Java (JSSE), keytool and certificates

Question

Hello,
I have a few basic problems with Certificates and JSSE.
I need to code a client-server program for company internal use. For this program I need a secure way of communication over TCP. Thus I thought SSL is the thing I need. Now I have a few basic problems with the 'SSL-Idea'.
What I know (or what I think to know):
The server have access to a private key which I previously generated with
keytool -genkey -dname "cn=Programm Name, ou=something, o=company name, c=country-code" -alias myalias -keypass keypass -keystore /some/where/keystore -storepass storepass -validity 180well... the server have access to this keystore to decrypt any incoming data encrypted with the public key of this private key. I am correct?
What I further (tink to) know is, that the client get the signed public key after opening the socket to this server. After verifying the reliability of this public key, the client can now decrypt all outgoing data to the server with its public key. I think, that the client now itself send a key for further decryption to the server. Correct? The further encryption should now be a symmetric one.
My problem is now: Where the is the public key? And how can I sign it?
What I already did:
keytool -certreq -alias myalias -file cert-request.csr -keystore /some/where/keystoreI think this is the request which I should send to some CA and get back the signed public key? If yes, is there a way to do it myself, because it's for internal use anyway?
And another thing: I read (and tried to understand) the JSSE Reference Guid and the contained examples (SSLSocketClientWithClientAuth and ClassFileServer). For these examples the server AND the client need access to the keystore which I though this keystore containing the private key. But this couldn't be the truth, because the private key should only be accessable by the server.
which files are now needed on which side? And where to get these needed files?
Well, I need some kind of explanation help here and appreciative any help :)
Regards,
Martin

Answer 1

The server have access to a private key which I
previously generated with
keytool -genkey -dname "cn=Programm Name,
ou=something, o=company name, c=country-code" -alias
myalias -keypass keypass -keystore
/some/where/keystore -storepass storepass -validity
180well... the server have access to this keystore to
decrypt any incoming data encrypted with the public
key of this private key. I am correct?Yes.
>
What I further (tink to) know is, that the client get
the signed public key after opening the socket
to this server. After verifying the reliability of
this public key, the client can now decrypt all
outgoing data to the server with its public key. I
think, that the client now itself send a key for
further decryption to the server. Correct? The
further encryption should now be a symmetric one.More or less.
>
My problem is now: Where the is the public
key? And how can I sign it?The public key is in the keystore, and it was signed at the same time it and the private key were created.
What I already did:
keytool -certreq -alias myalias -filecert-request.csr -keystore
/some/where/keystoreI think this is the request which I should send to
some CA and get back the signed public key? If yes,
is there a way to do it myself, because it's for
internal use anyway?
And another thing: I read (and tried to understand)
the JSSE Reference Guid and the contained examples
(SSLSocketClientWithClientAuth and ClassFileServer).
For these examples the server AND the client need
access to the keystore which I though this keystore
containing the private key. But this couldn't be the
truth, because the private key should only be
accessable by the server.
which files are now needed on which side? And where
to get these needed files?
Well, I need some kind of explanation help here and
appreciative any help :)
Regards,
Martin
I think you are really asking several questions here, but I'll try to answer them.
When you use keytool -genkey, a keypair is created. A keypair consists of a private key and a public key. keytool stores the public key in a self-signed certificate. You can immediately use this self-signed certificate to make SSL connections, provided the peer has been configured to trust it. Most peers, e.g. IE and mozilla, are configured to trust certificates signed by set of well known CAs and will complain when they receive your certificate. If you would like to avoid these complaints, you can get your certificate signed by one of these CAs. To do so, you would create a CSR using keytool -certreq,, and send the CSR to CA (along with $$$). The CA will do what they need to verify you and when satisfied they'll send you a certificate or certificate chain. You can then import this with keytool -import. This will replace the self-signed certificate that was there originally.
This describes what happens at the server side. You may optionally configure SSL to require client-side authentication. If you do, you must repeat the above process for each client. The clients do not share keystores with the server.