Is there a way that I can do Mutual SSL without direct acces to the Websphere keystore in Java? -


i'm trying establish mutual ssl between 2 websphere 8.5.5 servers. i'll call them servera , serverb.

servera: client side, added serverb's ssl certificate defaulttrustkeystore.

serverb: server side, added servera's ssl certificate defaulttrustkeystore. installed war provide servlet receive http post message, log it, , response "ok" client. client auth mode set "required".

now got problem: traditional way of mutual ssl client side must read keystore directly retrieve private key, can use set our sslcontext client authentication. might have security flaw accessing keystore directly. need find way if can let servera's websphere me(or java code command websphere this).

can teach me how without accessing keystore directly, please?

update:

hi dbreaux.

i tried way loop-back connection, seem not working.

here's ssl debug log last section:

[2017/9/3   21:06:25:284 cst] 00000099 systemout     o jssejce:  using keygenerator ibmtlsprf provider tbd via init  [2017/9/3   21:06:25:284 cst] 00000099 systemout     o handshakemessage:  tls keygenerator ibmtlsprf  provider init ibmjce version 1.8 [2017/9/3   21:06:25:284 cst] 00000099 systemout     o webcontainer : 3, write: tlsv1 change cipher spec, length = 1 [2017/9/3   21:06:25:285 cst] 00000099 systemout     o jssejce:  using cipher aes/cbc/nopadding provider tbd via init  [2017/9/3   21:06:25:285 cst] 00000099 systemout     o cipherbox:  using cipher aes/cbc/nopadding provider init ibmjce version 1.8 [2017/9/3   21:06:25:285 cst] 00000099 systemout     o jssejce:  using mac hmacsha1 provider tbd via init  [2017/9/3   21:06:25:285 cst] 00000099 systemout     o mac:  using messagedigest hmacsha1 provider ibmjce version 1.8 [2017/9/3   21:06:25:285 cst] 00000099 systemout     o *** finished [2017/9/3   21:06:25:285 cst] 00000099 systemout     o verify_data:  { 226, 248, 159, 68, 107, 196, 76, 219, 134, 227, 129, 58 } [2017/9/3   21:06:25:285 cst] 00000099 systemout     o *** [2017/9/3   21:06:25:285 cst] 00000099 systemout     o webcontainer : 3, write: tlsv1 handshake, length = 48 [2017/9/3   21:06:25:285 cst] 00000099 systemout     o webcontainer : 3, waiting close_notify or alert: state 1 [2017/9/3   21:06:25:285 cst] 00000099 systemout     o webcontainer : 3, exception while waiting close java.net.socketexception: software caused connection abort: recv failed [2017/9/3   21:06:25:285 cst] 00000099 systemout     o %% invalidated:  [session-27, ssl_ecdhe_rsa_with_aes_128_cbc_sha] [2017/9/3   21:06:25:285 cst] 00000099 systemout     o webcontainer : 3, send tlsv1 alert:  fatal, description = handshake_failure [2017/9/3   21:06:25:285 cst] 00000099 systemout     o webcontainer : 3, write: tlsv1 alert, length = 32 [2017/9/3   21:06:25:285 cst] 00000099 systemout     o webcontainer : 3, exception sending alert: java.net.socketexception: software caused connection abort: socket write error [2017/9/3   21:06:25:285 cst] 00000099 systemout     o webcontainer : 3, called closesocket() [2017/9/3   21:06:25:285 cst] 00000099 systemout     o webcontainer : 3, handling exception: javax.net.ssl.sslhandshakeexception: java.net.socketexception: software caused connection abort: recv failed

i'm using defaultkeystores generated. since dynamic outbound endpoint page keep giving me cwpki0681e error, applied first way.

does work on yours? or it's because i'm using default ca generated?

in websphere configuration, appears need specify client certificate keystore present when making outbound connection. (i don't know if can edit keystore set default. don't see way admin console, might able outside that. or maybe it's set, isn't sufficient.)

but way can set explicitly in ssl configurations. believe of these levels should work, confess haven't tried them personally.

you can set in cell/node default ssl settings:

celldefaultsslsettings

or scope, cell, node, or server:

endpoint security configurations

endpoint ssl configuration

or can set based on destination you're connecting to:

dynamic outbound ssl configuration


Comments

Post a Comment

Popular posts from this blog

Is there a better way to structure post methods in Class Based Views -

i'm using class based views in django , never specify url in ajax calls , omit action parameter in form because know these requests go through post method of class based view. notice view - profile page make many requests depending on user updating on page - post method become convoluted , if/else mess example: def post(self, request, *args, **kwargs): # handle user changing available date if request.post.get('availabledate') != none: self.updateavailabledate(request) return jsonresponse({'result':'success'}) if request.post.get('newprojectname') != none: creative_user = creativeuserprofile.objects.get(id = request.user.id) project = project.create_project(creative_user, request.post['newprojectname']) project.save() return jsonresponse({'projectid': project.id }) if request.post.get('projectimage') != none , request.files['file']: proj
Read more

performance - Why is XCHG reg, reg a 3 micro-op instruction on modern Intel architectures? -

i'm doing micro-optimization on performance critical part of code , came across sequence of instructions (in at&t syntax): add %rax, %rbx mov %rdx, %rax mov %rbx, %rdx i thought had use case xchg allow me shave instruction , write: add %rbx, %rax xchg %rax, %rdx however, dimay found agner fog's instruction tables , xchg 3 micro-op instruction 2 cycle latency on sandy bridge, ivy bridge, broadwell, haswell , skylake. 3 whole micro-ops , 2 cycles of latency! 3 micro-ops throws off 4-1-1-1 cadence , 2 cycle latency makes worse original in best case since last 2 instructions in original might execute in parallel. now... cpu might breaking instruction micro-ops equivalent to: mov %rax, %tmp mov %rdx, %rax mov %tmp, %rdx where tmp anonymous internal register , suppose last 2 micro-ops run in parallel latency 2 cycles. given register renaming occurs on these micro-architectures, though, doesn't make sense me done way. why wouldn't register renamer
Read more

jquery - Responsive Navbar with Sub Navbar -

good day, forgive me nav vocabulary not best. if question confusing apologize. i'm working on navigation bar needs centered on page @ 768px , above. items in nav open (or perhaps toggle) subnav lives directly below. these nav should appear centered on page. i have been able work through responsive portion of nav bar, having main items align vertically , sub nav menu of each item roll out below, , gave them indent separation. working well. however, issue not responsive side, behavior @ width greater 768px. happens toggling menu's sub navigation pushes other main items down page below sub nav. here's code: $(document).ready(function () { //stick in fixed 100% height behind navbar don't wrap $('#slide-nav.navbar-inverse').after($('<div class="inverse" id="navbar-height-col"></div>')); $('#slide-nav.navbar-default').after($('<div id="navbar-height-col"></d
Read more