SSL shouldn't be this difficult

Hello,

First off, SSL is NOT really difficult... it is that I am just frustrated with the "service provider" that I have to connect to. They are of no help what so ever when it comes to trying to help me figure out what is going on with the SSL connection.

OK, all the service provider has "provided" me is their address and port to connect to... which is for example https://xxx.yyy.zzz 5000

They say that I need to connect into this server on this port in order to send and receive secure messages... So with that I put this little test program together...

-8<-

import java.io.*;

import java.net.*;

import java.security.*;

import javax.net.*;

import javax.net.ssl.*;

public class SSLSocketClient

{

public static void main(String[] args)

{

SSLSocket s = null;

PrintStream out = System.out;

out.println("\nTesting socket factory with SSLContext:");

try

{

SSLContext sc = SSLContext.getInstance("SSLv3");

KeyManagerFactory kmf = KeyManagerFactory.getInstance("SunX509");

String ksName = "test.keystore";

char ksPass[] = "password".toCharArray();

char ctPass[] = "password".toCharArray();

KeyStore ks = KeyStore.getInstance("JKS");

ks.load(new FileInputStream(ksName), ksPass);

// Generating KeyManager list

kmf.init(ks,ctPass);

KeyManager[] kmList = kmf.getKeyManagers();

// Generating SSLSocketFactory

sc.init(kmList, null, null);

SSLSocketFactory sf = sc.getSocketFactory();

// Generating SSLSocket

s = (SSLSocket)sf.createSocket("ssltest.tnsi.com", 5004);

s.startHandshake();

InputStream inputstream = s.getInputStream();

InputStreamReader inputstreamreader = new InputStreamReader(inputstream);

BufferedReader bufferedreader = new BufferedReader(inputstreamreader);

OutputStream outputstream = s.getOutputStream();

OutputStreamWriter outputstreamwriter = new OutputStreamWriter(outputstream);

BufferedWriter bufferedwriter = new BufferedWriter(outputstreamwriter);

char[] message = {0x48, 0x45, 0x4C, 0x4C, 0x4F};

bufferedwriter.write(message, 0, message.length);

bufferedwriter.newLine();

bufferedwriter.flush();

String string;

int x;

while ((x = bufferedreader.read()) != -1)

{

System.out.println(x);

}

}

catch (Exception e)

{

System.err.println(e.toString());

}

finally

{

try

{

if (s != null)

s.close();

}

catch (Exception e)

{

}

}

}

}

}

-8<-

I have created a keystore with my client key pair in it.

When I run the program I receive no errors or exceptions. All I receive is 5 ENQs and then the program exits...

My question is, since I have not received an exception, can I assume that I have actually connected to the server? They will not tell me if I have connected or not...

Thanks...

[3056 byte] By [jefflanzarottaa] at [2007-10-3 11:33:52]
# 1

If you managed to send and receive data you have negotiated the SSL handshake and made the connection.

After you do that, get the SSLSession from the SSLSocket and have a look at the various things it gives you, such as the peer certiificates and peer principal. This stuff comes from the server.

It's interesting that you didn't need to define a truststore. Try it without the keystore too, to see if they are doing client authentication. If it succeeds without the keystore, they aren't.

ejpa at 2007-7-15 14:01:31 > top of Java-index,Security,Java Secure Socket Extension (JSSE)...