Trying to clear up a few basic details

Question

I used the following example to open an HTTPS connection to a web site:
System.setProperty("java.protocol.handler.pkgs", "com.sun.net.ssl.internal.www.protocol");
Security.addProvider(new com.sun.net.ssl.internal.ssl.Provider());
URL url = new URL("https://www.sun.com");
BufferedReader in = new BufferedReader(
                    new InputStreamReader(
                    url .openStream()));
String inputLine;
while ((inputLine = in.readLine()) != null)
    System.out.println(inputLine);
in.close();The above code worked fine. What I am trying to understand is how this worked without me having any certificates installed on my machine. I thought I would have to create a certificate, import it with the keytool utility, and then register it. Yet, the above code worked without any other action on my part. I just don't like things "magically" happening, so I'd rather understand what is happening behind the scenes.

Answer 1

By using HTTPS, you're getting an SSL connection rather than one in the clear. The nice thing about SSL is precisely that it abstracts you from having to worry about the encryption handshake - it's all done under the covers, and it either works as advertised or your connection fails. And, with HttpsUrlConnection, you're even protected from having to know about the SSL-ness!
But to answer your question - yes, the connection uses the server's public key to encrypt data that will be used to create a shared key for the agreed-on stream cipher. The key itself is generated on each side "simultaneously" from this "premaster data" - you never end up sending the key itself over the air. Because the server's certificate will be rejected if it isn't from a known CA, and if it doesn't match the host we were trying to connect to, we can be (relatively) confident that there isn't a "man in the middle" spoofing us. You can look up the SSL protocol if you're really interested - here's one, URL, there are many others:
http://developer.netscape.com/docs/manuals/security/sslin/contents.htm
Grant