Mailing-List: contact derby-user-help@db.apache.org; run by ezmlm
Precedence: bulk
Reply-To: "Derby Discussion" <derby-user@db.apache.org>
Received-SPF: pass (nike.apache.org: domain of dag.wanvik@oracle.com
 designates 156.151.31.81 as permitted sender)
Message-ID: <510F2CAC.3080207@oracle.com>
Date: Mon, 04 Feb 2013 13:36:12 +1000
From: Dag Wanvik <dag.wanvik@oracle.com>
Organization: Oracle Corporation
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64;
 rv:17.0) Gecko/20130107 Thunderbird/17.0.2
MIME-Version: 1.0
To: Derby Discussion <derby-user@db.apache.org>
Subject: Re: SSL peerAuthentication
References: <loom.20130109T202846-411@post.gmane.org>
In-Reply-To: <loom.20130109T202846-411@post.gmane.org>
Content-Type: multipart/alternative;
 boundary="------------040707020307090409050208"

This is a multi-part message in MIME format.
--------------040707020307090409050208
Content-Type: text/plain; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit

Reading up on this, this is my understanding for your case
(peerAuthentication in both directions).
When using CA signed certs for both sides, you should keep the CA certs
in the trust stores, i.e.

Client keystore:                                            Server keystore:
client-key                                                      server-key
client-cert                                                     server-cert

Client truststore:                                         Server
truststore:
server-ca-cert                                               client-ca-cert

Of course, server-ca and client-ca may be identical as in your example.

where:

  * server-cert: the cert that the server presents to clients
  * server-key: the private key that corresponds to server-cert
  * server-ca-cert: the cert of the CA that signed server-cert
  * client-cert: the cert that the client presents to the server
  * client-key: the private key that corresponds to client-cert
  * client-ca-cert: the cert of the CA that signed client-cert

It is true that this will allow secure connection of any client that has
a cert signed by "client-ca-cert", but this is as it should be: the
client is authenticated, the communication can proceed encrypted.
Further authorization should be handled by the server.

Hope this helps,
Dag


--------------040707020307090409050208
Content-Type: text/html; charset=ISO-8859-1
Content-Transfer-Encoding: 7bit

<html>
  <head>
    <meta content="text/html; charset=ISO-8859-1"
      http-equiv="Content-Type">
  </head>
  <body text="#000000" bgcolor="#FFFFFF">
    Reading up on this, this is my understanding for your case
    (peerAuthentication in both directions).<br>
    When using CA signed certs for both sides, you should keep the CA
    certs in the trust stores, i.e.<br>
    <br>
    Client keystore:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Server
    keystore:<br>
    client-key&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
    server-key<br>
    client-cert&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
    server-cert<br>
    <br>
    Client truststore:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; Server
    truststore:<br>
    server-ca-cert&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
    client-ca-cert<br>
    <br>
    Of course, server-ca and client-ca may be identical as in your
    example.<br>
    <br>
    where:<br>
    <ul>
      <li>server-cert: the cert that the server presents to clients</li>
      <li>server-key: the private key that corresponds to server-cert</li>
      <li>server-ca-cert: the cert of the CA that signed server-cert</li>
      <li>client-cert: the cert that the client presents to the server<br>
      </li>
      <li>client-key: the private key that corresponds to client-cert</li>
      <li>client-ca-cert: the cert of the CA that signed client-cert</li>
    </ul>
    It is true that this will allow secure connection of any client that
    has a cert signed by "client-ca-cert", but this is as it should be:
    the client is authenticated, the communication can proceed
    encrypted. Further authorization should be handled by the server.<br>
    <br>
    Hope this helps,<br>
    Dag<br>
    <br>
  </body>
</html>

--------------040707020307090409050208--