<document>
<header>
  <resin-2.0>$resin/faq/ssl.xtp</resin-2.0>
  <product>resin</product>
  <title>SSL with Resin</title>
  <description>
  <p>SSL (Secure Sockets Layer) is a commonly-used protocol
  for managing the security of message transmission on the
  Internet.  SSL in your web server provides support for the
  familiar <code>https://</code> protocol.
  </p>
  <p><font color='green'><b>This connection is
  <jsp:scriptlet>if (!request.isSecure()) {</jsp:scriptlet>
  not
  <jsp:scriptlet>}</jsp:scriptlet>
  using SSL.</b></font></p>
  </description>
</header>

<body>
<summary/>

<section name="notneeded" title="Resin is not always responsible for SSL">

<p>When you are using Resin as a servlet runner behind another web
server, such as Apache or IIS, the web server is responsible for
handling SSL.  The request looks like a regular unencrypted request to
Resin.</p>

<p>In a similar fashion, a hardware accelerator is sometimes used to
boost the performance of a server supporting SSL.  This causes the
incoming requests to look like regular unencrypted requests to
Resin.</p>

<p>Even if you're using Apache/IIS for SSL support, you can still use
Resin's standalone web server for non-SSL pages. Your resin.conf will
need to list both a &lt;http port='80'/&gt; and a &lt;srun port='6802'/&gt;.</p>
</section>

<section name="aboutssl" title="What SSL provides">

<p>SSL provides two kinds of protection, <var/encryption/> and <var/server
authentication/>.</p>

<section title="Encryption">

<glossary title="public key">
<p>A set of bytes used to <var/encrypt/> data and <var/verify signatures/>.
The key is public because it can be made available without a loss of security.
The public key can only be used for encryption; it cannot decrypt
anything.  A public key always has a corresponding <var/private key/>.</p>
</glossary>


<p>SSL provides encryption of the data traffic betweeen a client and a server.
When the traffic is encrypted, an interception of that traffic will not reveal
the contents because they have been encrypted - it will be unusable
nonsense.</p>

<glossary title="private key" type="sidebar-left">
<p>A set of bytes used to <var/decrypt/> data and <var/generate signatures/>.
The key is private because it must be kept secret or there will be a loss of
security.  The private key is used for decryption of data that has been
encrypted with the corresponding <var/public key/>.</p>
</glossary>

<p>
SSL uses public key cryptography.  Public key cryptography is based upon a
pair of keys, the public key and the private key.  The public key is used to
encrypt the data.  Only the corresponding private key can successfully decrypt
the data.  
</p>

<p>
For example, when a browser connects to Resin, Resin provides the browser a
public key.  The browser uses the public key to encrypt the data, and Resin
uses the private key to decrypt the data.  For this reason, it is important that
you never allow anyone access to the private key, if the private key is
obtained by someone then they can use it to decrypt the data traffic. 
</p>

<p>Encryption is arguably the more important of the security meausures that SSL
provides.</p>

</section> <!-- aboutssl/Encryption -->

<section title="Server Authentication">

<glossary title="certificate">
<p>A combination of a <var/private key/>, identity information (such as company
name), and a <var/signature/> generated by a <var/signing authority/>.
<var/private key/>.</p>
</glossary>

<p>
SSL also provides the ability for a client to verify the identity of a server.
This is used to protect against identity theft, where for example a malicious
person imitates your server or redirects client traffic to a different server
while pretending to be you.
</p>

<glossary title="signing authority" type="sidebar-left">
<p>A company that is trusted to sign certificates.  Browsers include
certificates of signing authorities that they trust.</p>
</glossary>

<p>
Server authentication uses the signature aspect of public key cryptography.
The private key is used to sign messages, and the public key is used to verify
the signature.  With SSL, the validity of signatures depends upon signing
authorities.  Signing authorites (also called certificate authorities) are
companies who have generated public keys that are included with browser
software.  The browser knows it can trust the signing authority, and the
signing authority signs your SSL certificate, putting its stamp of approval on
the information in your certificate.
</p>

<glossary title="certificate authority">
<p>Another name for <var/signing authority/>.  A company that is trusted to
sign certificates.  Browsers include certificates of signing authorities that
they trust.</p>
</glossary>

<p>For example, after you generate your public and private key, you then
generate a signing request and send it to a signing authority.  This signing
request contains information about your identity, this identity information is
confirmed by the signing authority and ultimately displayed to the user of the
browser.  The signing authority validates the identity information you have
provided and uses their private key to sign, and then returns a
<var/certificate/> to you.  This certificate contains the identity information
and your public key, verified by the signing authority, and is provided to the
browser. Since the browser has the public key of the signing authority, it can
recognize the signature and know that the identity information has been
provided by someone that can be trusted.</p>


</section> <!-- aboutssl/Server Authentication -->

</section> <!-- aboutssl -->

<section name="openssl" title="OpenSSL">

<p>OpenSSL is the same SSL implementation that Apache's mod_ssl
uses. Since OpenSSL uses the same certificate as Apache, you can get
signed certificates using the same method as for Apache's mod_ssl or
following the OpenSSL instructions.</p>

<section title="Linking to the OpenSSL Libraries on Unix">

<p>On Unix systems, Resin's libexec/libresinssl.so JNI library
supports SSL using the
<a href="http://www.openssl.org">OpenSSL</a> libraries.
Although the ./configure script will detect many configurations,
you can specify the openssl location directly:</p>

<example>
resin> ./configure --with-openssl=/usr/local/ssl
</example>
</section>

<section title="Obtaining the OpenSSL Libraries on Windows">

<p>On Windows systems, the resinssl.dll includes JNI code to use
OpenSSL libraries (it was in resin.dll in versions before 3.0).  All
you need to do is to obtain an OpenSSL binary distribution and install
it. </p>
  
<p>Resin on Windows is compiled against the GnuWin32 binary, you can obtain an
installation package 
<a href="http://gnuwin32.sourceforge.net/packages/openssl.htm">here</a>.
</p>

<p>Once you have run the installation package, you can copy the necessary
dll libraries into <code>$RESIN_HOME</code>:</p>

<example title="Copying the Windows SSL libraries into $RESIN_HOME">
C:\&gt; cd %RESIN_HOME%
C:\resin-3.0&gt; copy "C:\Program Files\GnuWin32\bin\libssl32.dll" .\libssl32.dll
C:\resin-3.0&gt; copy "C:\Program Files\GnuWin32\bin\libeay32.dll" .\libeay32.dll
</example>


</section>

<section title="Preparing to use OpenSSL for making keys">
<p>You can make a <code>keys/</code> subdirectory of $RESIN_HOME to do
your work from and as a place to store your generated keys.</p>

<example title="$RESIN_HOME/keys">
unix> cd $RESIN_HOME
unix> mkdir keys
unix> cd keys

win> cd %RESIN_HOME%
win> mkdir keys
win> cd keys
</example>

<p>Using OpenSSL requires a configuration file.  Unix users might find
the default configuration file in <code>/usr/ssl/openssl.cnf</code>
or <code>/usr/share/ssl/openssl.cnf</code>.  Windows users may not
have received one with their package.</p>

<p>Either way, it can be valuable to make your own
<code>openssl.cnf</code> that is used just for generating the keys to
use with Resin.  You can use the following as a template for a file
<code>$RESIN_HOME/keys/openssl.cnf</code>.  You may want to fill in
the <code>_default</code> values so you don't have to type them in
every time.</p>

<example title="$RESIN_HOME/keys/openssl.cnf">
[ req ]
 default_bits            = 1024
 distinguished_name      = req_distinguished_name

[ req_distinguished_name ]
 C                      = 2 letter Country Code, for example US
 C_default              =
 ST                     = State or Province
 ST_default             =
 L                      = City
 L_default              =
 O                      = Organization Name
 O_default              =
 OU                     = Organizational Unit Name, for example 'Marketing'
 OU_default             =
 CN                     = your domain name, for example www.hogwarts.com
 CN_default             =
 emailAddress           = an email address
 emailAddress_default   =

</example>
</section>

<section title="Creating a private key">

<p>Create a private key for the server.  You will be asked for a
password - don't forget it!  You will need this password anytime you
want to do anything with this private key.  But don't pick something
you need to keep secret, you will need to put this password in the
Resin configuration file.</p>

<example title="creating the private key gryffindor.key">
unix> openssl genrsa -des3 -out gryffindor.key 1024
win>  "C:\Program Files\GnuWin32\bin\openssl.exe" \
         genrsa -des3 -out gryffindor.key 1024
</example>

</section>

<section title="Creating a certificate">
<p>OpenSSL works by having a signed public key that corresponds to your
private key.  This signed public key is called a <var/certificate/>.  A
certificate is what is sent to the browser.</p>

<p>You can create a self-signed certificate, or get a certificate that
is signed by a certificate signer (CA).</p>

<section title="Creating a self-signed certificate">

<p>You can create a certificate that is self-signed, which is good for
testing or for saving you money.  Since it is self-signed, browsers will not
recognize the signature and will pop up a warning to browser users.  Other than
this warning, self-signed certificates work well. The browser cannot confirm
that the server is who it says it is, but the data between the browser and the
client is still encrypted.</p>

<example title="creating a self-signed certificate gryffindor.crt"
         size="smaller">
unix> openssl req -config ./openssl.cnf -new -key gryffindor.key \
        -x509 -out gryffindor.crt
win> "C:\Program Files\GnuWin32\bin\openssl.exe" req -config ./openssl.cnf \
         -new -key gryffindor.key -x509 -out gryffindor.crt
</example>

<p>You will be asked to provide some information about the identity of
your server, such as the name of your Organization etc.  Common Name
(CN) is your domain name, like: "www.gryffindor.com".</p>

</section>

<section title="Creating a certificate request">

<p>To get a certificate that is signed by a CA, first you generate a
<var/certificate signing request/> (CSR).</p>

<example title="creating a certificate request gryffindor.csr"
         size="smaller">
unix> openssl req -new -config ./openssl.cnf -key gryffindor.key \
      -out gryffindor.csr
win> "C:\Program Files\GnuWin32\bin\openssl.exe" req -new \
      -config ./openssl.cnf  -key gryffindor.key -out gryffindor.csr
</example>

<p>You will be asked to provide some information about the identity of
your server, such as the name of your Organization etc.  Common Name
(CN) is your domain name, like: "www.gryffindor.com".</p>

<p>Send the CSR to a certificate signer (CA).  You'll use the CA's
instructions for Apache because the certificates are identical.  Some
commercial signers include:</p>

<ul>
<li><a href="external|digitalid.verisign.com|server/apacheNotice.htm">Verisign</a>
<li><a href="external|www.thawte.com|certs/server/request.html">Thawte Consulting</a>
</ul>
<p>You'll receive a <em>gryffindor.crt</em> file.</p>

<p>Most browsers are configured to recognize the signature of signing
authorities.  Since they recognize the signature, they will not pop up a
warning message the way they will with self-signed certificates.  The browser
can confirm that the server is who it says it is, and the data between the
browser and the client is encrypted.</p>

</section>
</section>

<section title="resin.conf - Configuring Resin to use your private key and certificate">

<p>The OpenSSL configuration has two tags <a config-tag='certificate-file'/> and
<a config-tag='certificate-key-file'/>.  These correspond exactly to mod_ssl's
SSLCertificateFile and SSLCertificateKeyFile.  So you can use the same
certificates (and documentation) from mod_ssl for Resin.</p>

<p>The full set of parameters is in the port configuration.</p> 

<example>
...
&lt;http port="443">
  &lt;openssl>
    &lt;certificate-file>keys/gryffindor.crt&lt;/certificate-file>
    &lt;certificate-key-file>keys/gryffindor.key&lt;/certificate-key-file>
    &lt;password>my-password&lt;/password>
  &lt;/openssl>
&lt;/http>
</example>

</section>

<section title="Testing">

<section title="Testing with the browser">

<p><jsp:scriptlet>if (request.isSecure()) {</jsp:scriptlet>
<p><code>request.isSecure()</code> is reporting true, so it looks like
you have SSL working and are viewing this page over an SSL encrypted
connection.</p>
<jsp:scriptlet>} else {</jsp:scriptlet>
<p>Once you have SSL configured, you can come back to this page using
an <code>https://</code> style URL instead of an <code>http://</code>
url and you will get a message telling that SSL is working.
<jsp:scriptlet>}</jsp:scriptlet>

<p>A quick test is the following JSP.</p>

<example>
Secure? &lt;%= request.isSecure() %>
</example>
</section>

<section title="Using openssl to test the server">
<p>
The openssl tool can be used as a client, showing some interesting information
about the conversation between the client and the server:
</p>

<example>
unix$ openssl s_client -connect www.some.host:443 -prexit
</example>
</section>
</section> <!-- testing -->

<section title="Certificate Chains">

<p>A <var/certificate chain/> is used when the signing authority is not an
authority trusted by the browser.  In this case, the signing authority uses a
certificate which is in turn signed by a trusted authority, giving a chain of
<code>[your certificate] &lt;--- signed by ---- [untrusted signer] &lt;---- signed by ---- [trusted signer]</code>.

<p>
The Resin config parameter <a config-tag="certificate-chain-file"/> is used to
specify a certificate chain.  It is used to reference a file that is a
concatenation of:
</p>

<ol>
<li>your certificate file
<li>the intermediate (untrusted) certificate
<li>the root (trusted) certificate.
</ol>

<p>
The certificates must be in that order, and must be in PEM format.
</p>

<section title="Example certificate chain for Instant SSL">

<p>
<a href="http://instantssl.com">Comodo (http://instantssl.com)</a> is a signing
authority that is untrusted by most browsers.  Comodo has their certificate
signed by GTECyberTrust.
</p>

<p>
Comodo gives you three certificates:
</p>

<ol>
<li><code>your_domain.crt</code>   (signed by Comodo)
<li><code>ComodoSecurityServicesCA.crt</code>   (signed by GTE CyberTrust)
<li><code>GTECyberTrustRoot.crt</code>  (universally known root)
</ol>

<p>
In addition to this, you have your key, <code/your_domain.key/>.
The contents of the file referred to by <a
config-tag="certificate-chain-file"/> is a concatenation of the three
certificates, in the correct order.
</p>

<example title="Creating a certificate chain file">
$ cat your_domain.crt ComodoSecurityServicesCA.crt GTECyberTrustRoot.crt &gt; chain.txt
</example>

<example title="resin.conf using a certificate chain file">
&lt;http port="443"&gt;
  &lt;openssl&gt;
    &lt;certificate-key-file&gt;keys/your_domain.key&lt;/certificate-key-file&gt;
    &lt;certificate-file&gt;keys/your_domain.crt&lt;/certificate-file&gt;        
    &lt;certificate-chain-file&gt;keys/chain.txt&lt;/certificate-chain-file&gt;
    &lt;password&gt;test123&lt;/password&gt;
  &lt;/openssl&gt;
&lt;/http&gt;
</example>

</section> <!-- example certificate chain -->

</section> <!-- certificate chain -->

</section> <!-- OpenSSL -->


<section name="jsse" title="JSSE">

<p>We recommend avoiding JSSE if possible. It is slower than using
Resin's OpenSSL support and does not appear to be as stable as Apache
or IIS (or Netscape/Zeus) for SSL support. In addition, JSSE is far
more complicated to configure. While we've never received any problems
with Resin using OpenSSL, or SSL from Apache or IIS, JSSE issues are
fairly frequent.</p>

<section title="Install JSSE from Sun">

<p>This section gives a quick guide to installing a test SSL
configuration using Sun's JSSE.  It avoids as many complications as
possible and uses Sun's keytool to create a server certificate.</p>

<p>Resin's SSL support is provided by Sun's
<a href='http://java.sun.com/products/jsse'>JSSE</a>.  Because of
export restrictions, patents, etc, you'll need to download the JSSE
distribution from Sun or get a commercial JSSE implementation.</p>

<p>More complete JSSE installation instructions for JSSE are at
<a href="http://java.sun.com/products/jsse/install.html">http://java.sun.com/products/jsse/install.html</a>.
</p>
<ol>
<li>First download Sun's <a href="http://java.sun.com/products/jsse">JSSE</a>.
<li>Uncompress and extract the downloaded file.
<li>Install the JSSE jar files: jsse.jar, jnet.jar, and jcert.jar.  You can
either put them into the CLASSPATH or you can put them into $JAVA_HOME/jre/lib/ext.  Since you will use "keytool" with the new jars, you need to make them
visible to keytool.  Just adding them to resin/lib is not enough.
<li>Register the JSSE provider (com.sun.net.ssl.internal.ssl.Provider).
Modify $JAVA_HOME/jre/lib/security/java.security so it contains something like:
<example>
security.provider.1=sun.security.provider.Sun
security.provider.2=com.sun.net.ssl.internal.ssl.Provider
</example>
Adding the JSSE provider allows "keytool" to create a key using the RSA
algorithm.
</ol>

</section>

<section title="Create a test server certificate">

<p>The server certificate is the core of SSL.  It will identify your server and
contain the secret key to make encryption work.</p>

<ul>
<li>Sun's keytool
<li>A self-signed certificate using open_ssl
<li>A test certificate from Thawte
<li>A production certificate from one of the certificate authorities (Verisign, Thawte, etc)
</ul>

<p>In this case, we're using Sun's <var/keytool/> to generate the
server certificate.  Here's how:</p>

<example>
resin1.2.b2> <var/mkdir keys/>
resin1.2.b2> <var/keytool -genkey -keyalg RSA -keystore keys/server.keystore/>
Enter keystore password:  <var/changeit/>
What is your first and last name?
  [Unknown]:  <var/www.caucho.com/>
What is the name of your organizational unit?
  [Unknown]:  <var/Resin Engineering/>
What is the name of your organization?
  [Unknown]:  <var/Caucho Technology, Inc./>
What is the name of your City or Locality?
  [Unknown]:  <var/San Francisco/>
What is the name of your State or Province?
  [Unknown]:  <var/California/>
What is the two-letter country code for this unit?
  [Unknown]:  <var/US/>
Is &lt;CN=www.caucho.com, OU=Resin Engineering,
  O="Caucho Technology, Inc.", L=San Francisco, ST=California, C=US> correct?
  [no]:  <var/yes/>

Enter key password for &lt;mykey>
        (RETURN if same as keystore password):  <var/changeit/>
</example>

<p>Currently, the key password and the keystore password must be the same.</p>

</section>

<section title="resin.conf">

<p>The Resin SSL configuration extends the http configuration with a few new
elements.</p>

<example>
&lt;resin xmlns="http://caucho.com/ns/resin">
  &lt;server>

    &lt;http port="8443">
     &lt;jsse-ssl>
       &lt;key-store-type>jks&lt;/key-store-type>
       &lt;key-store-file>keys/server.keystore&lt;/key-store-file>
       &lt;password>changeit&lt;/password>
     &lt;/jsse-ssl>
    &lt;/http>

    ...

  &lt;/http-server>
&lt;/caucho.com>
</example>

</section>

<section title="Testing JSSE">

<p>With the above configuration, you can test SSL with https://localhost:8443.
A quick test is the following JSP.</p>

<example>
Secure? &lt;%= request.isSecure() %>
</example>

</section>

        
<section title="User Experiences with JSSE">

<section title="How do I configure Resin with SSL using JSSE?">

<p>Nicholas Lehuen writes:</p>

<p>Here is a short step-by-step installation guide for SSL on Resin.</p>
 
<p>The purpose : to install SSL support on Resin</p>

<section title='Requirements'>
<ul>
<li>The latest Resin 1.2 snapshot (I used the 08/04/2000 snapshot with success)
    http://www.caucho.com/download/index.xtp
<li>JSSE 1.0.1
    http://java.sun.com/products/jsse/
<li>Optional : a certificate authority (CA) such as Verisign, Thawte, or your own. Thawte is providing a free test certificate authority
service which enables you to check the certification process before buying your own certificate. Of course, you can also skip the CA by
providing self-signed public key certificate. This will be explained later.

<a href="https://www.thawte.com/cgi/server/test.exe">https://www.thawte.com/cgi/server/test.exe</a>
</ul>
</section>

 
<section title="JSSE setup">

<ol>
<li>Follow the installation instructions
<a href="http://java.sun.com/products/jsse/install.html">http://java.sun.com/products/jsse/install.html</a>
<li>Even if Resin has its own provider registration system (we'll see it on next step), I suggest that you statically register the SunJSSE
by editing the &lt;java-home>/lib/security/java.security as explained in the installation guide. This will ease the use of keytool.
</ol>
</section>
 
<section title="Keystore initialization">
<ol>
<li>Create a directory named 'keys' somewhere in your Resin installation. I suggest you place it in the Resin home directory.
<li>Copy the file &lt;java-home>/lib/security/cacerts into the 'keys' directory
<li>Rename the cacerts file as you want. I'll suppose you name it 'private.keystore'.
</ol>

</section>
<section title="Keystore protection">
<p>Your private.keystore file is for the moment a copy of the cacerts keystore, which contains the CA public key certificates (very
important for client HTTPS connections). We will insert your own private key in this file, thus it'll have to be password-protected, so
that anyone stealing it will have difficulties in forging certificates on your behalf.</p>

<ol>
<li>Go into the 'keys' directory
<li>type the following command :
keytool -storepasswd -storepass changeit -new YourPasswordHere \
        -keystore private.keystore
</ol>
 
<p>(the default password for the cacerts keystore is 'changeit')</p>
 
</section>

<section title="Private key generation">

<p>We'll now generate your key pair, which is composed of a private (the one which MUST remain secret !) and a public key. The point here is
to use the RSA key pair generator, and NOT the default one, which is DSA. This is were the JSSE security provider is used.</p>
 
<p>type the following command :</p>
<example>
M:\keys>keytool -genkey -keyalg RSA -alias myserverkeypair \
                -storepass YourPasswordHere -keystore private.keystore
What is your first and last name?
  [Unknown]:  www.myserver.com
What is the name of your organizational unit?
  [Unknown]:  Foo Dept
What is the name of your organization?
  [Unknown]:  Bar
What is the name of your City or Locality?
  [Unknown]:  Paris
What is the name of your State or Province?
  [Unknown]:  France
What is the two-letter country code for this unit?
  [Unknown]:  FR
Is &lt;CN=www.myserver.com, OU=Foo Dept, O=Bar, L=Paris,
                ST=France, C=FR> correct?
  [no]:  yes
 
Enter key password for &lt;myserverkeypair>
        (RETURN if same as keystore password):
</example>
 
<p>You MUST mention your HTTP server name as the CN of the certificate (thus the reply to 'first and last name'). Browsers would emit
warnings to your users if you didn't. Any other informations are at your choice, however the process of key pair generation and
attributes definitions is very strict for "real-life" cryptography, i.e. Verisign will double-check your identity, address and so on.</p>
 
<p>Another important point : DON'T AFFECT A PASSWORD to your key pair. It must remain the same as the keystore, at least until Resin
provides a means of configuring the key pair password.</p>
</section>

<section title="Public Key Certificate (optional)">

<p>Request a public key certificate and insert the public key certificate into your keystore.</p>

<p>For users to trust your server, you'll have to have your public key
certificate (PKC) signed by a Certificate Authority (CA) (Verisign,
Thawte, Certplus...). This is done by sending a certificate signature
request (CSR) to the CA, coping with all the legal stuff and
getting a signed PKC in return. This step is mandatory for production server, unless you have some means to convince your users that your
PKC is valid without a CA signature, which is possible in intranet environment for example. However, for testing purpose, you can start
by using your self-signed PKC without any CA signature. An intermediary solution is to use a test CA so that you can check that your CSR
is correctly emitted, that the Certificate Chain is correctly checked, and so on. Thawte provides a test CA at the address mentioned
above.</p>

<ol>
<li>Generate a CSR by typing the following command :

<example>

M:\keys>keytool -certreq -alias myserverkeypair -storepass YourPasswordHere \
                -keystore private.keystore
-----BEGIN NEW CERTIFICATE REQUEST-----
MIIBqjCCARMCAQAwajELMAkGA1UEBhMCRlIxDzANBgNVBAgTBkZyYW5jZTEOMAwGA1UEBxMFUGFy
... cut ...
KDYZTklbg1NOiXTdXIhPHb3+YOgZ+HoeDTxOx/rRhA==
-----END NEW CERTIFICATE REQUEST-----
</example>
 
<li>Copy/Paste the CSR into the text box at the following address. Leave all options with their default value.
    https://www.thawte.com/cgi/server/test.exe
 
<li>You'll get a certificate looking like :
<example>
-----BEGIN CERTIFICATE-----
MIICjzCCAfigAwIBAgIDBp8SMA0GCSqGSIb3DQEBBAUAMIGHMQswCQYDVQQGEwJa
... cut ...
/93Q58iI4fgQ/kc+l8ogpVwh/IJw1Ujmszd19Jf+pxyySMM=
-----END CERTIFICATE-----
</example>
<li>Copy/Paste this certificate into a file named 'myserver.cer' . If you have Microsoft Internet Explorer 5.0 (maybe 4.0) installed, you
can open this .cer file and see the certificate as your user will when they ask the security properties of pages served securely by your
server. A warning should be emitted, stating that you can't trust the certificate as it does not point to a trusted root CA. You can keep
going with this warning or download and trust the test root CA (available on https://www.thawte.com/servertest.crt ). Be ware though that
the final user should not and surely won't accept to trust this test root CA.
 
<li>Anyway, to be able to import your signed certificate, you'll have to import the test root CA certificate. Download it and import it
using the following command :
<example>
M:\keys>keytool -import -alias servertest -storepass YourPasswordHere \
                -keystore private.keystore -file servertest.crt
Owner: CN=Thawte Test CA Root, OU=TEST, O=Thawte, ST=FOR TESTING, C=ZA
Issuer: CN=Thawte Test CA Root, OU=TEST, O=Thawte, ST=FOR TESTING, C=ZA
Serial number: 0
Valid from: Thu Aug 01 02:00:00 CEST 1996 until: Thu Dec 31 22:59:59 CET 2020
Certificate fingerprints:
         MD5:  5E:E0:0E:1D:17:B7:CA:A5:7D:36:D6:02:DF:4D:26:A4
         SHA1: 39:C6:9D:27:AF:DC:EB:47:D6:33:36:6A:B2:05:F1:47:A9:B4:DA:EA
Trust this certificate? [no]:  yes
Certificate was added to keystore
</example>
 
<li>Import the certificate and attach it to your server key pair by typing the command :
<example>
M:\keys>keytool -import -alias myserverkeypair -storepass YourPasswordHere \
                -keystore private.keystore -file myserver.cer
Certificate reply was installed in keystore
</example>
</ol>
</section>

<section title="Key pair verification">

<p>Issue the following command :</p>
<example>
M:\keys>keytool -list -v -alias myserverkeypair -storepass YourPasswordHere \
                -keystore private.keystore
Alias name: myserverkeypair
Creation date: Fri Aug 11 23:07:53 CEST 2000
Entry type: keyEntry
Certificate chain length: 2
Certificate[1]:
Owner: CN=www.myserver.com, OU=Foo Dept, O=Bar, L=Paris, ST=France, C=FR
Issuer: CN=Thawte Test CA Root, OU=TEST, O=Thawte, ST=FOR TESTING, C=ZA
Serial number: 69f12
Valid from: Fri Aug 11 23:00:07 CEST 2000 until: Mon Sep 11 23:00:07 CEST 2000
Certificate fingerprints:
         MD5:  41:84:55:8C:A1:85:28:DA:B0:5A:47:D6:5B:D2:ED:41
         SHA1: 61:DE:DB:E6:7C:3C:AD:90:63:9B:20:E0:FF:3B:02:3A:60:EB:B4:82
Certificate[2]:
Owner: CN=Thawte Test CA Root, OU=TEST, O=Thawte, ST=FOR TESTING, C=ZA
Issuer: CN=Thawte Test CA Root, OU=TEST, O=Thawte, ST=FOR TESTING, C=ZA
Serial number: 0
Valid from: Thu Aug 01 02:00:00 CEST 1996 until: Thu Dec 31 22:59:59 CET 2020
Certificate fingerprints:
         MD5:  5E:E0:0E:1D:17:B7:CA:A5:7D:36:D6:02:DF:4D:26:A4
         SHA1: 39:C6:9D:27:AF:DC:EB:47:D6:33:36:6A:B2:05:F1:47:A9:B4:DA:EA
</example>
 
<p>As you can see the alias myserverkeypair points to a keyEntry type entry, its certificate chain has 2 certificate, the first being your
own certificate, signed by the Thawte Test CA Root, and the other being the Thawte Test CA Root own.</p>
 
</section>

<section title="Resin configuration (resin.conf)">

<p>add the support for the SunJSSE security provider :</p>

<example>
&lt;resin xmlns="http://caucho.com/ns/resin">
    &lt;security-provider id='com.sun.net.ssl.internal.ssl.Provider'/>
 
&lt;!-- declare a new HTTP server on port 443 (standard port for HTTPS),
      - with SSL enabled -->
 
&lt;server>
  &lt;!-- the http port -->
  &lt;http port="80"/>

  &lt;!-- the srun port, read by both JVM and plugin -->
  &lt;cluster>
    &lt;srun host='localhost' port='6802'/>
  &lt;/cluster>
 
  &lt;http port=443>
    &lt;jsse-ssl>
      &lt;key-store-type>jks&lt;/key-store-type>
      &lt;key-store-file>file://m:/keys/private.keystore&lt;/key-store-file>
      &lt;password>YourPasswordHere&lt;/password>
    &lt;/jsse-ssl>
  &lt;/http>
</example>
</section>

<section title="Test !">
<p>Try connecting to your server with https instead of http !</p>
 
<p>I've been running successfully SSL on Resin with JDK 1.3 on Windows NT 4 SP6 and JDK 1.2.2 on Solaris 7.</p>
 
<p>And the fun begins when mixing HTTPS and WAP... !</p>

</section>

</section> <!-- how do I ...-->

</section> <!-- user experiences -->

</section> <!-- JSSE -->



</body>

</document>
