10.12.2012 Views

The Java EE 5 Tutorial (PDF) - Oracle Software Downloads

The Java EE 5 Tutorial (PDF) - Oracle Software Downloads

The Java EE 5 Tutorial (PDF) - Oracle Software Downloads

SHOW MORE
SHOW LESS

You also want an ePaper? Increase the reach of your titles

YUMPU automatically turns print PDFs into web optimized ePapers that Google loves.

Establishing a Secure Connection Using SSL<br />

790<br />

To specify that the Application Server should use the new keystore for authentication and<br />

authorization decisions, you must set the JVM options for the Application Server so that they<br />

recognize the new keystore. To use a different keystore than the one provided for development<br />

purposes, follow these steps.<br />

1. Start the Application Server if you haven’t already done so. Information on starting the<br />

Application Server can be found in “Starting and Stopping the Application Server” on<br />

page 68.<br />

2. Start the Admin Console. Information on starting the Admin Console can be found in<br />

“Starting the Admin Console” on page 69.<br />

3. Select Application Server in the Admin Console tree.<br />

4. Select the JVM Settings tab.<br />

5. Select the JVM Options tab.<br />

6. Change the following JVM options so that they point to the location and name of the new<br />

keystore. <strong>The</strong>re current settings are shown below:<br />

-Djavax.net.ssl.keyStore=${com.sun.aas.instanceRoot}/config/keystore.jks<br />

-Djavax.net.ssl.trustStore=${com.sun.aas.instanceRoot}/config/cacerts.jks<br />

7. If you’ve changed the keystore password from its default value, you need to add the<br />

password option as well:<br />

-Djavax.net.ssl.keyStorePassword=your-new-password<br />

8. Log out of the Admin Console and restart the Application Server.<br />

Miscellaneous Commands for Certificates<br />

To check the contents of a keystore that contains a certificate with an alias server-alias, use<br />

this command:<br />

keytool -list -keystore keystore.jks -alias server-alias -v<br />

To check the contents of the cacerts file, use this command:<br />

keytool -list -keystore cacerts.jks<br />

Enabling Mutual Authentication over SSL<br />

This section discusses setting up client-side authentication. When both server-side and<br />

client-side authentication are enabled, it is called mutual, or two-way, authentication. In client<br />

authentication, clients are required to submit certificates that are issued by a certificate<br />

authority that you choose to accept.<br />

<strong>The</strong> <strong>Java</strong> <strong>EE</strong> 5<strong>Tutorial</strong> • June 2010

Hooray! Your file is uploaded and ready to be published.

Saved successfully!

Ooh no, something went wrong!