I made my implementation of the HTTP protocol following the specification of the W3C in Java. But I can't handle https connections.
There is nothing special about HTTPs when it comes to HTTP protocol. All you need is to open server SSL socket and once the new connection comes, get the socket's input stream and you can use it (maybe after wrapping to buffered input stream) in the same way as for HTTP.
int port = 443;
ServerSocketFactory ssocketFactory = SSLServerSocketFactory.getDefault();
ServerSocket ssocket = ssocketFactory.createServerSocket(port);
Socket socket = ssocket.accept();
EDIT: You might be missing server keystore. Pls try to follow this tutorial: http://stilius.net/java/java_ssl.php i.e.
generate server keystore:
keytool -genkey -keystore mySrvKeystore -keyalg RSA
run your server with proper arguments like:
java -Djavax.net.ssl.keyStore=mySrvKeystore -Djavax.net.ssl.keyStorePassword=123456 EchoServer
Related
In order to secure my Thrift server against the recently discovered SSLv3 vulnerability, I explicitly stated which protocols should be enabled for the server socket:
TServerSocket socket = TSSLTransportFactory.getServerSocket(...);
SSLServerSocket sslServerSocket = (SSLServerSocket) socket.getServerSocket;
sslServerSocket.setEnabledProtocols(new String[] {"TLSv1.1", "TLSv1.2"});
However, even though a check using the TestSSLServer lists only TLSv1.1 and TLSv1.2, I'm still able to connect with OpenSSL using SSLv3:
openssl s_client -connect localhost:1111 -ssl3
How can I entirely disable SSLv3 on Thrift, so it fails during the SSL handshake already?
It seems I misinterpreted the openssl client output. Even though there is CONNECTED(00000003) on the first line, the error message follows:
140535757866656:error:1408F10B:SSL routines:SSL3_GET_RECORD:wrong version number:s3_pkt.c:337:
It is, therefore, not possible to connect to the server; the code snippet presented in the question works fine.
I am getting this error: javax.net.ssl.SSLHandshakeException: no cipher suites in common
when trying to do an SSL socket communication between java server and android client.
I used this line to create the keyfile: keytool -genkey -keystore mySrvKeystore -keyalg RSA
server code:
System.setProperty("javax.net.ssl.keyStore","mySrvKeystore.key");
System.setProperty("javax.net.ssl.keyStorePassword","1234567");
private SSLServerSocketFactory sslserversocketfactory =
(SSLServerSocketFactory) SSLServerSocketFactory.getDefault();
private SSLServerSocket sslserversocket;
private SSLSocket sslsocket;
sslserversocket= (SSLServerSocket) sslserversocketfactory.createServerSocket(port);
sslsocket = (SSLSocket) sslserversocket.accept();
client code:
System.setProperty("javax.net.ssl.trustStore","mySrvKeystore.key");
System.setProperty("javax.net.ssl.trustStorePassword","1234567");
sslsocket = (SSLSocket) sslsocketfactory.createSocket(serverAddr, SERVERPORT);
private SSLSocketFactory sslsocketfactory = (SSLSocketFactory)
SSLSocketFactory.getDefault();
private SSLSocket sslsocket;
Any idea how to solve this issue ?
Is it possible that the connection is failing because the server's certificate is self-signed ?
Thanks.
You must be changing the enabled cipher suites in either your SSLServerSocket or your SSLSocket. Don't do that. If you must, make sure you set a subset that is supported by both peers.
EDIT In your client code, you have
System.setProperty("javax.net.ssl.trustStore","mySrvKeystore.key");
i.e. you are using the server keystore as the client truststore. Don't do that. The keystore contains the private key and it shouldn't reside anywhere except at the server. You need to export the server certificate from that keystore and import it into the client truststore as a trusted CA certificate.
Android uses slightly different approach to setup up a secure connection. Please take a look at this post:
Android Trusting SSL Certificates
In case of POP3 it is possible to connect via telnet using sockets over port 110, But how to do it , if SPOP3 is implemented.
With normal telnet it can be done quite easily with
Socket pop3Socket = new Socket(host.com, 110);
FYI:
For connecting to SPOP3 we use in linux/unix
openssl s_client -connect servername.com:995
You'll need to use the SSLSocket class. An example can be found at: http://www.herongyang.com/JDK/SSL-Socket-Client-Example-SslSocketClient.html.
Basically, you'll do something like:
SSLSocketFactory f = (SSLSocketFactory) SSLSocketFactory.getDefault();
SSLSocket c = (SSLSocket) f.createSocket("localhost", 8888);
If the endpoint has a self signed certificate then you have two options:
Add this self-signed cert to your local keystore. This URL gives a good overview: http://www.chrissearle.org/blog/technical/adding_self_signed_https_certificates_java_keystore
Create a TrustManager that does not validate the server's certificate: http://www.howardism.org/Technical/Java/SelfSignedCerts.html
Option 1 is more secure.
I have a client written in C# and server in JAVA. So, when I'm trying to connect I got error in server javax.net.ssl.SSLHandshakeException: no cipher suites in common and in C# "EOF or 0 bytes".
[C#]:
TcpClient tc = new TcpClient(server, 1337);
using (sslStream = new SslStream(tc.GetStream())){ }
[JAVA]:
SSLServerSocketFactory ssocketFactory = (SSLServerSocketFactory) SSLServerSocketFactory.getDefault();
SSLServerSocket server = (SSLServerSocket) ssocketFactory.createServerSocket(1337);
server.setEnabledCipherSuites(server.getEnabledCipherSuites());
And JAVA launch properties:
-Djavax.net.ssl.trustStore=Certificatename -Djavax.net.ssl.trustStorePassword=thereisapw -Djava.protocol.handler.pkgs=com.sun.net.ssl.internal.www.protocol -Djavax.net.debug=ssl TCPServer
The truststore defines how you're going to trust remote certificates that are presented to you. The keystore is for the certificates you have (and for which you have the private key). (More details about the difference here. The terminology about "keystore" can be confusing, since it can have two meanings).
Here, you're trying to run a server, but you haven't set up your own certificate. You need to import/create a certificate in a keystore and use it as a keystore.
If you don't specify a keystore, the server won't be able to find a cert/key. As a result, it won't be able to use any of the cipher suites enabled by default.
I'm not sure where you got this from, but you don't need it: -Djava.protocol.handler.pkgs=com.sun.net.ssl.internal.www.protocol
For secure server sockets in order to send the server certificate, all I do is initialize SSLContext with a KeyManagerFactory.getKeyManagers() that has been initialized with my keystore.
But how can I do this in client side?
I.e. for client I do:
System.setProperty("javax.net.ssl.keyStore", "clientKeystore.keystore");
System.setProperty("javax.net.ssl.keyStorePassword", "secret");
System.setProperty("javax.net.ssl.trustStore", "clientKeystore.keystore");
System.setProperty("javax.net.ssl.trustStorePassword", "secret");
SSLSocketFactory factory = (SSLSocketFactory) SSLSocketFactory.getDefault();
SSLSocket socket = (SSLSocket) factory.createSocket("localhost", 7890);
I use the same keystore as trust store. I assume that just for looking arround JSSE it is ok.
Problem is that I get in the server part (I have setNeedClientAuth in the serversocket to true).
Exception in thread "main" javax.net.ssl.SSLHandshakeException: null cert chain
So how am I supposed to configure the client side to send a certificate?Isn't the system properties a correct approach?
Because I do not see how the SSLContext can be used in client side.
Thank you!
You do not have to set a specific configuration on the client side to use a certificate for authentication. Maybe some intermediate CAs are missing in the keystore, and the client is not able to build a certificate path from the trust anchor sent by the server and therefore cannot determine if the certificate is suitable for authentication.
You can add the system property javax.net.debug to all to print the debug stream on the standard output. Maybe you can get more information on the error.