Implementation of ssl injava
- 1. Introduction Name – Tanuj Agrawal Class – IT-I VI Sem Topic – Implementation Of SSL In Java (Tomcat) And In PHP
- 2. Web Server And Web Container Web Server is the application that understand the HTTP request only (it does not process the request) and give the request to the appropriate container for processing. Web Container-Web Container is the actual one that processes the request and generate the response. Types of containers A-Context (Application) B-Engine (Service) C-Host (Virtual Host) D-Cluster (Set of Application) There can be multiple containers within the single server.
- 3. What is Tomcat Tomcat is not a web server it is a package which contains web server and web container. Actually when we install the Tomcat application named as HtttpConnector is installed with it which works as the Web Server. Tomcat uses the Apache Portable Runtime (APR) it provides some functionality. A-Advanced i/O functionality B-Support for OpenSSL C-OS level functionality It includes three connectors A-HTTP B-HTTPS C-AJP (Apache Java Protocol) Tomcat uses the JSSE configuration and uses the open SSL style configuration.
- 4. What is SSL (Secure Socket Layer) SSL, or Secure Socket Layer, is a technology which allows web browsers and web servers to communicate over a secured connection. This means that the data being sent is encrypted by one side, transmitted, then decrypted by the other side before processing. This is a two-way process, meaning that both the server AND the browser encrypt all traffic before sending out data.
- 5. Another important aspect of the SSL protocol is Authentication. This means that during your initial attempt to communicate with a web server over a secure connection, that server will present your web browser with a set of credentials, in the form of a "Certificate", as proof the site is who and what it claims to be. In certain cases, the server may also request a Certificate from your web browser, asking for proof that you are who you claim to be. This is known as "Client Authentication," although in practice this is used more for business-to-business (B2B) transactions than with individual users. Most SSL-enabled web servers do not request Client Authentication.
- 6. What is certificate ? In order to implement SSL, a web server must have an associated Certificate for each external interface (IP address) that accepts secure connections. The theory behind this design is that a server should provide some kind of reasonable assurance that its owner is who you think it is, particularly before receiving any sensitive information For sites involved in e-commerce, or any other business transaction in which authentication of identity is important, a Certificate is typically purchased from a well-known Certificate Authority (CA) such as VeriSign or Thawte. Such certificates can be electronically verified -- in effect, the Certificate Authority will vouch for the authenticity of the certificates that it grants, so you can believe that that Certificate is valid if you trust the Certificate Authority that granted it.
- 7. Configuring tomcat for running SSL It has been Done In Three Easy Steps. 1-Generating A self signed certificate. 2-Configuring The Tomcat For enabling SSL 3-Configuring your application to run on SSL
- 8. Step-1 Java provides a relatively simple command-line tool, called keytool , which can easily create a "self-signed" Certificate. Self-signed Certificates are simply user generated Certificates which have not been officially registered with any well-known CA, and are therefore not really guaranteed to be authentic at all.It generates the keystore file which would store the details of the certificates necessary to make the protocol secured. First we create a keystore file (.jks) keytool -genkey -alias tomcat -keyalg RSA -keystore C:\keystore.jks When we give this command it will ask for some information about your name,organization,locality etc.
- 9. Certificate signing request (.csr) keytool -certreq -keyalg RSA -alias tomcat -file certreq.csr -keystore c:\keystore.jks This (.csr) can be sent to certifying authority for certification. After getting back the authenticated certificate from the vendor it can be imported into the keystore of your server.
- 10. Step-2 Configuring the server.xml for enabling the SSL support in Tomcat that server.xml will be found in the C:\Program Files\Apache Software Foundation\Tomcat 6.0\conf\ Find this tag in this file <!-- <Connector port="8443" ……………. /> --> By default it is commented remove the comments and place an additional attribute keystore in this tag keystoreFile="C:keystore.jks"
- 11. Step-3 Configuring your application’s web.xml open the web.xml of that application and just add this XML fragment before web-app ends i.e </web-app> <security-constraint> <web-resource-collection> <web-resource-name>securedapp</web-resource-name> <url-pattern>/*</url-pattern> </web-resource-collection> <user-data-constraint> <transport-guarantee> CONFIDENTIAL </transport-guarantee> </user-data-constraint> </security-constraint>
- 12. /* indicates that now, any resource in your application can be accessed only with https be it Servlets or JSP’s The term CONFIDENTIAL is the term which tells the server to make the application work on SSL. If you want to turn the SSL mode for this application off then just turn don’t delete the fragment. Just put the value as NONE instead of CONFIDENTIAL Now your server and application both has been configured to run on SSL . Type https://localhost :8443 URL in browser. A page opens with a warning .This warning comes due to the self signed certificates because browser can not auhenticate these certificates so we have to add an exception.
- 13. SSL on PHP We use the XAMPP server for running PHP .it is a complete package with all the required tools. Apache server PHP MySQL It have many extensions already installed with it and openSSL is also one of them. So we need not to do anything with XAMPP for running SSL on PHP . We should type the URL https://localhost in your browser and need to add an exception and it will run.
- 14. Thank You TANUJ AGRAWAL (tanuj.agrawal@hotmail.com)