Home.... | log in.... | Pub my question! | Sign-up....
Java-index >> Security >> Java Secure Socket Extension (JSSE)

identifying clients with certificate serial number

Hi,I use client certificates to identify connections to my server, the client certs are signed by my own CA.Is it secure then, to identify the clients by their serial number certificate and let ssl do the rest of the job ?Regardsalex
[268 byte] By [alexxelaa] at [2007-10-1 21:29:59]
«« JDBC/JSP question
»» NoinitialContextException
# 1
without any more details, I would guess the answer is yes.
ghstarka at 2007-7-13 3:25:08 > top of Java-index,Security,Java Secure Socket Extension (JSSE)...
# 2

Ok,

In fact I wanted to be sure that the certificate footprint is veryfied in every ssl handshake, and that the serial number is part of the hash.

It seemed to me obvious but I realised, for instance, that the validity date of the certificate is not checked automatically during ssl handshake, do you think it is a normal behavior ?

alexxelaa at 2007-7-13 3:25:08 > top of Java-index,Security,Java Secure Socket Extension (JSSE)...
# 3
Yes, the serial number of the is part of the signed data. The validity period of the certificate is checked as part the handshake. Why do you say it is not chcked?
ghstarka at 2007-7-13 3:25:08 > top of Java-index,Security,Java Secure Socket Extension (JSSE)...
Security
Java Secure Socket Extension (JSSE)

Security New Topic

Security Hot Topic

Security

All Classified