Is server authentication mandatory for using SSL?

Question

Is server authentication mandatory for using SSL sockets, or is there a way around it?
In other words, how can I take advantage of SSL sockets without dealing with any kind of certificates? Do I have any other options?

Answer 1

Ok folks, I found my answer.Here�s the deal.
Here are some helpful sites: I hope they will also help you understand this topic better and make your life little easier.
//====================================
http://www.onjava.com/pub/a/onjava/2001/05/03/java_security.html
http://www-105.ibm.com/developerworks/education.nsf/java-onlinecourse-bytitle/96B42A25DD270CA886256BAA006351B4?OpenDocument
http://www.ddj.com/documents/s=870/ddj0102a/rl1
//====================================
Neither Server nor Client authentication is mandatory. However, if you don�t use proper ciphersuite (that doesn�t require any authentication), the connection will die so to avoid this problem, you need to enable those ciphersuites manually. Read on.
In most modes, SSL encrypts data being sent between client and server and also provides (optional) peer authentication.
These kinds of protection are specified by a "cipher suite", which is a combination of cryptographic algorithms used by a given SSL connection. During the negotiation process, the two endpoints must agree on a ciphersuite that is available in both environments. If there is no such suite in common, no SSL connection can be established, and no data can be exchanged.
The cipher suite used is established by a negotiation process called "handshaking".
There are two groups of cipher suites which you will need to know about when managing cipher suites:
�     Supported cipher suites: all the suites which are supported by the SSL implementation. This list is reported using getSupportedCipherSuites.
�     Enabled cipher suites, which may be fewer than the full set of supported suites.
This group is set using the setEnabledCipherSuites method, and queried using the getEnabledCipherSuites method. Initially, a default set of cipher suites will be enabled on a new socket that represents the minimum suggested configuration.
Implementation defaults require that only cipher suites which authenticate servers and provide confidentiality be enabled by default. Only if both sides explicitly agree to unauthenticated and/or non-private (unencrypted) communications will such a ciphersuite be selected.
When SSLSockets are first created, no handshaking is done so that applications may first set their communication preferences: what cipher suites to use, whether the socket should be in client or server mode, etc. However, security is always provided by the time that application data is sent over the connection.
The suite is chosen based upon the credentials that each side possesses and suites that each side supports. For example, a server can�t support an RSA cipher suite unless it has an available RSA private key.
The client and server must support at least one common cipher suite in order to communicate; if they both support multiple ciphers, the strongest available suite will be chosen.
The strings are part of the SSL specification and are defined as:
SSL_<key exchange algorithm>with<encryption algorithm>_<hash algorithm>
When a number appears in the encryption algorithm, it refers to the key strength of the encryption: higher numbers are more secure.
setEnabledCipherSuites(String[] suites) method controls which particular cipher suites are enabled for use on this connection.
�     The cipher suites must have been listed by getSupportedCipherSuites() as being supported.
�     Even if a suite has been enabled, it might never be used if no peer supports it, or the requisite certificates (and private keys) are not available.
getSupportedProtocols(): Returns the names of the protocols which could be enabled for use on an SSL connection.
setEnabledCipherSuites(String[] suites): Controls which particular cipher suites are enabled for use on this connection.
Let me give you some code that will help you understand little better.
One is Client.java for the client and the other one is Server.java for the server.
Compile and run them in two separate consoles.
( By the way, I assume that you have properly installed JSSE on your system.)
//===== Client.java: ===================================================
import java.io.*;
import java.net.*;
import javax.net.ssl.*;
public class Client
     public static void main(String[] args)
          (new Client()).doIt();
     }//end main
     private void doIt()
          int port = 3333;
          String host = "localhost";
/*          String[] enable = {"SSL_DH_anon_WITH_RC4_128_MD5",
                    "SSL_DH_anon_WITH_DES_CBC_SHA",
                    "SSL_DH_anon_WITH_3DES_EDE_CBC_SHA",
                    "SSL_DH_anon_EXPORT_WITH_RC4_40_MD5",
                    "SSL_DH_anon_EXPORT_WITH_DES40_CBC_SHA"};
*/          try
          SSLSocketFactory sslFact =
          (SSLSocketFactory)SSLSocketFactory.getDefault();
          SSLSocket s =
          (SSLSocket)sslFact.createSocket(host, port);
               //String[] suites;
               //Get all the default CipherSuites
               System.out.println("\n*** Default CipherSuites ***\n");
               String [] defaultSuites=sslFact.getDefaultCipherSuites();
               for(int i = 0; i<defaultSuites.length; i++)
                    System.out.println("["+i+"] Default CipherSuite ="+defaultSuites);
               //Get all the supported CipherSuites
               System.out.println("*** ================= ***");               
               System.out.println("\n*** CipherSuites Enabled by default ***\n");
               String [] enabledSuites=s.getEnabledCipherSuites();
               for(int i = 0; i<enabledSuites.length; i++)
                    System.out.println("["+i+"] Enabled CipherSuite="+enabledSuites[i]);
               System.out.println("*** ================= ***\n");
               System.out.println("***\n Supported CipherSuites ***\n");
               String [] supportedSuites=sslFact.getSupportedCipherSuites();
               for(int i = 0; i<supportedSuites.length; i++)
                    System.out.println("["+i+"]Enabled Supported CipherSuite ="+supportedSuites[i]);
               //Get all enabled CipherSuites
               System.out.println("*** ================= ***\n");
               System.out.println("\n*** Old and Newly enabled Anonymous CipherSuites ***\n");
               //s.setEnabledCipherSuites(enable);
               //Enable all supported CipherSuites
               s.setEnabledCipherSuites(supportedSuites);
               String [] suites=s.getEnabledCipherSuites();
               for(int i = 0; i<suites.length; i++)
                    System.out.println("["+i+"] Newly enabled Anonymous CipherSuites="+suites[i]);
               System.out.println("*** ================= ***\n");
               System.out.println(" The strongest available CipherSuite is chosen by the System.");
               System.out.println(" But it has to be enabled first, otherwise it ignores it. ");
               System.out.println("Currently Selected CipherSuite = "+s.getSession().getCipherSuite()+"\n");
               System.out.println("*** ================= ***");
               // Send messages to the server through
          // the OutputStream
          // Receive messages from the server
          // through the InputStream
          OutputStream out = s.getOutputStream();
          InputStream in = s.getInputStream();
               PrintWriter p = new PrintWriter(out);
               p.println("Hi Buddy!");
               p.println("Wanna have a beer?");
               p.println("All right, let's have some.");
               p.flush();
               out.close();
     in.close();
     s.close();
          catch (IOException e)
               System.out.println(""+e);
}//end class
//===== Here's Server.java ==============================================
import java.io.*;
import java.net.*;
import javax.net.ssl.*;
public class Server
     public static void main(String[] args)
          (new Server()).doIt();
     }//end main
     private void doIt()
          int port = 3333;
          SSLServerSocket ss;
          String[] enable = {"SSL_DH_anon_WITH_RC4_128_MD5",
                    "SSL_DH_anon_WITH_DES_CBC_SHA",
                    "SSL_DH_anon_WITH_3DES_EDE_CBC_SHA",
                    "SSL_DH_anon_EXPORT_WITH_RC4_40_MD5",
                    "SSL_DH_anon_EXPORT_WITH_DES40_CBC_SHA"};
          try
          SSLServerSocketFactory sslSrvFact =
          (SSLServerSocketFactory)
          SSLServerSocketFactory.getDefault();
               //Get all the default CipherSuites
               String [] suites=sslSrvFact.getDefaultCipherSuites();
               for(int i = 0; i<suites.length; i++)
                    System.out.println(""+i+". DEFAULT CIPHER SUITE="+suites[i]);
               suites=sslSrvFact.getSupportedCipherSuites();
               for(int i = 0; i<suites.length; i++)
                    System.out.println(""+i+". SUPPORTED CIPHER SUITE="+suites[i]);
               System.out.println("*** ================= ***");
          ss =(SSLServerSocket)sslSrvFact.createServerSocket(port);
               suites=ss.getEnabledCipherSuites();
               for(int i = 0; i<suites.length; i++)
                    System.out.println(""+i+". ENABLED CIPHER SUITE="+suites[i]);
               ss.setEnabledCipherSuites(enable);
               suites=ss.getEnabledCipherSuites();
               for(int i = 0; i<suites.length; i++)
                    System.out.println(""+i+". NEW ENABLED CIPHER SUITE="+suites[i]);
               System.out.println("*** ================= ***");
          SSLSocket c = (SSLSocket)ss.accept();
//          ServerSocket ss = new ServerSocket(port);
//          Socket c = ss.accept();
          OutputStream out = c.getOutputStream();
          InputStream in = c.getInputStream();
               BufferedReader br = new BufferedReader(new InputStreamReader(in));
          // Send messages to the client through
          // the OutputStream
          // Receive messages from the client
          // through the InputStream
          while(true)
//               int i = in.read();
                    String inputString = br.readLine();
                    if(inputString != null)
                    System.out.println(inputString);
               else
                    out.close();
                    in.close();
                    c.close();
               ss.close();
          catch (IOException e)
               System.out.println(""+e);
}//end class
//========= Good Luck! ===================