Re: Secure Jini and Tomcat

Hi
Hi setting the javax.net.ssl.trustStore and javax.net.ssl.trustStorePass
variables has got it working, thank you everyone who offered suggestions.

--
Jeff Hyatt-Steel
CDO2
Albert Buildings
49 Queen Victoria Street
London
EC4N 4SA
Tel: +44 (0)845 456 4460
Fax: +44 (0)845 456 4461
www.cdo2.com

-----Original Message-----
From: Mark Brouwer [mailto:[email protected]] 
Sent: 15 May 2007 19:23
To: [email protected]
Subject: Re: Secure Jini and Tomcat

Jeff Hyatt-Steel wrote:

> I tried this and got this a certificate chain of length 1 containing:

Thanks, now we know at least which certificate it is trying to validate.

>> Something else you might try is to set a breakpoint at line 141 of
>> net.jini.jeri.ssl.FilterX509TrustManager (JTSK 2.1) and inspect the
>> trustmanager factory with a debugger to see which keystore it uses for
>> trust related questions.
>
> I tried this but couldn't seem to find the trustmanager factory and the
> trustmanager variable was null.

This is strange, trustmanager can't be null as that would have resulted
in an NPE opposed to the sun.security.validator.ValidatorException thrown.

Probably you couldn't have answered my question anyway, because
inspecting the trustmanager factory with your debugger requires local
debug information to be available in your JRE classes and even after 10
years some wise men think that developers don't need that. I've built
these classes with debug information myself for the purpose of
troubleshooting any securty class related problem, but that is not of
much use to you.

I still think the keystore being consulted isn't the one that contains
the self-signed certificate. If you don't set the keystore for the trust
manager with the javax.net.ssl.trustStore system property it will look
for the default key stores, see javax.net.ssl.trustStore in
http://java.sun.com/j2se/1.4.2/docs/guide/security/jsse/JSSERefGuide.html#Tr
ustManagerFactory

(you might need to correct the link manually). What you might try is to
add your self-signed certificate to the keystore at the following
location: <java-home>/lib/security/jssecacerts this one contains the
root certificates of the major CAs.

>> Also you talk about configuring security related stuff through
>> server.xml, the JTSK based implementation is configured through system
>> properties as mentioned in
>>
http://java.sun.com/products/jini/2.1/doc/api/net/jini/jeri/ssl/package->su
> mmary.html.

Probably you should have corrected the link, but otherwise have a look
at the net.jini.jeri.ssl package documentation at
http://java.sun.com/products/jini/2.1/doc/api .

> The link provided didn't work however loking at
> http://java.sun.com/j2se/1.5.0/docs/api/
> I couldn't find anything on trust or key stores but I do use:
>
> -Djava.security.auth.login.config=/ssl.login
> And the ssl.login file:
> XXx.XXX.XXX.XXX {
>         com.sun.security.auth.module.KeyStoreLoginModule required
>                 keyStoreAlias="client"
>                 keyStoreURL="file:///absoluteFilePath/keystore"
>                 keyStorePasswordURL="file:/// absoluteFilePath/password";
> };
>
> Although as far as I am aware this is for the Login Context that is used
to
> authenticate the client.

This is to populate the Subject the client operates under so yes it is
used to authenticate the client to the server (if required). What fails
is the trust verification for the server certificate.
--
Mark

===========================================================================
To unsubscribe, send email to [email protected] and include in the body
of the message "signoff JAVASPACES-USERS".  For general help, send email to
[email protected] and include in the body of the message "help".

To view past JAVASPACES-USERS postings, please see:
http://archives.java.sun.com/archives/javaspaces-users.html

===========================================================================
To unsubscribe, send email to [email protected] and include in the body
of the message "signoff JAVASPACES-USERS".  For general help, send email to
[email protected] and include in the body of the message "help".

To view past JAVASPACES-USERS postings, please see:
http://archives.java.sun.com/archives/javaspaces-users.html