java - Aceepting any Client Certificate in SSL-Handshake -


i'm using netty on android , server side establish ssl-secured connection client-authentication. i'm having difficulties connecting these certificates since sslengine declines them due "null cert chain".

this i've done on server side. set sslcontext signed server certificat (the client knows ca can validate one).

to make server accept certificates clients (since self-signed) implemented dummytrustmanager accept any.

private static class dummytrustmanager implements x509trustmanager     {         private x509certificate[] mcerts;          public dummytrustmanager(certificate[] pcerts)         {             // convert x509 array             mcerts = new x509certificate[pcerts.length];             for(int = 0; < pcerts.length; i++)             {                 mcerts[i] = (x509certificate)pcerts[i];             }         }          @override         public void checkclienttrusted(x509certificate[] arg0, string arg1) throws certificateexception{}          @override         public void checkservertrusted(x509certificate[] arg0, string arg1) throws certificateexception{}          @override         public x509certificate[] getacceptedissuers()         {             return mcerts;             //return new x509certificate[0];         }     }

the point i'm not quite sure getacceptedissuers() method.

  • if retrurn empty array openssl-binary (which use veryfi correct setup) fails due empty acceptedissuers list.

  • if add currents server certificate chain work @ least client certificates signed same ca not ones self signed (which need).

but maybe i'm doing wrong on client side:

        keystore keystore = keystore.getinstance(keystore.getdefaulttype());         keystore.load(null);          keystore.setentry("user_certificate", new keystore.privatekeyentry(mprivate, new certificate[]{mclientcert}), this);         keystore.setcertificateentry("server_certificate", mservercert);

also did researches , understood far: client has valid certificate chain not send because server tells it accepts issuers listed server.

if right, how can overcome issue?

i thinking of seperate self-signed ca delivered clients , listed in server accepted issuers list. client uses ca sign own certificate. see of no security problem this. or there better solution?

since there no answer longer period i'm going give brief overview of how solve now.

i've created ca not signed trusted ca. self signed. ca given clients sign own certificates. why? because way can tell server send out ca accepted 1 getacceptedissuers(). not intended give level of authority. way check clients public key, there no security risk there.

you have carefull not mix trustedmanagers , sslcontext instances up.


Comments

Post a Comment

Popular posts from this blog

jquery - How can I dynamically add a browser tab? -

since using iframes house external pages are, accounts "not preferred method" , disallowed sites (flickr, one), want dynamically generate browser tabs. e.g., when user submits form, want dynamically generate tab on browser in response submitted. e.g., might want add new tab url like: http://www.bigsurgarrapata.com/contact how in jquery? you want form target attribute action attribute. http://www.w3schools.com/tags/att_form_target.asp browsers have ultimate control on result of target attribute open new tab value of _blank. <form action="contact_submit.php" target="_blank" method="post">
Read more

node.js - Getting the socket id,user id pair of a logged in user(s) -

i have web application done using node js , in it,i have authentication system requires users log in before can access pages. have 2 pages,the homepage , updates page. from read docs,a new socket id issued when user opens tab in browser. me being admin,i know socket id of logged in user , more so,the socket id,logged in user id pair logged in users. what method can use socket id,logged in user id pair make sure broadcast realtime info users online?.
Read more

keyboard - C++ GetAsyncKeyState alternative -

i using windows.h library's getasynckeystate function define key pushed on keyboard . here program returns int value of pushed key example. #include <iostream> #include <windows.h> using namespace std; int main (){ char i; for(i=8;i<190;i++){ if(getasynckeystate(i)== -32767){ cout<<int (i)<<endl; } } return 0; } but trying make opengl simple game , function appeared slow . there function not need cycle 180 times , if statement . thanks you're trying make opengl game, you're going use glfw. if that's case can away using glfwgetkey() such: if (glfwgetkey(glfw_key_up) == glfw_press) {...} if (glfwgetkey(glfw_key_down) == glfw_press) {...} that method nicely explained in tutorial 6 opengl-tutorial.org . should start first tutorial of beginners tutorials , later intermediate tutorials . if you're going make win32 window can listen wm_keydown or wm_keyup messages , virtua
Read more