Working with JSSE using multi-purpose keystore

Question

Hello,
I am currently working on an application which employs the JCA for providing signatures, authenticating users etc., but also working with JSSE.
More specifically: The application must be able to verify signatures on code packages created by known users and loaded at runtime; but for communication with other parts of the application, it shall use SSL connections.
Now I worked through the JSSE manuals and I was able to set up a simple SSL application with client and server, using all the getDefaults() I could get a hold on.
In the final application that I am working on, I will have a keystore with quite a lot of keys from users, public and possibly private ones, and also a key for the SSL communication. I have the strong feeling that I will not see many getDefault()s anymore.
My problem is that by looking at the API, I don't have any clue how to tell the JSSE which key to use for the SSL connection from the keystore holding possibly many keys of users.
Moreover, how do I pass the passphrase for unlocking the private key to the JSSE if it is not equal to the keystore password? (Which, by the way, seems to me to require passing via the command line - argh!)
Help would be greatly appreciated.
Michael

Answer 1

I've got it.
The secret is to create an own X509KeyManager. This key manager gets its keys from the keystore, so I have the chance to provide an alias which is intended to be used for SSL and to provide the key password.
public class SpecialX509KeyManager implements X509KeyManager {
public SpecialX509KeyManager(KeyStore keys, String sSSLAlias, String sPassword) {
// browse the keystore,
// get the key which has the given alias - and only this one -
// and use the password to decrypt it
// keep the key and its certificate chain
The keystore must be loaded before, using the keystore password:
KeyStore keys = KeyStore.getInstance("JKS");
keys.load(new FileInputStream("server.ks"), "keystorepw".toCharArray());
KeyManager[] akm = new KeyManager[1];
akm[0] = new SpecialX509KeyManager(keys, "ssl", "ssl012");
SSLContext sc = SSLContext.getInstance("TLS");
sc.init(akm, null, null);
SSLServerSocketFactory sslSrvFact = sc.getServerSocketFactory();
That is, I have a keystore, using the password "keystorepw", containing keys with one using the alias "ssl" and the password "ssl012".
Michael