Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've read plenty but i'm still very confused about the server certificate concept.

At what stage does it turn a glassfish server from HTTP to HTTPS and how?

I know how to create a certificate with keytool, but what happens to it after that? I read something about associating the certificate with a JAR file? What? Surely a certificate should belong to a server?

I'm using glassfish and netbeans.

Thanks for clearing up my confusion if you can!

share|improve this question

migrated from stackoverflow.com May 2 '11 at 18:49

This question came from our site for professional and enthusiast programmers.

    
What exactly are you asking about? How HTTPS works? How Glassfish works? How to configure it? – SLaks May 1 '11 at 17:53
    
Basically, how to convert my HTTP server to an HTTPS server using a self-signed certificate. – Anonymous May 1 '11 at 18:10
    
So you're asking how to configure Glassfish. That might belong on ServerFault; I'm not sure. – SLaks May 1 '11 at 18:11

There's two different things happening here.

  • Acquire/create SSL keypair & certificate

In order to use SSL for anything (SMTP, HTTP, IMAP, etc.) you need a public and private key.

The private key is stored on the server and the public key is made available to the world to allow data to be encrypted in such a form that the private key can decode it.

The distribution of the public key is accomplished via sending it during the SSL negotiation1 - this is an insecure approach vulnerable to MITM attacks.

An SSL certificate is a signature of the SSL public key by a third party that is trusted - the third party is responsible for authenticating the identify of the public key.

A self-signed certificate is generally used for testing and is still vulnerable to MITM. Using it is like presenting only a letter to your bank written by you and signed by you to verify your identity.

  • Configure service to use SSL keypair & certificate

This is the part where you tell your service to actually use that keypair and certificate. Beyond the scope of this answer, but hopefully you understand SSL now :)


1: Though some cool things could be done now that DNSSEC is being implemented - we could put HTTPS certificates into TXT records or the like.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.