Skip to main content

SSL/TLS certificate handling in Java

Java has very good support for SSL/TLS enabled network connections. But before going into that, let's understand the hierarchy of certificate chaining. There are two certificates involved in the whole process of SSL connection establishment.
  • Root Certificate - certificate of credibility of the certificate issuing authorities (CA) like Symantec, GeoTrust, Thawte, DigiCert, GlobalSign etc 
  • Intermediate Certificate - these certificates are provided to different service providers by the certificate issuing authorities
When a client tries to connect to a server using an SSL connection, the server responds with Intermediate Certificate and the response body. The client then checks for the validity of the Intermediate Certificate by checking whether that certificate have been issues by a trusted CA by looking for the Root Certificate. Once this validation is successful, the connection is established. It is important to note here that the clients need to have a certificate store containing the Root Certificates of all the CAs. For example, the internet browser have it. If the clients don't come pre-packed with certain Root Certificates, such certificates can also be imported. In development/non-production environments, sometimes this whole process is done away with a Self-signed Certificate which isn't issued by a CA, but instead the service hosting server. Needless to say that Root Certificate isn't involved in such cases.

Java provides certain files/tools to handle the SSL/TLS certificates. 
  • trustStore/keyStore - both of these are represented by the Java class java.security.KeyStore. These refer to the files which are represented by two different properties and are intended for different purposes. Both of these files are password protected.
  • keytool - this is used to interact with trustStore and keyStore to manage the key pairs and certificates. Various actions that can be performed with this tool are generating key pairs, exporting and importing certificates, listing and deleting keystore entry, generating certificate request. It doesn't provide a direct way to import private key though.
keyStore - it's defined by two properties namely javax.net.ssl.keyStore and javax.net.ssl.keyStorePassword. It is mainly used in SSL based server environments to store the private key and certificates (Intermediate Certificate) corresponding to your public key. These certificates are sent to clients during SSL based communication. The default format of this file is 'jks' (keystore.jks). But it can also be created in PKCS12 format. This file can be created as per the need basis. keyStores generally use a default password 'changeit'. 

trustStore - it's defined by two properties namely javax.net.ssl.trustStore and javax.net.ssl.trustStorePassword. It is mainly used by the SSL based clients. It contains the root certificates of the Certificate Authorities (CA) and a client uses the root certificate to verify if the intermediate certificate returned by the SSL based server is actually issued by a CA which the client trusts. The trustStore that comes pre-bundled with Java can be located $JAVA_HOME/lib/security/cacerts. The file format here is also 'jks' (cacerts.jks). It is also possible to use a different trustStore file than the system provided one. 

Although it is entirely possible to use a single file to represent both the keyStore and trustStore, it's a bad practice. 

Comments

Post a Comment

Popular posts from this blog

Working in India

The day I started working in SRA India(Indian arm of Japan's Software Research Associates, Inc ), I never thought that I world become an onsite team member in just one and half years. Because, the branch was very small & it was very illogical for a novice like me to think of an onsite tour that time. But the fact was that they would make you do your work in almost Japanese style. The very first day I started coding in SRA India, I was told that the Japanese were simply put - perfectionists. This simple word had a very large inner meaning. The code that you wrote should be totally bug free, robust, modifiable without introducing regression etc. The first project I was assigned to, it took a hell lot days to prepare only the detailed design(Java Doc) for a very tiny function, every molecular level detail was described on that. But somehow I made myself adjusted to such work environment. My performance was good in my batch. And in one day, one of my managers told me of an onsite a...
Post a Comment
Read more

Java collection series - miscellaneous

Java Vector is a legacy class. And it is significantly faster in comparison to a list obtained through Collections.synchronizedList(). Vector has loads of legacy operations and hence the manipulations in Vector needs to be done through the List interface, otherwise you won't be able to replace the implementation at a later time. Arrays.asList() is better choice if the list is of fixed size and any kind of size mutation of the collection results in UnsupportedOperationException. The underlying array is updated whenever the list is updated (or vice-versa), but the array reference isn't retained. Collections.nCopies() is another convenient mini-implementation which can be useful in two ways - initialize a newly created list with n null values (need not be only null values) -  new ArrayList (Collections.nCopies(1000, (Type)null)  grow an existing list -  lovablePets.addAll(Collections.nCopies(69, "fruit bat")) Collections.singleton()/Collectio...
Post a Comment
Read more

DB transaction ACID properties

DB transaction is a combination of different operations. If not performed in a proper manner, different transactions working on the same data at the same time may leave the data in corrupted state, effecting the application. In this article, I am going to illustrate DB transaction ACID properties through an example of money transfer application between two different accounts A and B. To begin with, lets suppose that accounts A and B both have initial balance of $100. ACID stands for Atomicity , Consistency , Isolation and Durability . Let's try to understand these one by one. Atomicity : This is the property that mandates that if a transaction is started, either all the operations which are part of the transaction need to be completed by end of the transaction completion as a single unit of work or none of the operations needs to be completed. It is maintained by transaction management component. If a debit of $10 is made from account A, then the corresponding credit of $10 al...
Post a Comment
Read more