WebSphere Application Server V7.0: Concepts ... - IBM Redbooks

that is involved in an Internet transaction, either financial or operational, with
requirements for identity verification. It also supports the use of certificate
revocation lists (CRLs), which are lists of revoked certificates.
Secure Sockets Layer
Secure Sockets Layer (SSL) is the industry standard for data interchange
encryption between clients and servers. SSL provides secure connections
through the following technologies:
► Communication privacy
The data that passes through the connection is encrypted.
► Communication integrity
The protocol includes a built-in integrity check.
► Authentication
The server authenticates the client, interchanging digital certificates.
A certificate is an encrypted, password-protected file that includes the following
information:
► Name of the certificate holder
► Private key for encryption/decryption
► Verification of sender’s public key
► Name of the certificate authority
► Validity period for the certificate
A certificate authority is an organization that issues certificates after verifying the
requester’s identity.
Certificate management
Certificates can be created and managed through the Integrated Solutions
Console.
WebSphere Application Server provides mechanisms for creating and managing
client CA clients and keystores, and for creating self-signed certificates and
certificate authority requests.
12.2.4 Application security
The Java EE specification defines the building blocks and elements of a Java EE
application that build an enterprise application. The specification provides details
about security related to different elements. A typical Java EE application
consists of an application client tier, a Web tier, a EJB tier, and a Web services
396 WebSphere Application Server V7.0: Concepts, Planning, and Design