10.12.2012 Views

The Java EE 5 Tutorial (PDF) - Oracle Software Downloads

The Java EE 5 Tutorial (PDF) - Oracle Software Downloads

The Java EE 5 Tutorial (PDF) - Oracle Software Downloads

SHOW MORE
SHOW LESS

You also want an ePaper? Increase the reach of your titles

YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.

Signing Digital Certificates<br />

After you’ve created a digital certificate, you will want to have it signed by its owner. After the<br />

digital certificate has been cryptographically signed by its owner, it is difficult for anyone else to<br />

forge. For sites involved in e-commerce or any other business transaction in which<br />

authentication of identity is important, a certificate can be purchased from a well-known<br />

certificate authority such as VeriSign or Thawte.<br />

As mentioned earlier, if authentication is not really a concern, you can save the time and<br />

expense involved in obtaining a CA certificate and simply use the self-signed certificate.<br />

Obtaining a Digitally Signed Certificate<br />

This example assumes that the keystore is named keystore.jks, the certificate file is<br />

server.cer, and the CA file is cacerts.jks. To get your certificate digitally signed by a CA:<br />

1. Generate a Certificate Signing Request (CSR).<br />

keytool -certreq -alias server-alias -keyalg RSA -file csr-filename<br />

-keystore cacerts.jks<br />

2. Send the contents of the csr-filename for signing.<br />

3. If you are using Verisign CA, go to http://digitalid.verisign.com/. Verisign will send<br />

the signed certificate in email. Store this certificate in a file.<br />

Using a Different Server Certificate with the Application Server<br />

Follow the steps in “Creating a Server Certificate” on page 787, to create your own server<br />

certificate, have it signed by a CA, and import the certificate into keystore.jks.<br />

Make sure that when you create the certificate, you follow these rules:<br />

Establishing a Secure Connection Using SSL<br />

■ When you create the server certificate, keytool prompts you to enter your first and last<br />

name. In response to this prompt, you must enter the name of your server. For testing<br />

purposes, this can be localhost.<br />

■ <strong>The</strong> server/host specified in the keystore must match the host identified in the<br />

javaee.server.name property specified in the<br />

tut-install/javaeetutorial5/examples/bp-project/build.properties file for running<br />

the example applications.<br />

■ Your key/certificate password in keystore.jks should match the password of your<br />

keystore, keystore.jks. This is a bug. If there is a mismatch, the <strong>Java</strong> SDK cannot read the<br />

certificate and you get a “tampered” message.<br />

■ If you want to replace the existing keystore.jks, you must either change your keystore’s<br />

password to the default password (changeit) or change the default password to your<br />

keystore’s password.<br />

Chapter 28 • Introduction to Security in the <strong>Java</strong> <strong>EE</strong> Platform 789

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!