This example demonstrates the use of SSLIOP and IIOP calls between TAO and JacORB. There are three components: the client, the server and the service. The client and server represent user applications (either TAO or JacORB) that need to communicate with each other using SSLIOP calls. The service represents a generic TAO service (such as the TAO naming service), and calls from the client and server to the service need to be via IIOP (as the service is not configured for SSL).
These instructions are based on the Solaris gcc3.2 compiler makefiles.
ACE_ROOT=<TAO install dir>; export ACE_ROOT
TAO_ROOT=<TAO install dir>; export TAO_ROOT
SHLIB_PATH=$TAO_ROOT/lib; export SHLIB_PATH
LD_LIBRARY_PATH=$TAO_ROOT/lib:$LD_LIBRARY_PATH; export LD_LIBRARY_PATH
PATH=$PATH:$TAO_ROOT/bin; export PATH
INSLIB=$TAO_ROOT/lib; export INSLIB
PATH=/usr/local/gcc-3.2/bin:/usr/ccs/bin:$PATH; export PATH
LD_LIBRARY_PATH=/usr/local/gcc-3.2/lib:$LD_LIBRARY_PATH; export LD_LIBRARY_PATH
<TAO install dir>/examples/cc
directory.
make
command to run the makefile. This will compile all of the OpenFusion examples.
TAO_ROOT=<TAO install dir>
, where
<TAO install dir>
is the location into which you have installed
TAO.
<TAO install dir>\examples\examples.sln
. Double-click on the project file to load
it into Microsoft Visual C++.
If you intend to run the JacORB client or server, ensure that the OpenFusion V4 bin directory is in the path and that the V4 lib/jacorb.jar file is on the classpath. The OpenFusion TCS - JacORB with OpenFusion CORBA Services distribution can be obtained from the downloads page by following the OpenFusion CORBA Products software link.
idl SSLExample.idl
javac *.java
Start a server. To start the TAO server:
sslexample -ORBSvcConf configs\cppserver.conf -r serverTo start the JacORB server:
jaco -Dcustom.props=configs\javaserver.props SSLExampleImpl -r server
Start a client. To start the TAO client:
sslexample -ORBSvcConf configs\cppclient.conf -r clientTo start the JacORB client:
jaco -Dcustom.props=configs\javaclient.props SSLExampleImpl -r client
Start the TAO service.
sslexample -r service
Wait for all three components to initialise. This is shown by the "Ready: waiting for user input" line appearing in the console.
Send a message from the server to the client. In the sever's console, type:
client abc
Send a message from the server to the service. In the server's console, type:
service def
Send a message from the client to the server. In the client's console, type:
server ghi
Send a message from the client to the service. In the client's console, type:
service jkl
To exit the server, client and service, enter "exit" as the command.
The server and client are run with SSL enabled, and will report if a call to them has been made via SSLIOP or IIOP. The service is run without SSL enabled, and so will not be able to determine how the call was made. To get more information on the connection being used, you can enable ORB debugging as follows:
For a TAO server or client, add -ORBDebugLevel 3
to the command line. For example:
sslexample -ORBDebugLevel 3 -ORBSvcConf configs\cppserver.conf -r server
For a JacORB server or client, uncomment the jacorb.log.default.verbosity
and
jacorb.security.jsse.log.verbosity
lines in the appropriate configuration file
(configs/javaserver.props for the server, config/javaclient.props for the client).
A local certificate authority was created for this example. The certificates and keystores were created as follows:
Create the Java Server keystore and export a certificate request
keytool -genkey -alias java_server_alias -validity 365 -dname "CN=Java Server, OU=NA, O=NA, L=NA, S=NA, C=NA" -keystore javaserverks -storepass serverpass -keypass serverpass -keyalg rsa -keysize 1024
keytool -certreq -alias java_server_alias -file java_server_req.pem -keypass serverpass -keystore javaserverks -storepass serverpass
Create the Java Client keystore and export a certificate request
keytool -genkey -alias java_client_alias -validity 365 -dname "CN=Java Client, OU=NA, O=NA, L=NA, S=NA, C=NA" -keystore javaclientks -storepass clientpass -keypass clientpass -keyalg rsa -keysize 1024
keytool -certreq -alias java_client_alias -file java_client_req.pem -keypass clientpass -keystore javaclientks -storepass clientpass
Create the C++ Server certificate request (OPENSSL_CONF is not set, so as to use the the OpenSSL defaults)
openssl req -newkey rsa:1024 -keyout cpp_server_key.pem -keyform PEM -out cpp_server_req.pem -outform PEMPass phrase:
CppServerPassPhrase
cppserverchallenge
Create the C++ Client certificate request (OPENSSL_CONF is not set, so as to use the the OpenSSL defaults)
openssl req -newkey rsa:1024 -keyout cpp_client_key.pem -keyform PEM -out cpp_client_req.pem -outform PEMPass phrase:
CppClientPassPhrase
cppclientchallenge
Issue the certificates using the local certificate authority (OPENSSL_CONF set to the CA configuration file)
openssl ca -notext -in java_server_req.pem -out java_server_cert.pem
openssl ca -notext -in java_client_req.pem -out java_client_cert.pem
openssl ca -notext -in cpp_server_req.pem -out cpp_server_cert.pem
openssl ca -notext -in cpp_client_req.pem -out cpp_client_cert.pem
Import the certificates into the Java Server keystore
The test CA's certificate:
keytool -import -alias testcacert -file cacert.pem -keystore javaserverks -storepass serverpass
Own signed certificate:
keytool -import -alias java_server_alias -file java_server_cert.pem -keystore javaserverks -storepass serverpass
Signed certificates for the two clients:
keytool -import -alias java_client_alias -file java_client_cert.pem -keystore javaserverks -storepass serverpass
keytool -import -alias cpp_client_alias -file cpp_client_cert.pem -keystore javaserverks -storepass serverpass
To confirm the contents of the keystore:
keytool -list -keystore javaserverks -storepass serverpass
Import the certificates into the Java Client keystore
The test CA's certificate:
keytool -import -alias testcacert -file cacert.pem -keystore javaclientks -storepass clientpass
Own signed certificate:
keytool -import -alias java_client_alias -file java_client_cert.pem -keystore javaclientks -storepass clientpass
Signed certificates for the two servers:
keytool -import -alias java_server_alias -file java_server_cert.pem -keystore javaclientks -storepass clientpass
keytool -import -alias cpp_server_alias -file cpp_server_cert.pem -keystore javaclientks -storepass clientpass
To confirm the contents of the keystore:
keytool -list -keystore javaclientks -storepass clientpass
Remove the passphrases from the C++ Server and Client keys
openssl rsa -in cpp_server_key.pem -out cpp_server_nopass.key
openssl rsa -in cpp_client_key.pem -out cpp_client_nopass.key
This is done for convenience, so the pass phrases do not need to be entered each time the C++ client or server is run. The C++ configuration files refer to these unsecure keys. To use the original (secure) key with the C++ server, edit the configs/cppserver.conf file and change the -SSLPrivateKey
value from PEM:privatekeys/cpp_server_nopass_key.pem
to PEM:privatekeys/cpp_server_key.pem
. For the C++ client, edit the configs/cppclient.conf file and change the value from PEM:privatekeys/cpp_client_nopass_key.pem
to PEM:privatekeys/cpp_client_key.pem
. When using the secure keys, you will need to enter the appropriate pass phrase when starting the C++ server (CppServerPassPhrase
) and C++ client (CppClientPassPhrase
).