CBC_SHA,
TLS_DHE_DSS_WITH_AES_128_CBC_SHA, SSL_RSA_WITH_3DES_EDE_CBC_SHA,
SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA, SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA,
SSL_RSA_WITH_DES_CBC_SHA, SSL_DHE_RSA_WITH_DES_CBC_SHA,
SSL_DHE_DSS_WITH_DES_CBC_SHA, SSL_RSA_EXPORT_WITH_RC4_40_MD5,
SSL_RSA_EXPORT_WITH_DES40_CBC_SHA, SSL_DHE_RSA_EXPORT_WITH_DES40_CBC_SHA,
SSL_DHE_DSS_EXPORT_WITH_DES40_CBC_SHA, SSL_RSA_WITH_NULL_MD5,
SSL_RSA_WITH_NULL_SHA, SSL_DH_anon_WITH_RC4_128_MD5,
TLS_DH_anon_WITH_AES_128_CBC_SHA, SSL_DH_anon_WITH_3DES_EDE_CBC_SHA,
SSL_DH_anon_WITH_DES_CBC_SHA, SSL_DH_anon_EXPORT_WITH_RC4_40_MD5,
SSL_DH_anon_EXPORT_WITH_DES40_CBC_SHA]
integrity=required
]
creates SslConnection[[Session-1, TLS_DHE_DSS_WITH_AES_128_CBC_SHA],
49497=>test.XXX.net:8090]
--
Jeff Hyatt-Steel
CDO2
Albert Buildings
49 Queen Victoria Street
London
EC4N 4SA
Tel: +44 (0)845 456 4460
Fax: +44 (0)845 456 4461
www.cdo2.com
===========================================================================
To unsubscribe, send email to [email protected] and include in the body
of the message "signoff JAVASPACES-USERS". For general help, send email to
[email protected] and include in the body of the message "help".
To view past JAVASPACES-USERS postings, please see:
http://archives.java.sun.com/archives/javaspaces-users.html