-2

I've read plenty but i'm still very confused about the server certificate concept.

At what stage does it turn a glassfish server from HTTP to HTTPS and how?

I know how to create a certificate with keytool, but what happens to it after that? I read something about associating the certificate with a JAR file? What? Surely a certificate should belong to a server?

I'm using glassfish and netbeans.

Thanks for clearing up my confusion if you can!

  • What exactly are you asking about? How HTTPS works? How Glassfish works? How to configure it? – SLaks May 01 '11 at 17:53
  • Basically, how to convert my HTTP server to an HTTPS server using a self-signed certificate. –  May 01 '11 at 18:10
  • So you're asking how to configure Glassfish. That might belong on ServerFault; I'm not sure. – SLaks May 01 '11 at 18:11

1 Answers1

2

There's two different things happening here.

  • Acquire/create SSL keypair & certificate

In order to use SSL for anything (SMTP, HTTP, IMAP, etc.) you need a public and private key.

The private key is stored on the server and the public key is made available to the world to allow data to be encrypted in such a form that the private key can decode it.

The distribution of the public key is accomplished via sending it during the SSL negotiation1 - this is an insecure approach vulnerable to MITM attacks.

An SSL certificate is a signature of the SSL public key by a third party that is trusted - the third party is responsible for authenticating the identify of the public key.

A self-signed certificate is generally used for testing and is still vulnerable to MITM. Using it is like presenting only a letter to your bank written by you and signed by you to verify your identity.

  • Configure service to use SSL keypair & certificate

This is the part where you tell your service to actually use that keypair and certificate. Beyond the scope of this answer, but hopefully you understand SSL now :)

1: Though some cool things could be done now that DNSSEC is being implemented - we could put HTTPS certificates into TXT records or the like.

MikeyB
  • 39,291
  • 10
  • 105
  • 189