Using HardwareCrypto Accelerator With Enterprise Server
Youcan use hardware accelerator tokens to improve the cryptographic performance and to
furnisha secure key storage facility. Additionally, you can provide end users with mobile secure
keystorage through smart cards.
SunJava System Application Server supports the use of PKCS#11 tokens for SSL or TLS
communicationsand Network Security Services (NSS) tools for managing keys and PKCS#11
tokens.This section describes how Enterprise Server provides that support and walks you
throughthe procedures for the related congurations.
J2SE5.0 PKCS#11 providers can be easily integrated with the Enterprise Server runtime.
Throughthese providers, you can use hardware accelerators and other PKCS#11 tokens in
EnterpriseServer to achieve fast performance and to protect the private key inherent in SSL or
TLScommunications.
Thissection contains the following topics:
■“AboutConguring Hardware Crypto Accelerators” on page 120
■“ConguringPKCS#11 Tokens” on page 121
■“ManagingKeys And Certicates” on page 122
■“ConguringJ2SE 5.0 PKCS#11 Providers” on page 124

About ConguringHardware Crypto Accelerators

SunGlassFish Enterprise Server has been tested with Sun Crypto Accelerator 1000 (SCA-1000)
andSCA-4000.
EnterpriseServer can communicate with PKCS#11 tokens. Packaged with Enterprise Server are
anNSS PKCS#11 token library (for the NSS Internal PKCS#11 Module,commonly known as
theNSS soft token) and NSS command-line management tools. For more details, see “Using
NetworkSecurity Services (NSS) Tools” on page 116.
Usethe NSS tools to create keys and certicates on PKCS#11 tokens and J2SE PKCS#11
providersto access token keys and certicates at runtime. A PKCS#11 provider is a
cryptographicservice provider that acts as a wrapper around a native PKCS#11 library. A
PKCS#11token generally refers to all the hardware and software tokens with a native PKCS#11
interface.A hardware token is a PKCS#11 token implemented in physical devices, such as
hardwareaccelerators and smart cards. A software token is a PKCS#11 token implemented
entirelyin software.
Note– If you run Enterprise Server on the J2SE 1.4.x platform, only one PKCS#11 token, the NSS
softtoken, is supported.
UsingHardwareCrypto Accelerator With Enterprise Server
SunGlassFishEnterprise Ser ver2.1 Administration Guide • December 2008120