Java two-way SSL without a "server"

Question

I have been looking for an example of a mutual auth SSL in java where there is no "server" as in weblogic / glassfish / tomcat / etc. - is there such a thing?

also no external libraries please, I am hoping to get by with just the following:

import javax.net.ssl.SSLServerSocket;
import javax.net.ssl.SSLServerSocketFactory;
import javax.net.ssl.SSLSocket;

There's always a server. The one that connects is the client, the one that gets connected to is the server. The bytes don't magically meet in the middle of the internet and create some sort of serverless connection. What's your actual problem? — Kayaman, Jul 16 '14 at 16:22
@Kayaman please read the question (in its entirety this time) - I am looking for something that can be done in pure java and not require a "server install" such as weblogic / glassfish / tomcat /etc. — user2813274, Jul 16 '14 at 16:25
Yea I read it fully. You'll still have one program that acts as a server and one that acts as a client. Haven't you ever used a regular `ServerSocket` in a client-server program? — Kayaman, Jul 16 '14 at 16:28
Search/recommendation questions are off topic here. JSSE examples abound. — user207421, Jul 16 '14 at 16:41
Do you mean without an existing off-the-shelf web server? What have you tried? — James Kingsbery, Jul 16 '14 at 21:50
@JamesKingsbery I mean using just a JRE (this isn't even for web traffic) — user2813274, Jul 17 '14 at 15:22

score 2 · Accepted Answer · answered Jul 16 '14 at 16:50

You can use something like this (NOTE this is from a tutorial school project i did and its not complete)

Client

    //load client private key
    KeyStore clientKeys = KeyStore.getInstance("JKS");
    clientKeys.load(new FileInputStream("proxyKeystore"),"password".toCharArray());
    KeyManagerFactory clientKeyManager = KeyManagerFactory.getInstance("SunX509");
    clientKeyManager.init(clientKeys,"password".toCharArray());
    //load server public key
    KeyStore serverPub = KeyStore.getInstance("JKS");
    serverPub.load(new FileInputStream("proxyTrustedStore"),"password".toCharArray());
    TrustManagerFactory trustManager = TrustManagerFactory.getInstance("SunX509");
    trustManager.init(serverPub);

  //use keys to create SSLSoket
  SSLContext ssl = SSLContext.getInstance("TLS");
  ssl.init(clientKeyManager.getKeyManagers(), trustManager.getTrustManagers(), SecureRandom.getInstance("SHA1PRNG"));
  socket = (SSLSocket)ssl.getSocketFactory().createSocket("localhost", 8889);


  socket.startHandshake();

Server:

KeyStore serverKeys = KeyStore.getInstance("JKS");
            serverKeys.load(new FileInputStream("authKeystore"),"password".toCharArray());
            KeyManagerFactory serverKeyManager = KeyManagerFactory.getInstance("SunX509");
            serverKeyManager.init(serverKeys,"password".toCharArray());


            KeyStore clientPub = KeyStore.getInstance("JKS");
            clientPub.load(new FileInputStream("authTrustedStore"),"password".toCharArray());
            TrustManagerFactory trustManager = TrustManagerFactory.getInstance("SunX509");
            trustManager.init(clientPub);

          //use keys to create SSLSoket
          SSLContext ssl = SSLContext.getInstance("TLS");
          ssl.init(serverKeyManager.getKeyManagers(), trustManager.getTrustManagers(), SecureRandom.getInstance("SHA1PRNG"));
          serverSock = (SSLServerSocket)ssl.getServerSocketFactory().createServerSocket(8889);
          serverSock.setNeedClientAuth(true);
          socket = (SSLSocket)serverSock.accept();

Before you start the handshake and/or accept the serverSocket connection, you can request certificate from server and or client.

You can request the certificate any time actually, *except* 'before you accept the connection'. You don't need to call startHandshake() explicitly: it is automatic on the first I/O. Most of what you've done here can be accomplished by merely setting a few system properties. — user207421, Jul 16 '14 at 16:53

Java two-way SSL without a "server"

1 Answers1