Re: AW: [WSS4J] Using trusted Certs with wss4j

On Jan 27, 2004, at 12:42 AM, Dittmann Werner wrote:

> thanks for the testing and fix the problem. The whole
> area of certificate handling and verfication is not
> well tested, to say the least :-). I'm not a real
> guru in that area and _any_ help is welcome here.

I am no guru either, so bear with me.

> Just a question about your fix: the code in your e-mail
> contains a loop (enumaration loop) over all keystore
> aliases, but it seems that they are not used later on.
> Can you pls clarify? Otherwise your fix looks great.

DOH! That's a relic. This enumeration was from a bit of debug code that 
I was using to verify what exactly was in the keystore at runtime. I 
deleted all my log statements, but forgot to loose the loop.

> During the tests we always use a self-signed trusted certificate
> (produced by Dims) that is stored in a PKCS12 type keystore.
> Do you use another keystore type? Other Keystore provider?

A self signed key pair (which is what you have) works fine. I am using 
a JKS keystore with RSA keys generated by keytool, and when I use an 
entry that contains a key pair it works as well. It just seems to be a 
problem with trusted certificates.

> During some other tests I already found problems between
> different keystore types (had to introduce a specific check
> of DN string, refer to the splitAndTrim() and
> equalsStringArray() mehtods because different keystores and
> their implementation produced diffrent DN string for the
> same certificate (more blanks)).

Interesting. I thought there was an RFC that describes how the DN 
should be rendered?

> Just a remark: I'll insert the fix in my codebase here but
> will not check it in yet because SF seems to have some
> problems with the CVS server. I'll checkin as soon as SF's
> CVS is stable again.

Problems with SF CVS? I have never heard of such a thing. </sarcasm>

Sounds perfectly reasonable to me.

On Jan 27, 2004, at 12:52 AM, Dittmann Werner also wrote:

> another short question: did the decryption work on the
> server side? Because here the Security Engine needs to
> get the private key for that Certificate.

I am testing with separate keystores. The server side is a JBoss 
instance which does have the private key(actually the whole key pair). 
In my test environment, I exported the Certificate (public key) from 
that keystore, and imported it into the other keystore on my client. I 
also did the reverse. This way I could simulate an actual 2 party 
communication.

-jason



-------------------------------------------------------
The SF.Net email is sponsored by EclipseCon 2004
Premiere Conference on Open Tools Development and Integration
See the breadth of Eclipse activity. February 3-5 in Anaheim, CA.
http://www.eclipsecon.org/osdn