Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I've read plenty but i'm still very confused about the server certificate concept.

At what stage does it turn a glassfish server from HTTP to HTTPS and how?

I know how to create a certificate with keytool, but what happens to it after that? I read something about associating the certificate with a JAR file? What? Surely a certificate should belong to a server?

I'm using glassfish and netbeans.

Thanks for clearing up my confusion if you can!

share|improve this question

migrated from stackoverflow.com May 2 '11 at 18:49

This question came from our site for professional and enthusiast programmers.

    
What exactly are you asking about? How HTTPS works? How Glassfish works? How to configure it? –  SLaks May 1 '11 at 17:53
    
Basically, how to convert my HTTP server to an HTTPS server using a self-signed certificate. –  Anonymous May 1 '11 at 18:10
    
So you're asking how to configure Glassfish. That might belong on ServerFault; I'm not sure. –  SLaks May 1 '11 at 18:11

2 Answers 2

There's two different things happening here.

  • Acquire/create SSL keypair & certificate

In order to use SSL for anything (SMTP, HTTP, IMAP, etc.) you need a public and private key.

The private key is stored on the server and the public key is made available to the world to allow data to be encrypted in such a form that the private key can decode it.

The distribution of the public key is accomplished via sending it during the SSL negotiation1 - this is an insecure approach vulnerable to MITM attacks.

An SSL certificate is a signature of the SSL public key by a third party that is trusted - the third party is responsible for authenticating the identify of the public key.

A self-signed certificate is generally used for testing and is still vulnerable to MITM. Using it is like presenting only a letter to your bank written by you and signed by you to verify your identity.

  • Configure service to use SSL keypair & certificate

This is the part where you tell your service to actually use that keypair and certificate. Beyond the scope of this answer, but hopefully you understand SSL now :)


1: Though some cool things could be done now that DNSSEC is being implemented - we could put HTTPS certificates into TXT records or the like.

share|improve this answer

Here's a good tutorial on how to setup GF with SSL Glassfishv3 & SSL

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.