Are you going to use SSL for authentication or for network transmission encryption? Do you control all of the clients?
If you control all of the machines.. all you need to do is use keytool to generate a self-signed cert on the server. This will create a cert and a private key. Export the cert and put the file on the client pc. On the client side, you will import the cert into the client's truststore (using keytool again). Now do the exact same thing on the client.. generate a self-signed cert, export the cert, import it into the server's truststore. Now each side of the equation a) trusts each other and b) can use SSL to encrypt messages. The key here is that you control both sides of the messaging and each side has essentially each other's public key, and trusts the certificate authority (you).
If you do not control all of the clients.. then you will need to (on the server side) generate a cert (via keytool -certreq) that is going to be signed by a certificate authority (like Verisign). By default java's default truststore has Verisign, Thawte and a some others already in it... so the client won't need to import any certificates. This server then can be hit from any of the clients.. without much effort.
You definitely need to read up on JSSE here is a link that should start the learning process..
http://www.javaworld.com/j
In a nutshell, if you control all of the players.. you can use self-signed certs, if you do not.. you will need a CA to sign your cert so that the clients will trust it.
Main Topics
Browse All Topics
by: OBCTPosted on 2005-09-03 at 00:05:54ID: 14815208
Yes usually SSL certificates are on the server side.
This is so the client connecting to the server can be sure that the server is being run by the trusted company/person/etc.
If you want to be sure who the client is, again, you'll need certificates on the client side.
Generally this isn't desirable due to the cost of certificates unless you have a small number of clients (with some money to throw around).
You would use the same type of certificate as you would with the server however under the clients name.