Sun Microsystems GlassFish Enterprise Server 2.1 Administration Manual page 110

Introduction to Certificates and SSL
When a Web browser (client) wants to connect to a secure site, an SSL handshake happens:
■
■
■
■
■
After the handshake, the client has verified the identity of the Web site, and only the client and
the Web server have a copy of the session key. From this point forward, the client and the server
use the session key to encrypt all their communications with each other. Thus, their
communications are ensured to be secure.
The newest version of the SSL standard is called TLS (Transport Layer Security). The Enterprise
Server supports the Secure Sockets Layer (SSL) 3.0 and the Transport Layer Security (TLS) 1.0
encryption protocols.
To use SSL, the Enterprise Server must have a certificate for each external interface, or IP
address, that accepts secure connections. The HTTPS service of most Web servers will not run
unless a digital certificate has been installed. Use the procedure described in
Certificate Using the keytool Utility" on page 114
server can use for SSL.
About Ciphers
A cipher is a cryptographic algorithm used for encryption or decryption. SSL and TLS protocols
support a variety of ciphers used to authenticate the server and client to each other, transmit
certificates, and establish session keys.
Some ciphers are stronger and more secure than others. Clients and servers can support
different cipher suites. Choose ciphers from the SSL3 and TLS protocols. During a secure
connection, the client and the server agree to use the strongest cipher they both have enabled for
communication, so it is usually sufficient to enable all ciphers.
Using Name-based Virtual Hosts
Using name-based virtual hosts for a secure application can be problematic. This is a design
limitation of the SSL protocol itself. The SSL handshake, where the client browser accepts the
server certificate, must occur before the HTTP request is accessed. As a result, the request
information containing the virtual host name cannot be determined prior to authentication,
and it is therefore not possible to assign multiple certificates to a single IP address.
110 Sun GlassFish Enterprise Server 2.1 Administration Guide • December 2008
The browser sends a message over the network requesting a secure session (typically, by
requesting a URL that begins with https instead of http).
The server responds by sending its certificate (including its public key).
The browser verifies that the server's certificate is valid and is signed by a CA whose
certificate is in the browser's database (and who is trusted). It also verifies that the CA
certificate has not expired.
If the certificate is valid, the browser generates a one time, unique session key and encrypts it
with the server's public key. The browser then sends the encrypted session key to the server
so that they both have a copy.
The server decrypts the message using its private key and recovers the session key.
to set up a digital certificate that your Web
"Generating a