Customization of Your JSSE Key Material Managers
The main task of the KeyManager interface is to manage the keys used for authentication in front of its peer (client or server). For example, the KeyManager interface is responsible for selecting the correct key material that will be sent to the peer. The authentication process can take place only in the presence of a context.
The sample application's SSLContext uses a default KeyManager (redirect this KeyManager to a keystore by setting the javax.net.ssl.keyStore system property). To customize SSLContext, you first must initialize it by providing one or more KeyManagers.Providing the null value ensures that an empty KeyManager will be used, but this is not what you need. The idea is to create your own KeyManager and there are several ways to do this.
The most common approach is to use the KeyManagerFactory class. As its name suggests, this class is a factory for one or more KeyManagers. When you generate a KeyManagerFactory , you can specify a key management algorithm. The default SunJSSE services provider contains two such algorithms:
- SunX509: This can be used to obtain key managers for the X.509 certificates.
- PKIX
Set the right algorithm using the ssl.KeyManagerFactory.algorithm property which can be found in the <java.home>/lib/security/java.security file, shown in Figure 1.
Figure 1. The java.security File: Setting the ssl.KeyManagerFactory.algorithm
You can also specify a different provider by using a String or a Provider object, as you can see from the below KeyManagerFactory.getInstance methods (these methods are used to generate KeyManagerFactory objects):
public static final KeyManagerFactory getInstance(String algorithm) throws
NoSuchAlgorithmException
public static final KeyManagerFactory getInstance(String algorithm, Provider provider)
throws NoSuchAlgorithmException
public static final KeyManagerFactory getInstance(String algorithm, String provider) throws
NoSuchAlgorithmException, NoSuchProviderException
Here's a simple example of creating a KeyManagerFactory:
...
KeyManagerFactory ClientKMF=null;
…
try{
KeyManagerFactory KMF=KeyManagerFactory.getInstance("SunX509", "SunJSSE");
}catch(java.security.NoSuchAlgorithmException e)
{System.out.println(e.getMessage());
}catch(java.security.NoSuchProviderException e)
{System.out.println(e.getMessage());}
...
To initialize a KeyManagerFactory, call one of the following init methods:
public final void init(KeyStore KS,char[] KSpassword) throws
KeyStoreException,NoSuchAlgorithmException,UnrecoverableKeyException
Generally, when you initialize a KeyManagerFactory, you have to provide the name of your keystore and the access password to the keys. It's mandatory that all the keys from the keystore are protected by the same password—otherwise, the provider won't be able to access all the keys from that keystore. The password can be exactly the same as the password that protects the keystore:
Now, suppose you have a special provider that needs more parameters to initialize a KeyManagerFactory. Then, you'd have to use the following init method:
public final void init(ManagerFactoryParameters MFP)throws InvalidAlgorithmParameterException
In our example, this means you must provide all the parameters by implementing the ManagerFactoryParameters interface in agreement with the provider requests.
Finally, to retrieve all the KeyManagers, call the KeyManagerFactory.getKeyManagers method. This method returns one key manager for each type of key material:
public final KeyManager[] getKeyManagers()
After all this theory, let's see a practical example. The server in Listing 3 is another version of the SSLServerSide.java from Listing 1. This modified server uses a customized context along with the set of key managers returned by the generated KeyManagerFactory, provided by SunJSSE for the SunX509 algorithm. The factory has been initialized with the SSLcert keystore, without using system properties.
Note: In most cases, only one KeyManager will support the authentication mechanism, based on the X.509 certificates' public keys, but this isn't mandatory. J2SSE can handle more than one authentication mechanism simultaneously, but in this case every mechanism is represented by a separate KeyManager.
New on the Java Boutique:
New Review:
Time Management Made Easy with the Quartz Enterprise Job Scheduler
Why not just use the Java timer API? This open source scheduling
API boasts simplicity, ease-of-integration, a well-rounded feature
set, and it's free!
New Applet:
Reverse Complement
Reverse Complement is a simple applet that converts DNA or RNA
sequences into three useful formats.
Elsewhere on internet.com:
WebDeveloper Java
Lots of Java information on webdeveloper.com
WDVL Java
Thorough Java resource at the Web Developer's Virtual Library.
ScriptSearch Java
Hundreds of free Java code files to download.
jGuru: Your View of the Java Universe
Customizable portal with online training, FAQs, regular news updates, and tutorials.
| 
