SSL Example

Description

This example demonstrates the use of SSLIOP and IIOP calls between TAO and JacORB. There are three components: the client, the server and the service. The client and server represent user applications (either TAO or JacORB) that need to communicate with each other using SSLIOP calls. The service represents a generic TAO service (such as the TAO naming service), and calls from the client and server to the service need to be via IIOP (as the service is not configured for SSL).

How to Build This Example

UNIX

These instructions are based on the Solaris gcc3.2 compiler makefiles.

  1. Ensure that the following environment variables are set:
  2. Ensure that your environment is set up for your compiler and linker. For example, for gcc3.2:
  3. Change to the <TAO install dir>/examples/cc directory.
  4. If you have not done so already, enter the make command to run the makefile. This will compile all of the OpenFusion examples.

Windows NT

  1. Set the environmental property TAO_ROOT=<TAO install dir>, where <TAO install dir> is the location into which you have installed TAO.
  2. A global example Microsoft Visual C++ project has been provided. This is called <TAO install dir>\examples\examples.sln. Double-click on the project file to load it into Microsoft Visual C++.
  3. Change the SSLExample project from debug mode to release mode using the Build | Configuration Manager menu option.
  4. Build the SSLExample files.

Java Code

If you intend to run the JacORB client or server, ensure that the OpenFusion V4 bin directory is in the path and that the V4 lib/jacorb.jar file is on the classpath. The OpenFusion TCS - JacORB with OpenFusion CORBA Services distribution can be obtained from the downloads page by following the OpenFusion CORBA Products software link.

  1. Compile the IDL:
    idl SSLExample.idl
  2. Compile the Java classes:
    javac *.java

How to Run This Example

  1. Start a server. To start the TAO server:

    sslexample -ORBSvcConf configs\cppserver.conf -r server
    To start the JacORB server:
    jaco -Dcustom.props=configs\javaserver.props SSLExampleImpl -r server

  2. Start a client. To start the TAO client:

    sslexample -ORBSvcConf configs\cppclient.conf -r client
    To start the JacORB client:
    jaco -Dcustom.props=configs\javaclient.props SSLExampleImpl -r client

  3. Start the TAO service.

    sslexample -r service

  4. Wait for all three components to initialise. This is shown by the "Ready: waiting for user input" line appearing in the console.

  5. Send a message from the server to the client. In the sever's console, type:

    client abc

    Send a message from the server to the service. In the server's console, type:

    service def

    Send a message from the client to the server. In the client's console, type:

    server ghi

    Send a message from the client to the service. In the client's console, type:

    service jkl

  6. To exit the server, client and service, enter "exit" as the command.

The server and client are run with SSL enabled, and will report if a call to them has been made via SSLIOP or IIOP. The service is run without SSL enabled, and so will not be able to determine how the call was made. To get more information on the connection being used, you can enable ORB debugging as follows:

Additional Information

Certificate Creation

A local certificate authority was created for this example. The certificates and keystores were created as follows:

  1. Create the Java Server keystore and export a certificate request

    keytool -genkey -alias java_server_alias -validity 365 -dname "CN=Java Server, OU=NA, O=NA, L=NA, S=NA, C=NA" -keystore javaserverks -storepass serverpass -keypass serverpass -keyalg rsa -keysize 1024
    keytool -certreq -alias java_server_alias -file java_server_req.pem -keypass serverpass -keystore javaserverks -storepass serverpass

  2. Create the Java Client keystore and export a certificate request

    keytool -genkey -alias java_client_alias -validity 365 -dname "CN=Java Client, OU=NA, O=NA, L=NA, S=NA, C=NA" -keystore javaclientks -storepass clientpass -keypass clientpass -keyalg rsa -keysize 1024
    keytool -certreq -alias java_client_alias -file java_client_req.pem -keypass clientpass -keystore javaclientks -storepass clientpass

  3. Create the C++ Server certificate request (OPENSSL_CONF is not set, so as to use the the OpenSSL defaults)

    openssl req -newkey rsa:1024 -keyout cpp_server_key.pem -keyform PEM -out cpp_server_req.pem -outform PEM
    Pass phrase: CppServerPassPhrase
    Challenge password: cppserverchallenge

  4. Create the C++ Client certificate request (OPENSSL_CONF is not set, so as to use the the OpenSSL defaults)

    openssl req -newkey rsa:1024 -keyout cpp_client_key.pem -keyform PEM -out cpp_client_req.pem -outform PEM
    Pass phrase: CppClientPassPhrase
    Challenge password: cppclientchallenge

  5. Issue the certificates using the local certificate authority (OPENSSL_CONF set to the CA configuration file)

    openssl ca -notext -in java_server_req.pem -out java_server_cert.pem
    openssl ca -notext -in java_client_req.pem -out java_client_cert.pem
    openssl ca -notext -in cpp_server_req.pem  -out cpp_server_cert.pem
    openssl ca -notext -in cpp_client_req.pem  -out cpp_client_cert.pem

  6. Import the certificates into the Java Server keystore

    The test CA's certificate:

    keytool -import -alias testcacert -file cacert.pem -keystore javaserverks -storepass serverpass

    Own signed certificate:

    keytool -import -alias java_server_alias -file java_server_cert.pem -keystore javaserverks -storepass serverpass

    Signed certificates for the two clients:

    keytool -import -alias java_client_alias -file java_client_cert.pem -keystore javaserverks -storepass serverpass
    keytool -import -alias cpp_client_alias  -file cpp_client_cert.pem  -keystore javaserverks -storepass serverpass

    To confirm the contents of the keystore:

    keytool -list -keystore javaserverks -storepass serverpass

  7. Import the certificates into the Java Client keystore

    The test CA's certificate:

    keytool -import -alias testcacert -file cacert.pem -keystore javaclientks -storepass clientpass

    Own signed certificate:

    keytool -import -alias java_client_alias -file java_client_cert.pem -keystore javaclientks -storepass clientpass

    Signed certificates for the two servers:

    keytool -import -alias java_server_alias -file java_server_cert.pem -keystore javaclientks -storepass clientpass
    keytool -import -alias cpp_server_alias  -file cpp_server_cert.pem  -keystore javaclientks -storepass clientpass

    To confirm the contents of the keystore:

    keytool -list -keystore javaclientks -storepass clientpass

  8. Remove the passphrases from the C++ Server and Client keys

    openssl rsa -in cpp_server_key.pem -out cpp_server_nopass.key
    openssl rsa -in cpp_client_key.pem -out cpp_client_nopass.key

    This is done for convenience, so the pass phrases do not need to be entered each time the C++ client or server is run. The C++ configuration files refer to these unsecure keys. To use the original (secure) key with the C++ server, edit the configs/cppserver.conf file and change the -SSLPrivateKey value from PEM:privatekeys/cpp_server_nopass_key.pem to PEM:privatekeys/cpp_server_key.pem. For the C++ client, edit the configs/cppclient.conf file and change the value from PEM:privatekeys/cpp_client_nopass_key.pem to PEM:privatekeys/cpp_client_key.pem. When using the secure keys, you will need to enter the appropriate pass phrase when starting the C++ server (CppServerPassPhrase) and C++ client (CppClientPassPhrase).

top
[top]


© PrismTech Limited 2002