Creating an SSL Connection in Java

Question

I looked around and did not see any questions that fully answered what I wanted, though if this is a duplicate, point me to the question and I will be on my way.

Right now I am trying to write a Java server that will receive data from an SSLServerSocket and for now, just print it out. I would eventually like to have this data come from an Android, but right now it throws an SSLException before it even starts listening for data.

code:

System.setProperty("javax.net.ssl.keyStore","C:\\ProgramFiles\\jre6\\bin\\server.jks");
System.setProperty("javax.net.ssl.keyStorePassword","password");
SSLServerSocketFactory factory = (SSLServerSocketFactory) SSLServerSocketFactory.getDefault();
ServerSocket ss = factory.createServerSocket(6543);
Socket s = ss.accept();

There is more code after that to process it, but it gets hung up and throws the exception there, so I'm not sure posting it will help any, but if it will, just comment for it.

I created the certificate following a tutorial for openssl on Ubuntu and transferred it over and created my keystore using:

keytool -import -file "C:\Documents and Settings\matt\Desktop\server.crt" -keystore server.jks

I can easily admit that I don't fully understand how a large portion of this works, so any help would be appreciated. Also, I suppose I am going to leave it outside the scope of this question becauseI feel like this is a pretty big question on its own, butI would also like some insight as to how to connect the client if possible. Sorry for all the trouble and thanks ahead of time for all the help.

EDIT:

the tutorial I followed is here: http://www.akadia.com/services/ssh_test_certificate.html

Thanks again!

EDIT:

The Exception being throw is:

javax.net.ssl.SSLException: No available certificate or key corresponds to the SSL cipher suites which are enabled

I tried to Google the exception and most everything was a tutorial describing how to create a keystore (which I am under the impression that I already have). I will continue to sift through these search results.

Thanks!

Can you run [your socket object].getEnabledCipherSuites() and [your socket object].getSupportedCipherSuites - then paste that output in your question (along with the cipher that your cert was created for - e.g. RC4-128, etc.)? — jefflunt
– jefflunt, Commented Jun 21, 2011 at 21:51

Community · Accepted Answer · 2017-03-17 13:14:46Z

3

When you create a keystore like this, you only put a certificate in your keystore:

keytool -import -file "server.crt" -keystore server.jks

What you need is to have a private key + a certificate.

Either you import them from somewhere else if you already have a certificate issued by a Certification Authority, or you can create a self-signed certificate if it's for limited use.

If the certificate you've created with OpenSSL is self-signed (or from a mini CA for your own use, e.g. with CA.pl), it's probably not worth the trouble of doing the conversion. You might as well generate a self-signed certificate directly with keytool. See the "Generating Your Key Pair" example in the official keytool documentation:

keytool -genkeypair -dname "cn=Mark Jones, ou=JavaSoft, o=Sun, c=US"
     -alias business -keypass kpi135 -keystore /working/mykeystore
     -storepass ab987c -validity 180

Make sure you use cn=your.fqdn.host.name (or cn=localhost if it's for local tests only). (I think keytool provided with Java 7 also has support for subject alternative names, which would be better.)

If you already have a private key + certificate you want to re-use in PKCS#12 format (usually .p12 file), you can import it using the method described in this question.

If what you've produced with OpenSSL is in PEM format, it might be easier to bundle them in a PKCS#12 file with OpenSSL and then import them as above. This can be done with this:

openssl pkcs12 -export -in cert.pem -inkey key.pem -out creds.p12

edited Mar 17, 2017 at 13:14

CommunityBot

11 silver badge

answered Jun 21, 2011 at 21:48

Bruno

123k33 gold badges278 silver badges389 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

Matt Over a year ago

Thanks, I will work on implementing these. It seems like this will probably cover everything I need.

Bruno Over a year ago

I forgot to say: you don't necessarily need to convert a PKCS#12 file into JKS format for it to be usable in Java: you can use them directly with the PKCS12 store type, if this is more convenient (see javax.net.ssl.keyStoreType).

Collectives™ on Stack Overflow

Creating an SSL Connection in Java

1 Answer 1

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related