Databases
StackOverflow2013
Postsdbo
PO
 

Note that there are some explanatory texts on larger screens.

plurals
  1. PO
    primarykey
    data
    text
    <p>The "obvious" problem is that you're not actually making any use of the <code>SSLContext</code>s you create:</p> <pre><code>SSLServerSocketFactory sslSrvSockFact = (SSLServerSocketFactory) SSLServerSocketFactory.getDefault(); </code></pre> <p>This should at least be:</p> <pre><code>SSLServerSocketFactory sslSrvSockFact = (SSLServerSocketFactory) ctx.getServerSocketFactory(); </code></pre> <p>The problem is that you would have to choose between one context or the other...</p> <p>The solution to your problem is in <a href="https://stackoverflow.com/a/9182713/372643">the answer I gave to your other similar question a couple of days ago</a>: you need to implement your own <a href="http://docs.oracle.com/javase/6/docs/api/javax/net/ssl/X509KeyManager.html" rel="nofollow noreferrer"><code>X509KeyManager</code></a> to be able to choose which key you're going to use.</p> <p>Whether you want to use a single keystore or load your key/cert from two keystores doesn't matter that much: if you really want to, you can certainly implement <code>getPrivateKey</code> and <code>getCertificateChain</code> so that they load the keys/certs from two distinct keystores depending in the alias. It would be unnecessarily complicated, though. You will still have to do something based on the alias selection anyway, so you might as well load both keys/certificates from a single key store, using different aliases.</p> <p>From the server point of view, the only way to choose one alias (and therefore key/cert pair) is to use what's available in the socket (or engine if you're using an <a href="http://docs.oracle.com/javase/6/docs/api/javax/net/ssl/X509ExtendedKeyManager.html" rel="nofollow noreferrer"><code>X509ExtendedKeyManager</code></a>). Since Java 7 doesn't support Server Name Indication (which would let the client tell which host name it's requesting ahead of this selection process), you may have to do this based on the client IP address, or on which of your server IP addresses is being used (if you have more than one).</p> <blockquote> <p>Using two private keys (keystore) and two public keys (truststore)</p> </blockquote> <p>You seem to be confused about what the keystore and the truststore are. Unless you're planning to use client-certificate authentication, you can ignore the trust store settings on the server. You can used the default (<code>null</code>) as the second parameter of your <code>SSLContext.init(...)</code>. Your "keystore (keystore)" is the information used by the local party (your server in this case), the "truststore (keystore)" is used to determine which remote party to trust.</p> <p>The public key (or, to be precised, the certificate) you're going to present to the client is also in your keystore, associated with your private key, not in the truststore.</p> <p><strong>EDIT:</strong></p> <blockquote> <p>Exception in thread "main" java.lang.NoSuchMethodError: javax.net.ssl.SSLContext.setDefault(Ljavax/net/ssl/SSLContext;) at ...initialiseManager(499)</p> </blockquote> <p><a href="http://docs.oracle.com/javase/6/docs/api/java/lang/NoSuchMethodError.html" rel="nofollow noreferrer">NoSuchMethodError</a>:</p> <blockquote> <p>Thrown if an application tries to call a specified method of a class (either static or instance), and that class no longer has a definition of that method.</p> <p>Normally, this error is caught by the compiler; this error can only occur at run time if the definition of a class has incompatibly changed.</p> </blockquote> <p>This has nothing to do with your SSL settings. Not sure what you've done here, but it looks like you may be using code for Java 6 on a Java 5 JRE (Java 6 did not have a <code>setDefault</code> on <code>SSLContext</code>). More importantly, there's something wrong about the general way you seem to be using Java here.</p> <blockquote> <p>javax.net.ssl.SSLException:</p> <p>No available certificate or key corresponds to the SSL cipher suites which are enabled.</p> </blockquote> <p>That could very well be explained by the fact you didn't seem to be using the <code>SSLContext</code>s you had initialised at all...</p> <ul> <li>If you have two pairs of private keys/certificates in your keystore.</li> </ul> <p>My answer <a href="https://stackoverflow.com/a/9217941/372643">here</a> still stands. I'll try to make it a bit more explicit. I'm assuming here that one of your cert/private key is using <code>alias1</code> and the other <code>alias2</code>. Find out using <code>keyool -list</code> if you're not sure. It's up to you to choose and set them up.</p> <pre><code>// Load the key store: change store type if needed KeyStore ks = KeyStore.getInstance(KeyStore.getDefaultType()); FileInputStream fis = new FileInputStream("/path/to/keystore"); try { ks.load(fis, keystorePassword); } finally { if (fis != null) { fis.close(); } } // Get the default Key Manager KeyManagerFactory kmf = KeyManagerFactory.getInstance( KeyManagerFactory.getDefaultAlgorithm()); kmf.init(ks, keyPassword); final X509KeyManager origKm = (X509KeyManager)kmf.getKeyManagers()[0]; X509KeyManager km = new X509KeyManager() { public String chooseServerAlias(String keyType, Principal[] issuers, Socket socket) { InetAddress remoteAddress = socket.getInetAddress(); if (/* remoteAddress has some conditions you need to define yourself */ { return "alias1"; } else { return "alias2"; } } public String chooseClientAlias(String[] keyType, Principal[] issuers, Socket socket) { // Delegate this other methods to origKm. origKm.chooseClientAlias(keyType, issuers, socket); } // Delegate this other methods to origKm, in the same way as // it was done for chooseClientAlias. } SSLContext sslContext = SSLContext.getInstance("TLS"); sslContext.init(new KeyManager[] { km }, null, null); SSLSocketFactory sslSocketFactory = sslContext.getSSLSocketFactory(); </code></pre> <ul> <li>If you really want two distinct keystores.</li> </ul> <p>Do the same and, on top of this, in <code>getCertificateChain(String alias)</code>, choose which of the two keystores to use depending on the alias, and use it to get the certificate chain. Same thing for <code>getPrivateKey(...)</code>.</p>
    singulars
    1. This table or related slice is empty.
    1. POUsing two private keys (keystore) and two public keys (truststore) in one SSL Socket Connection
      singulars
      1. PTQuestion
    1. PTAnswer
    1. USCommunity
    1. USBruno
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. VO
      singulars
      1. PO
      1. This table or related slice is empty.
      1. VTUpMod
    2. VO
      singulars
      1. PO
      1. This table or related slice is empty.
      1. VTUpMod
    1. COI can use client IP address to choose the correct certificate Bruno, for example... could't be easier make two SSL/Socket Connections instead?
      singulars
      1. PO
      1. USBera
    2. CO@Bera, there was a typo in my example, `chooseServerAlias` was obviously (or perhaps not) overriding the defined method (first param being `String`), not defining a new overloaded method with `String[]` as first param. In addition, avoid the complex logic in `getCertificateChain`: just wrap the original key manager and use the `alias` (ultimately, it doesn't matter, but you've used the wrong parameter name, which may lead to more confusion).
      singulars
      1. PO
      1. USBruno
    3. COIn addition to all this, you should know that the host name in the certificates presented by your clients (in Subject Alt Names or, if no SAN, in the CN), must match what's requested by the client.
      singulars
      1. PO
      1. USBruno
 

Querying!

 
Guidance
A row detail

Detail views are divided into sections. All the information in the data section comes from columns in the selected row. The other sections display data from other, related rows.

Related data can be related in a to-one or a to-many fashion. Captions of data related in a to-many fashion link to a list view showing a filtered view of the table.

Try moving around until you find a non-empty to-many entry and click on the label to get to one. You can move back to the root by clicking on the database name in the header.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload