Working with Digital Certificates
Working with Digital Certificates
only address-based virtual hosts are commonly used with SSL in a production environment.
the directory domain-dir/config/. These digital certificates are self-signed and are intended for
use in a development environment; they are not intended for production purposes. For
production purposes, generate your own certificates and have them signed by a CA.
Server. In the enterprise profile, the certutil utility is used to create digital certificates. For
more information, see the Sun Java System Application Server 9.1 Administration Guide.
interface, or IP address, that accepts secure connections. The theory behind this design is that a
server should provide some kind of reasonable assurance that its owner is who you think it is,
particularly before receiving any sensitive information. It may be useful to think of a certificate
as a "digital driver's license" for an Internet address. It states with which company the site is
associated, along with some basic contact information about the site owner or administrator.
forge. For sites involved in e-commerce or in any other business transaction in which
authentication of identity is important, a certificate can be purchased from a well-known
certificate authority (CA) such as VeriSign or Thawte. If your server certificate is self-signed,
you must install it in the Application Server keystore file (keystore.jks). If your client
certificate is self-signed, you should install it in the Application Server truststore file
(cacerts.jks).
want to ensure that data being transmitted and received by the server is private and cannot be
snooped by anyone eavesdropping on the connection. In such cases, you can save the time and
expense involved in obtaining a CA certificate and simply use a self-signed certificate.
and one private key. If data is encrypted with one key, it can be decrypted only with the other
key of the pair. This property is fundamental to establishing trust and privacy in transactions.
For example, using SSL, the server computes a value and encrypts the value using its private key.
The encrypted value is called a digital signature. The client decrypts the encrypted value using
the server's public key and compares the value to its own computed value. If the two values
match, the client can trust that the signature is authentic, because only the private key could
have been used to produce such a signature.
service of most web servers will not run unless a digital certificate has been installed. Use the