SSL with Windows Certificates

Looks to me that the problem can be reduced into 2 seperate issues: getting the smartcard to work so that you can read the stored certificates and private keys. And getting the https connection to work.

Java has smartcard support, but since there are several different kinds of cards available you'll have to check if your hardware is actually supported. A good place to start looking is here: http://java.sun.com/products/javacard/. There you can also grab the Java card development kit. The API docs are pretty self explaining here. Creating a card using Terminal.getCard and such. Although I have to add a small disclaimer since from what I read about the devkit its platform dependend. Not too sure but so far all my experience is based on the support supplied by Solaris 10 in combination with the cardreader on my Sun Blade 100. I could imagine that this might be a little different. But even then the API docs should provide you with most you need to know...

The next problem is then getting the https connection to go, IMO its the easiest of the two. Simply add the certificate you grabbed from the smartcard to a new keystore and use this as a trustmanager factory loaded with this keystore. You can then setup an SSLContext which you can then later use to setup an SSLSocket factory. Something in the likes of:

// using...

import java.security.KeyStore;

import javax.net.ssl.SSLContext;

import java.security.cert.Certificate;

import javax.net.ssl.TrustManagerFactory;

// setup keystore

/* Where 'cert' is naturally a reference to a Certificate(). */

KeyStore ks = KeyStore.getInstance("jks");

ks.load(null, null);

ks.setCertificateEntry("cardcert", cert);

// setup trustmanager

TrustManagerFactory tmf = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());

tmf.init(ks);

// Setup SSLContext with above trustmanager.

SSLContext sslcont = SSLContext.getInstance("SSL");

sslcont.init(null, tmf.getTrustManagers(), new SecureRandom());

You can then setup a HttpsURLConnection and use its SetSSLSocketFactory() method to point to the socketfactory from the created SSLContext. Hope this helps some.

Message was edited by: Lion-O

,,,to add the comment block so that 'cert' wasn't bungleing and a few import statements to make the example more clear ;)

Lion-Oa at 2007-7-7 20:34:02 >