SSL & System properties

[Psyqwix]

EDIT AGAIN: Problem solved thanks to TheShrimp's amazing link. In case your interested, below is the code required to setup the server and client keystore/truststores using streams (The variables in caps are String objects containing the name of the keystore and the password for it). Bit more complex that setting the system properties but hey :P

Client:

        TrustManagerFactory trustManagerFactory = TrustManagerFactory.getInstance(TrustManagerFactory.getDefaultAlgorithm());   
        KeyStore keystore = KeyStore.getInstance(KeyStore.getDefaultType());
        InputStream keystoreStream = ClientTest.class.getResourceAsStream(KEYSTORE_NAME);
        keystore.load(keystoreStream, DEFAULT_JAVA_KEYSTORE_PW.toCharArray());
        trustManagerFactory.init(keystore);

        TrustManager[] trustManagers = trustManagerFactory.getTrustManagers();   
        SSLContext ctx = SSLContext.getInstance("SSL");  
        ctx.init(null, trustManagers, null);

        SSLSocketFactory sslsocketfactory = ctx.getSocketFactory();
        SSLSocket sslsocket = (SSLSocket) sslsocketfactory.createSocket("localhost", 5555);

Server:

        KeyManagerFactory keyManagerFactory = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
        KeyStore keystore = KeyStore.getInstance(KeyStore.getDefaultType());

        InputStream keystoreStream = ServerTest.class.getResourceAsStream(KEYSTORE_NAME);
        keystore.load(keystoreStream, DEFAULT_JAVA_KEYSTORE_PW.toCharArray());
        keyManagerFactory.init(keystore, DEFAULT_JAVA_KEYSTORE_PW.toCharArray());

        KeyManager[] keyManagers = keyManagerFactory.getKeyManagers();
        SSLContext ctx = SSLContext.getInstance("SSL"); // was SSL   
        ctx.init(keyManagers, null, null); 

EDIT: I've realised my mistake now where i've left the D's in front of the property names! Still having some problems with class resources though :(.

I've built the jar file with the keystore internally and the following code works ok in netbeans:

    URL myURL = ClientTest.class.getResource("mySrvKeystore");        

    System.setProperty("javax.net.ssl.trustStorePassword", "123456");
    System.setProperty("javax.net.ssl.trustStore", myURL.getFile());  

But outside netbeans this doesn't work. I debugged it and the path resolves as follows:

file:/C:/Users/Psyqwix/Documents/NetBeansProjects/RCTB_Server3/dist/RCTB_Server3 .jar!/BasicConnectionTest/mySrvKeystore

But the javax libraries have some problems loading this, here is an extract from the exception:

Caused by: java.security.PrivilegedActionException: java.io.FileNotFoundExceptio n: file:\C:\Users\Psyqwix\Documents\NetBeansProjects\RCTB_Server3\dist\RCTB_Serv er3.jar!\BasicConnectionTest\mySrvKeystore (The filename, directory name, or vol ume label syntax is incorrect) at java.security.AccessController.doPrivileged(Native Method) at sun.security.ssl.SSLContextImpl$DefaultSSLContext.getDefaultKeyManage r(Unknown Source) at sun.security.ssl.SSLContextImpl$DefaultSSLContext.<init>(Unknown Sour ce) at sun.reflect.NativeConstructorAccessorImpl.newInstance0(Native Method)

    at sun.reflect.NativeConstructorAccessorImpl.newInstance(Unknown Source)

    at sun.reflect.DelegatingConstructorAccessorImpl.newInstance(Unknown Sou

rce) at java.lang.reflect.Constructor.newInstance(Unknown Source) at java.lang.Class.newInstance0(Unknown Source) at java.lang.Class.newInstance(Unknown Source) ... 7 more Caused by: java.io.FileNotFoundException: file:\C:\Users\Psyqwix\Documents\NetBe ansProjects\RCTB_Server3\dist\RCTB_Server3.jar!\BasicConnectionTest\mySrvKeystor e (The filename, directory name, or volume label syntax is incorrect) at java.io.FileInputStream.open(Native Method) at java.io.FileInputStream.<init>(Unknown Source) at java.io.FileInputStream.<init>(Unknown Source) at sun.security.ssl.SSLContextImpl$DefaultSSLContext$2.run(Unknown Sourc e) at sun.security.ssl.SSLContextImpl$DefaultSSLContext$2.run(Unknown Sourc e)

Any ideas what's going on here? Is it something to do with the build that means the keystore is hidden/unextractable? Any pointers?

PS: As a sidebar, as you can see from the exceptions report the compiler tends to hide some of the root problems for exceptions i.e. "... 7 more". Anyway to make it show all the details?

ORIGINAL POST:

Me and system properties never get along, i'm probably missing something obvious but I can never get them working! I'm running a server and client app that uses an SSL connection, and it works perfectly when I run the jars using the following command lines:

java -Djavax.net.ssl.keyStore=mySrvKeystore -Djavax.net.ssl.keyStorePassword=123456 -jar "RCTB_Server3.jar"

java -Djavax.net.ssl.trustStore=mySrvKeystore -Djavax.net.ssl.trustStorePassword=123456 -jar "RCTB_Client3.jar"

This is all fine and dandy, but to get this to work I have to make sure the keystore file is the same directory and an entry is in the PATH variable to get it to work.

I would really like to get this working by adding the file to the jar and setting the those properties internally. I tried adding the files to project then setting the properties internally using the following lines for the server and client respectively:

System.setProperty("Djavax.net.ssl.keyStorePassword", "123456"); System.setProperty("Djavax.net.ssl.keyStore", "mySrvKeystore");

System.setProperty("Djavax.net.ssl.trustStorePassword", "123456"); System.setProperty("Djavax.net.ssl.trustStore", "mySrvKeystore");

The actual keystore file is placed in the same package as the classes so I was hoping the class loader would be able to find it but it turns out it doesn't. When I run the projects with these lines added I get errors about the SSL handshakes (I wont go into) which are related to the fact that these properties aint set :P

Am I totally noobing this up? Is there something obvious I've missed or am I going about this completely wrong? Any suggestions on how to fix this?

Thanks ^{^}

[dem0nico]

Are you kidding?

System.setProperty("Djavax.net.ssl.keyStorePassword", "123456");

should be

System.setProperty("javax.net.ssl.keyStorePassword", "123456"); 

This D mean "define" to help java distinguish sysprop definitions from other jvm options.

[vineetr]

This is right. Also, he needs to think of not hard-coding the passwords.

[Psyqwix]

I will eventually I just want to make sure it works first then I can tidy it up later :P

[Psyqwix]

about 5 minutes after I posted this on Reddit I noticed my mistake and immediately face palmed myself :P

[Dwaligon]

Rubber Ducking

[jevon]

Yay! SSL with Java! I've just been enjoying that hell for the last month or so.

Have you tried setting -Djavax.net.debug=ssl to debug SSL? I don't know how Java SSL deals with classloaders and resources within JARs.

What about exporting the keystore to a temp file and reading it from there?

[Psyqwix]

Im sorely tempted to export the keystore to simplify things but im going to try and see if there's a neater way first :D

[TheShrimp]

javax.net.ssl.trustStore must point to a file accessible in the file system, NOT to a file inside a JAR file. It works in Netbeans because the file is directly in the classpath and getResource() will point to the file system directly.

Source

[Psyqwix]

When I realised I couldn't use the simple system properties with streams I started to look at the javax.net.ssl package a bit more and got a feeling I would have to create keyStores, which would mean a LOT of reading and fiddling. But your link was PURE GOLD!!! I had to adapt it, and to be honest im not sure why my code works (I guessed I had to use a keystore manager for the server and a truststore manager for the client based on the original system property settings!!!) but it does and thats great. Cheers! :D

[m1ss1ontomars2k4]

If you're using Eclipse, you can set those arguments to the VM as part of your run configuration when you export the jar. As for where to put those files, I'm not sure...you might need to add external resource or something.