René Samselnig's Weblog » security http://sdm-net.org Personal Entertainment and Knowledge Management Fri, 18 May 2012 10:09:22 +0000 en hourly 1 http://wordpress.org/?v=3.1 Configuring JBoss with SSL http://sdm-net.org/2008/11/configuring-jboss-with-ssl/ http://sdm-net.org/2008/11/configuring-jboss-with-ssl/#comments Tue, 04 Nov 2008 09:13:58 +0000 René Samselnig http://sdm-net.org/?p=225 Sometimes you need a self signed certificate to use SSL with your JBoss installation. This is a small how-to that tells you the essential steps to do that. Creating the Keystore Creating a keystore to store certificates that JBoss can use. keytool -genkey -alias $MYDOMAIN -keyalg RSA ↵ -keystore my.keystore You will be asked for [...]

]]> Sometimes you need a self signed certificate to use SSL with your JBoss installation. This is a small how-to that tells you the essential steps to do that.

Creating the Keystore

Creating a keystore to store certificates that JBoss can use.

keytool -genkey -alias $MYDOMAIN -keyalg RSA ↵
-keystore my.keystore

You will be asked for a password to this keystore, just set any password you like. Furthermore you will need to enter some more information, just enter whatever you like – you only need these values to be correct if you are going to sign the certificate at your Certificate Authority.

Creating a Certificate Request

Then we need to create a Certificate Request.

keytool -certreq -keystore my.keystore ↵
-alias $MYDOMAIN -file myserver.csr

Normally you would want to send this Certificate Request to your Certificate Authority to sign it. That way browsers would accept your certificate without complaining. But we only need this certificate for our local development machine, so don’t worry about a security exception. You need to accept this certificate within your browser, though.

Configuring JBoss

You need to change this file to enable SSL with our created certificate: $JBOSS_HOME/server/default/deploy/jbossweb-tomcat50.sar/server.xml. Look for the following lines and uncomment them:

<Connector port="8443" address="${jboss.bind.address}"
  maxThreads="100" strategy="ms" maxHttpHeaderSize="8192"
  emptySessionPath="true"
  scheme="https" secure="true" clientAuth="false" 
  keystoreFile="${jboss.server.home.dir}/conf/ssl/my.keystore"
  keystorePass="KEYSTORE_PASSWORD" sslProtocol = "TLS" />

At last we need to copy your keystore to the proper place:

mkdir $JBOSS_HOME/server/default/conf/ssl
cp my.keystore $JBOSS_HOME/server/default/conf/ssl/

After a JBoss restart you can now use the https connection.

See also

This how-to is a short version of SSL mit JBoss (german).

]]> http://sdm-net.org/2008/11/configuring-jboss-with-ssl/feed/ 0 The all new Cold Boot Attack on encryption keys http://sdm-net.org/2008/03/the-all-new-cold-boot-attack-on-encryption-keys/ http://sdm-net.org/2008/03/the-all-new-cold-boot-attack-on-encryption-keys/#comments Mon, 17 Mar 2008 08:53:03 +0000 René Samselnig http://sdm-net.org/2008/03/the-all-new-cold-boot-attack-on-encryption-keys/ This password retrieval article makes me think about data-encryption… Is encryption in vain? Is hardware this insecure? Though the article is in german you can find the original Princeton paper in english at the bottom of the page. Tell me what you think about it. Update: The link at heise.de seems to be down – [...]

]]> This password retrieval article makes me think about data-encryption… Is encryption in vain? Is hardware this insecure? Though the article is in german you can find the original Princeton paper in english at the bottom of the page.

Tell me what you think about it.

Update: The link at heise.de seems to be down – use this link instead: Lest We Remember: Cold Boot Attacks on Encryption Keys.

]]> http://sdm-net.org/2008/03/the-all-new-cold-boot-attack-on-encryption-keys/feed/ 0 Trusted Computing http://sdm-net.org/2007/03/trusted-computing/ http://sdm-net.org/2007/03/trusted-computing/#comments Mon, 05 Mar 2007 08:32:21 +0000 René Samselnig http://www.sdm-net.org/2007/03/trusted-computing/ What is trusted computing? Why doesn’t the industry trust me? Why do they want control about my computer/pda/cellphone/other device? Why can’t I decide by myself, who is thrustworthy? There’s a movie available at LAFKONs page on Trusted Computing. Though it is quite short it makes YOU ask these questions. Go watch it.

]]> What is trusted computing? Why doesn’t the industry trust me? Why do they want control about my computer/pda/cellphone/other device? Why can’t I decide by myself, who is thrustworthy? There’s a movie available at LAFKONs page on Trusted Computing. Though it is quite short it makes YOU ask these questions. Go watch it.

]]> http://sdm-net.org/2007/03/trusted-computing/feed/ 0