Whena Web browser (client) wants to connect to a secure site, an SSL handshake happens:
■Thebrowser sends a message over the network requesting a secure session (typically, by
requestinga URL that begins with https instead of http).
■Theserver responds by sending its certicate (including its public key).
■Thebrowser veries that the server's certicate is valid and is signed by a CA whose
certicateis in the browser's database (and who is trusted). It also veries that the CA
certicatehas not expired.
■Ifthe certicate is valid, the browser generates a one time, unique session key and encrypts it
withthe server's public key. The browser then sends the encrypted session key to the server
sothat they both have a copy.
■Theserver decrypts the message using its private key and recovers the session key.
Afterthe handshake, the client has veried the identity of the Web site, and only the client and
theWeb server have a copy of the session key. From this point forward, the client and the server
usethe session key to encrypt all their communications with each other. Thus, their
communicationsare ensured to be secure.
Thenewest version of the SSL standard is called TLS (Transport Layer Security). The Enterprise
Serversupports the Secure Sockets Layer (SSL) 3.0 and the Transport Layer Security (TLS) 1.0
encryptionprotocols.
Touse SSL, the Enterprise Server must have a certicate for each external interface, or IP
address,that accepts secure connections. The HTTPS service of most Web servers will not run
unlessa digital certicate has been installed. Use the procedure described in “Generating a
CerticateUsing the keytool Utility” on page 114 to set up a digital certicate that your Web
servercan use for SSL.
AboutCiphers
Acipheris a cryptographic algorithm used for encryption or decryption. SSL and TLS protocols
supporta variety of ciphers used to authenticate the server and client to each other, transmit
certicates,and establish session keys.
Someciphers are stronger and more secure than others. Clients and servers can support
dierentcipher suites. Choose ciphers from the SSL3 and TLS protocols. During a secure
connection,the client and the server agree to use the strongest cipher they both have enabled for
communication,so it is usually sucient to enable all ciphers.
UsingName-based Virtual Hosts
Usingname-based virtual hosts for a secure application can be problematic. This is a design
limitationof the SSL protocol itself. The SSL handshake, where the client browser accepts the
servercerticate, must occur before the HTTP request is accessed. As a result, the request
informationcontaining the virtual host name cannot be determined prior to authentication,
andit is therefore not possible to assign multiple certicates to a single IP address.
IntroductiontoCer ticatesand SSL
SunGlassFishEnterprise Ser ver2.1 Administration Guide • December 2008110