# SSL Quick Installation

Resin's SSL support is provided by Sun's JSSE. Because of export restrictions, patents, etc, you'll need to download the JSSE distribution from Sun or get a commercial JSSE implementation.

# Install JSSE from Sun

Installation instructions for JSSE are at http://java.sun.com/products/jsse/install.html.

<li>First download Sun's JSSE. <li>Uncompress and extract the downloaded file. <li>Install the JSSE jar files: jsse.jar, jnet.jar, and jcert.jar. You can either put them into the CLASSPATH or you can put them into $JAVA_HOME/jre/lib/ext. Since you will use "keytool" with the new jars, you need to make them visible to keytool. Just adding them to resin/lib is not enough. <li>Register the JSSE provider. You will modify $JAVA_HOME/jre/lib/java.security so it looks something like: security.provider.1=sun.security.provider.Sun security.provider.2=com.sun.net.ssl.internal.ssl.Provider Adding the JSSE provider allows "keystore" to create a key using the RSA algorithm.

# Create a test server certificate

The server certificate is the core of SSL. It will identify your server and contain the secret key to make encryption work.

<ul> <li>Sun's keytool <li>A test certificate from Thwaite

In this case, we're using Sun's <var/keytool/> to generate the server certificate. Here's how:

unix> <var/keytool -genkey -keyalg RSA -keystore keys/private.keystore/> Enter keystore password: <var/password1/> What is your first and last name? [Unknown]: <var/www.caucho.com/> What is the name of your organizational unit? [Unknown]: <var/Resin Engineering/> What is the name of your organization? [Unknown]: <var/Caucho Technology, Inc./> What is the name of your City or Locality? [Unknown]: <var/San Francisco/> What is the name of your State or Province? [Unknown]: <var/California/> What is the two-letter country code for this unit? [Unknown]: <var/US/> Is <CN=www.caucho.com, OU=Resin Engineering, O="Caucho Technology, Inc.", L=San Francisco, ST=California, C=US> correct? [no]: yes

Enter key password for <mykey> (RETURN if same as keystore password): password2

# resin.conf

SSL ports are configured as enhanced HTTP connections. You must:

<li>Load a <var/security provider/> providing the SSL implementation. <li>Enable SSL <li>Specify the keystore type <li>Specify the keystore file (certificate) <li>Specify the keystore password

The easiest keystore type to use is "pkcs12". pkcs12 is a standard format for exchanging certificates. When you export a client certificate from a browser, the usual format is pkcs12.

The default keystore type is "jks", the "Java KeyStore".

<caucho.com> <!-- JSSE security provider --> <security-provider id='com.sun.net.ssl.internal.ssl.Provider'/>

<http-server>

<http port=8443> <ssl>true</ssl> <key-store-type>pkcs12</key-store-type> <key-store-file>keys/server_cert.p12</key-store-file> <key-store-password>changeit</key-store-password> </http>

...

</http-server> </caucho.com>