W3C logo
Jigsaw

Jigsaw
SSL configuration


Jigsaw Home / Documentation Overview

This is a two-step process. First the SSL certificates need to be created, and then the jigsaw server needs to be configured. One item not covered in this document is the importing of already existing certificates.

make sure that jdk 1.4 is being used

We are going to be using the SSL implementation from Sun. Mainly the keytool (http://java.sun.com/j2se/1.4/docs/tooldocs/solaris/keytool.html) is used to configure the SSL certificates. If keytool is not in your default PATH, you can find it in the "bin" directory of your JDK installation.

  1. create a directory under jigsaw for the keystores
  2. run the jdk's keytool to first generate the self signed certificate

    Example:

    keytool -genkey -alias troi.example.com -keypass example -keystore /opt/jigsaw/dev/Jigsaw/keystore/troi.keystore -keyalg RSA
  3. run the keytool again to make a certificate request. This is what is sent to verisign or our own certificate authority. You can skip this if you want to sign it yourself.

    Example - specifying the output is put into a file:

    keytool -certreq -alias troi.example.com -keypass example -keystore /opt/jigsaw/dev/Jigsaw/keystore/troi.keystore -file troi.csr
    It will output something like:
          -----BEGIN NEW CERTIFICATE REQUEST-----
          MIICgTCCAj4CAQAwezELMAkGA1UEBhMCVVMxETAPBgAAAAgTCElsbGlub2lzMRYwFAYDVQQHEw1E
          b3duZXJzIEdyb3ZlMRAwDgYDVQQKEwdQZXJzZWNvMRkwFwYDVQQLExBCdXNpbmVzcyBTeXN0ZW1z
          MRQwEgYDVQQDEwtCcmlhbiBMYWlyZDCCAbgwggEsBgcqhkjOOAQBMIIBHwKBgQD9f1OBHXUSKVLf
          Spwu7OTn9hG3UjzvRADDHj+AtlEmaUVdQCJR+1k9jVj6v8X1ujD2y5tVbNeBO4AdNG/yZmC3a5lQ
          paSfn+gEexAiwk+7qdf+t8Yb+DtX58aophUPBPuD9tPFHsMCNVQTWhaRMvZ1864rYdcq7/IiAxmd
          0UgBxwIVAJdgUI8VIwvMspK5gqLrhAvwWBz1AoGBAPfhoIXWmz3ey7yrXDa4V7l5lK+7+jrqgvlX
          TAs9B4JnUVlXjrrUWU/mcQcQgYC0SRZxI+hMKBYTt88JMozIpuE8FnqLVHyNKOCjrh4rs6Z1kW6j
          fwv6ITVi8ftiegEkO8yk8b6oUZCJqIPf4VrlnwaSi2ZegHtVJWQBTDv+z0kqA4GFAAKBgQDc5Ki4
          7dX93se92yzYjxJIi99R9EZYHu4sNUH9obMQYO7o5u/3AOkxzqHLx60wWbf9JoCAlMe8q2i28NNC
          hjsN6LN7V0fgA05k/CzM9pMxbgeA0dqwQrtroWkJnFyzzFLrxjv7Rrh5RDGV/+ZeR72ZpHwy1GOj
          yDB2Dz+NE98sgKAAMAsGByqGSM44BAMFAAMwADAtAhRumfMg6P1KJmstMYga74KxaPLBfgIVAIwB
          bVanNqQb898bqHBkRybHIFqW
          -----END NEW CERTIFICATE REQUEST-----
    

    now we will import the response from the certificate authority.

    keytool -import -alias sis.example.com -keystore sis.keystore -file sis.cer -keyalg RSA -trustcacerts

    ans skip the next point (related to self-signature)

  4. If you want to self-sign the certificate, you may proceed like this:

    Example:
    keytool -selfcert -alias troi.example.com -keystore /opt/jigsaw/dev/Jigsaw/keystore/troi.keystore -keyalg RSA
  5. create a new configuration file called https-XXXXX.props where the XXXXX is the outside service (ex: enter.example.com). You can copy the default http- server.props to get started
  6. edit the https-XXXXX.props file and add the following entries:
          #Explicitly enables general SSL support
          org.w3c.jigsaw.ssl.enabled=true
          # Points to the key store (cf. 4. above, don't forget to put the full path to the keystore)
          org.w3c.jigsaw.ssl.keystore.path=
          # Supplies the key store access password
          org.w3c.jigsaw.ssl.keystore.password=
          #Finally, the socket client factory has to be set to the SSL factory:
          org.w3c.jigsaw.http.ClientFactory=org.w3c.jigsaw.https.socket.SSLSocket
          ClientFactory
    

    Of course you may change the default port to use the default one for SSL: 443 (or any other you like and not yet used)

    You should also change the propfile value to match the name of your configuration file.

  7. edit the server.props to use the new configuration file and add the following when creating the new server configuration

    Example - note the piece in bold. That lets jigsaw know which listener daemon to start:

    https-server.org.w3c.jigsaw.daemon.class=org.w3c.jigsaw.https.httpsd

This should cover the setup requirements. You should be able to start jigsaw and see something like the following when the start up occurs:

Jigsaw[2.2.2]/SSL[1.0.2]: serving at http://troi:8002/