0

I'm a new java developer, and I have to create a SSL connection between server and client (and the client must send signed files).

Following tutorials and post from this page (like https://stackoverflow.com/a/18790838/2933117 or http://stilius.net/java/java_ssl.php) I create a keystore: keytool -genkey -keystore mySrvKeystore -keyalg RSA and I have written this code: 

    public class Servidor extends Thread {

        static int port=2017;
        static String serverKeyStore="mySrvKeystore.jks", pwdStore="123456";

        public static void main(String[] arstring) {

            SSLServerSocket sslserversocket=null;

            try {

                System.setProperty("javax.net.ssl.keyStore", serverKeyStore);
                System.setProperty("javax.net.ssl.keyStorePassword", pwdStore);


                SSLServerSocketFactory sslserversocketfactory = (SSLServerSocketFactory) SSLServerSocketFactory.getDefault();
                sslserversocket = (SSLServerSocket) sslserversocketfactory.createServerSocket(port);

 [...]

--

class Cliente {

    static int port=2017;
    static String serverKeyStore="mySrvKeystore.jks", pwdStore="123456";

    public static void main(String[] arstring) {

        try {

            System.setProperty("javax.net.ssl.trustStore", serverKeyStore);
            System.setProperty("javax.net.ssl.trustStorePassword", pwdStore);

            SSLSocketFactory sslsocketfactory = (SSLSocketFactory) SSLSocketFactory.getDefault();
            SSLSocket sslsocket = (SSLSocket) sslsocketfactory.createSocket("localhost", port);

Now my doubts, actually I have to use the same file (mySrvKeystore.jks) for the Keystore and TruStore with the same pwd ("123456"), how can give me this a secure channel? the clients can easily get the keys

and... If a client wants sign a file must use the secret key from trustore?

thanks in advance and sorry for my noob doubts.

Community
  • 1
  • 1
naxo
  • 153
  • 2
  • 2
  • 18
  • Exact duplicate of [Java Server SSL with different storepass and keypass](http://stackoverflow.com/questions/22230815/java-server-ssl-with-different-storepass-and-keypass) – user207421 Mar 07 '14 at 00:14
  • here: keystore pass vs trustore pass... in the other post keypass vs storepass . here I ask about security in a channel ssl, the other post only take into account the server side. Thanks anyway – naxo Mar 08 '14 at 10:28

0 Answers0