/usr/share/doc/libhttpunit-java-doc/sslfaq.html is in libhttpunit-java-doc 1.7+dfsg-11.
This file is owned by root:root, with mode 0o644.
The actual contents of the file can be viewed below.
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 | <!doctype html public "-//w3c//dtd html 4.0 transitional//en">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<meta name="GENERATOR" content="Mozilla/4.72 [en] (X11; U; Linux 2.2.14-5.0 i686) [Netscape]">
</head>
<body bgcolor="#FFFFFF">
<center>
<h1>
<font size=+3>Using SSL with httpunit FAQ</font></h1></center>
<h2>
Where can I get information on SSL?</h2>
<a href="http://java.sun.com/security/ssl/API_users_guide.html">from Sun
on SSL</a>
<br><a href="http://www.thawte.com/developers/contents.html">from Thawte,
a certificate vendor</a>
<br>
<a href="http://java.sun.com/products/jsse/">from the JSSE part of Sun's site</a>
<h2> What are some tools for creating and modifying certificates?</h2>
<a href="http://www.openssl.org/docs/apps/openssl.html">openssl</a> which is <a href="http://www.pseudonym.org/ssl/wwwj-index.html">also
described at pseudonym.org</a><br>
<a href="http://java.sun.com/products/jdk/1.2/docs/tooldocs/solaris/keytool.html">keytool</a>
for java
<h2>
How do I create a certificate?</h2>
Create a self-signed cert via openssl, given an existing key and openssl
config file:
<p> openssl req -new -out output.pem -key my_key.pem
-days 9999 -x509 -config openssl.cnf
<p>There's also a way to do this with the java "keytool" application.
<br>
<h2>
How can I <a NAME="make my certificate trusted"></a>make my certificate
trusted by the JVM?</h2>
<p><br>If you purchased your SSL certificate from Verisign or Thawte, then
it should be automatically trusted by the "trust file" within the JVM (Sun
seems to ship JVMs with certs from these two suppliers). If you created
your own certificate, you'll need to <a href="#import my existing certificate into the trust file for">import
that cert into cacerts</a>.
<h2>
How can I <a NAME="import my existing certificate into the trust file for"></a>import
my existing certificate into the "trust file" for a JVM?</h2>
<p><br>1. Find the trusted file "cacerts" in your JRE, e.g.
<br> find /java_install -name "cacerts"
<p>2. Copy that file to a backup
<br> cp cacerts cacerts.bak
<p>3. Install your certificate into the trust file (note: the file cacerts
ships from Sun with password "changeit")
<br> keytool -import -alias <mycompany> -file mycert.pem
-keystore $JAVA_HOME/jre/lib/security/cacerts
<p>4. Verify that your cert was imported:
<br> keytool -list -keystore $JAVA_HOME/jre/lib/security/cacerts
<h2>
How can I use SSL in httpunit?</h2>
1. You need an SSL certificate intalled into the web server to be tested. That
<a href="#make my certificate trusted">certificate must be trusted</a> by the
JVM of the test rig (httpunit). That certificate must have, as its Common Name,
the exact domain name of the web server you want to secure (e.g. "www.foo.com"
or "secure.foo.com". I have not had luck with certs like *.foo.com.)
<p>2. You must enable SSL support (i.e., support for URLs that start with
"https") in your test rig's JVM. Some environments like Weblogic offer native
SSL support, which is fast compared to pure java. For Weblogic, set the
property weblogic.security.ssl.enable=true in the config file and just start
using URLs like "https://myhost". Also, there is at least one <a href="#free SSL implementation">free
SSL implementation in java</a>. <br>
<h2>
How can I use a <a NAME="free SSL implementation"></a>free SSL implementation?</h2>
There is a free <a href="http://java.sun.com/products/jsse/">SSL implementation
available in pure java from Sun</a> , although it is relatively slow, especially
in its creation of the random key to start an SSL connection (about 3 seconds
on a 600Mz PIII). To use this implementation, download the JSSE package
from the Sun URL above, then:
<p>1. Add the three key jars to your JVM's "ext" (extentions) directory;
e.g.
<br> cp jcert.jar jnet.jar jsse.jar $JAVA_HOME/jre/lib/ext/
<p>2. After the jars are in place, you must modify the file "java.security"
to allow usage of the providers found within the jars. Find the file
<br> find $JAVA_HOME -name "java.security"
<p>3. Add the following line to the file java.security:
<br> security.provider.2=com.sun.net.ssl.internal.ssl.Provider
<p>Then start using URLs like "https://myhost" within the test rig.
The HTTPS protocol will automatically cause new provider classes within
the extention jars to be employed for a java.net.URL class and its related
connections. Note that you should NOT add these jars to the CLASSPATH.
Javax jars are accessed by the JVM by their inclusion in the magic "ext"
folder.
<br>
<h2>
How do I solve a javax.net.ssl.SSLException: untrusted server cert chain?</h2>
<p><br>See how to <a href="#make my certificate trusted">make your certificate
trusted</a>.
<br>
<p>
<hr WIDTH="100%">
<p>Compiled 12 Mar 2001 by larry hamel. Please post corrections/comments
to the <a href="mailto:httpunit-develop@lists.sourceforge.net">httpunit discussion
list</a>.
</body>
</html>
|