Is there a way that I can do Mutual SSL without direct acces to the Websphere keystore in Java? -


i'm trying establish mutual ssl between 2 websphere 8.5.5 servers. i'll call them servera , serverb.

servera: client side, added serverb's ssl certificate defaulttrustkeystore.

serverb: server side, added servera's ssl certificate defaulttrustkeystore. installed war provide servlet receive http post message, log it, , response "ok" client. client auth mode set "required".

now got problem: traditional way of mutual ssl client side must read keystore directly retrieve private key, can use set our sslcontext client authentication. might have security flaw accessing keystore directly. need find way if can let servera's websphere me(or java code command websphere this).

can teach me how without accessing keystore directly, please?

update:

hi dbreaux.

i tried way loop-back connection, seem not working.

here's ssl debug log last section:

[2017/9/3   21:06:25:284 cst] 00000099 systemout     o jssejce:  using keygenerator ibmtlsprf provider tbd via init  [2017/9/3   21:06:25:284 cst] 00000099 systemout     o handshakemessage:  tls keygenerator ibmtlsprf  provider init ibmjce version 1.8 [2017/9/3   21:06:25:284 cst] 00000099 systemout     o webcontainer : 3, write: tlsv1 change cipher spec, length = 1 [2017/9/3   21:06:25:285 cst] 00000099 systemout     o jssejce:  using cipher aes/cbc/nopadding provider tbd via init  [2017/9/3   21:06:25:285 cst] 00000099 systemout     o cipherbox:  using cipher aes/cbc/nopadding provider init ibmjce version 1.8 [2017/9/3   21:06:25:285 cst] 00000099 systemout     o jssejce:  using mac hmacsha1 provider tbd via init  [2017/9/3   21:06:25:285 cst] 00000099 systemout     o mac:  using messagedigest hmacsha1 provider ibmjce version 1.8 [2017/9/3   21:06:25:285 cst] 00000099 systemout     o *** finished [2017/9/3   21:06:25:285 cst] 00000099 systemout     o verify_data:  { 226, 248, 159, 68, 107, 196, 76, 219, 134, 227, 129, 58 } [2017/9/3   21:06:25:285 cst] 00000099 systemout     o *** [2017/9/3   21:06:25:285 cst] 00000099 systemout     o webcontainer : 3, write: tlsv1 handshake, length = 48 [2017/9/3   21:06:25:285 cst] 00000099 systemout     o webcontainer : 3, waiting close_notify or alert: state 1 [2017/9/3   21:06:25:285 cst] 00000099 systemout     o webcontainer : 3, exception while waiting close java.net.socketexception: software caused connection abort: recv failed [2017/9/3   21:06:25:285 cst] 00000099 systemout     o %% invalidated:  [session-27, ssl_ecdhe_rsa_with_aes_128_cbc_sha] [2017/9/3   21:06:25:285 cst] 00000099 systemout     o webcontainer : 3, send tlsv1 alert:  fatal, description = handshake_failure [2017/9/3   21:06:25:285 cst] 00000099 systemout     o webcontainer : 3, write: tlsv1 alert, length = 32 [2017/9/3   21:06:25:285 cst] 00000099 systemout     o webcontainer : 3, exception sending alert: java.net.socketexception: software caused connection abort: socket write error [2017/9/3   21:06:25:285 cst] 00000099 systemout     o webcontainer : 3, called closesocket() [2017/9/3   21:06:25:285 cst] 00000099 systemout     o webcontainer : 3, handling exception: javax.net.ssl.sslhandshakeexception: java.net.socketexception: software caused connection abort: recv failed

i'm using defaultkeystores generated. since dynamic outbound endpoint page keep giving me cwpki0681e error, applied first way.

does work on yours? or it's because i'm using default ca generated?

in websphere configuration, appears need specify client certificate keystore present when making outbound connection. (i don't know if can edit keystore set default. don't see way admin console, might able outside that. or maybe it's set, isn't sufficient.)

but way can set explicitly in ssl configurations. believe of these levels should work, confess haven't tried them personally.

you can set in cell/node default ssl settings:

celldefaultsslsettings

or scope, cell, node, or server:

endpoint security configurations

endpoint ssl configuration

or can set based on destination you're connecting to:

dynamic outbound ssl configuration


Comments

Post a Comment

Popular posts from this blog

Is there a better way to structure post methods in Class Based Views -

i'm using class based views in django , never specify url in ajax calls , omit action parameter in form because know these requests go through post method of class based view. notice view - profile page make many requests depending on user updating on page - post method become convoluted , if/else mess example: def post(self, request, *args, **kwargs): # handle user changing available date if request.post.get('availabledate') != none: self.updateavailabledate(request) return jsonresponse({'result':'success'}) if request.post.get('newprojectname') != none: creative_user = creativeuserprofile.objects.get(id = request.user.id) project = project.create_project(creative_user, request.post['newprojectname']) project.save() return jsonresponse({'projectid': project.id }) if request.post.get('projectimage') != none , request.files['file']: proj...
Read more

performance - Why is XCHG reg, reg a 3 micro-op instruction on modern Intel architectures? -

i'm doing micro-optimization on performance critical part of code , came across sequence of instructions (in at&t syntax): add %rax, %rbx mov %rdx, %rax mov %rbx, %rdx i thought had use case xchg allow me shave instruction , write: add %rbx, %rax xchg %rax, %rdx however, dimay found agner fog's instruction tables , xchg 3 micro-op instruction 2 cycle latency on sandy bridge, ivy bridge, broadwell, haswell , skylake. 3 whole micro-ops , 2 cycles of latency! 3 micro-ops throws off 4-1-1-1 cadence , 2 cycle latency makes worse original in best case since last 2 instructions in original might execute in parallel. now... cpu might breaking instruction micro-ops equivalent to: mov %rax, %tmp mov %rdx, %rax mov %tmp, %rdx where tmp anonymous internal register , suppose last 2 micro-ops run in parallel latency 2 cycles. given register renaming occurs on these micro-architectures, though, doesn't make sense me done way. why wouldn't register renamer ...
Read more

c# - Asp.net web api : redirect unauthorized requst to forbidden page -

im trying redirect unauthorized request forbidden page instead i'm getting forbidden page in response body , how can fix ? here's startup class : app.createperowincontext(storecontext.create); app.createperowincontext<applicationusermanager>(applicationusermanager.create); app.createperowincontext<applicationsigninmanager>(applicationsigninmanager.create); app.usecookieauthentication(new cookieauthenticationoptions { authenticationtype = defaultauthenticationtypes.applicationcookie, expiretimespan = timespan.fromdays(30), }); app.useexternalsignincookie(defaultauthenticationtypes.externalcookie); app.usetwofactorsignincookie(defaultauthenticationtypes.twofactorcookie, timespan.fromminutes(5)); app.usetwofactorrememberbrowsercookie(defaultauthenticationtypes.twofactorrememberbrowsercookie); the method im trying reach : [httpget] [authorize(roles = "admin")] public string getcurrentusername() { return userman...
Read more