A Short Recipe for Creating a secure Java Webserver

Question

This is a short note describing how I was able to implement a Java server on a secure website. I am writing this because I hope the rest of you will be able to navigate the SSL minefield more easily than I was able to do.
I want to thank Brad Wetmore and Sean Mullan in the Sun Microsystems Java Security group. Without their help, I would never have been successful.
For more detailed reading, see http://java.sun.com/javase/6/docs/technotes/tools/solaris/keytool.html#EXAMPLES
1. Generate a public/private keypair and certificate for a webserver using keytool. The name of my product is FIRMS (Fully Integrated Resort Management System). You will see "firms" a lot in what follows. Fill in your own data under the "-dname" parameter. Note that if you run keytool so that it prompts you for this information, the first thing keytool will ask you to provide is your First Name and Last Name, although this field is also referred to as the Common Name. In SSL/TLS, the Common Name is the hostname of the website you'll be setting up. It probably would have been better if keytool had prompted for "Common Name" instead of First Name and Last Name. Just keep this in mind if you go through the keytool prompts. If you use the "-dname" parameter, as I have done here, you will not have to go through keytool's prompts. Also, note that the "-dname" information I provided is for a very small business, not a larger corporation.
keytool -genkeypair -alias firms -keyalg RSA -dname "cn=www.firmsglobal.com, ou=FIRMSGlobal, o=James Morris, l=Scottsdale, st=Arizona, c=US" -keystore foo
2. Generate a CSR (Certificate Signing Request).
keytool -certreq -alias firms -file firmsglobal.csr -keystore foo
3. Send the CSR to a trusted Certificate Authority (CA). I used GoDaddy. When the CA website asks you to provide a key, open the ".csr" file, copy it, and paste it into the website text area. Be sure to copy and paste the entire ".csr" file. Depending on the CA you are using, they will ask you what kind of server you are using. In most cases, choose "other". It really doesn't matter. Be absolutely sure you save the keystore file "foo". Back it up. Whatever you do, do not modify it or delete it. Save it. Got that?
4. Eventually the CA will provide you with one or more "reply" files ending (most likely) in ".cer" or ".crt". You might have to go into a repository to get the right "cross" files and "intermediate" files.
5. You must import the files provided by the CA back into your original keystore file. Remember that file? That is the one you saved. Above, I called it "foo".
6. Use the following keytool commands to import the files back into your original keystore file "foo". My CA provided me with 1 root file, 1 cross file, and 1 intermediate file, as well as my "real" certification file, which is called "www.firmsglobal.com.crt". Look again in step 1 above. Note that I used the alias "firms" to generate the public/private keypairs. You must use the same alias when you import the "real" certification reply file from the CA into the keystore file "foo". Note that I can use any alias name I wish on the first three lines below, but the fourth line is the command that will replace the self-signed certificate I generated in step 1 with the "real" certification reply file from the CA. The alias used in the fourth line must always match the alias used in step 1. Note that it might not always be necessary to perform lines one through three.
keytool -importcert -alias root -trustcacerts -keystore foo -file valicert_class2_root.cer"
keytool -importcert -alias cross -trustcacerts -keystore foo �file gd_cross_intermediate.cer"
keytool -importcert -alias intermed -trustcacerts -keystore foo -file gd_intermediate.cer"
keytool -importcert -alias firms -trustcacerts -keystore foo -file "www.firmsglobal.com.crt"
7. Here is the Java code I use to read the keystore. The string "keystore" holds the name of the keystore file. The string "keystorepass" is a char[] that holds the keystore password. The string "keypassword" is a char[] that holds the private key password. I might have these two passwords reversed. I used the same password for the keystore and the private key, but this is not recommended.
try {
      KeyStore ks = KeyStore.getInstance("JKS");
      ks.load(new FileInputStream(keystore), keystorepass);
      KeyManagerFactory kmf = KeyManagerFactory.getInstance("SunX509");
      kmf.init(ks, keypassword);
      SSLContext sslcontext = SSLContext.getInstance("SSLv3");
      sslcontext.init(kmf.getKeyManagers(), null, null);
      SSLServerSocketFactory ssf = sslcontext.getServerSocketFactory();
      sslServerSocket = (SSLServerSocket) ssf.createServerSocket(securePortNumber);
} catch (Exception e) {
      handleSocketException(e,"Server cannot listen on port ",securePortNumber);
};

Answer 1

Whenever the user selects a file, you can call the setCurrentDirectory method on the JFileChooser, with the getParentFile() method to return the directory of the selected file.
For example :
JFileChooser chooser = new JFileChooser();
if (chooser.showOpenDialog(null) == JFileChooser.APPROVE_OPTION) {
   File f = chooser.getSelectedFile();
   if (f.isFile()) {
       chooser.setCurrentDirectory(f.getParentFile());