This week's giveaway is in the Android forum.
We're giving away four copies of Android Security Essentials Live Lessons and have Godfrey Nolan on-line!
See this thread for details.
The moose likes Web Component Certification (SCWCD/OCPJWCD) and the fly likes Mock Exam question 2 Big Moose Saloon
  Search | Java FAQ | Recent Topics | Flagged Topics | Hot Topics | Zero Replies
Register / Login

Win a copy of Android Security Essentials Live Lessons this week in the Android forum!
JavaRanch » Java Forums » Certification » Web Component Certification (SCWCD/OCPJWCD)
Bookmark "Mock Exam question 2" Watch "Mock Exam question 2" New topic

Mock Exam question 2

Narendra Dhande
Ranch Hand

Joined: Dec 04, 2004
Posts: 950
This is the question from j2eecertificate

Question : Which of the following statement regarding the authentication method CLIENT-CERT are true ? ( Check all answers)

1. Supported by all application servers as it is mandeted by the servlet specification.
2. Authentication is performed when the SSL connection is establised.
3. All the commonly browsers support it.
4. All the data between the client and server is encrypted.
5. Requires a digital certificate which has been issued from a recognised certification authority.

The answers given are 2,3,4,5. Look correct. But I have little dout.

Is the SSL connection is mandeted by spec to use CLIENT-CERT authentication, though most of the application servers implemented it. Some application server generates their own 128 bit SSL certificates in testing environment, so the purchasing of digital certificate is not required if you are not using it for productin environment.

so I think option 2 and 5 are ambiguous. Can anyone provide explaination please.


Narendra Dhande
SCJP 1.4,SCWCD 1.4, SCBCD 5.0, SCDJWS 5.0, SCEA 5.0
Sushma Sharma
Ranch Hand

Joined: Jun 02, 2005
Posts: 139

However, there is not much specified in Servlet Specs about security, but If you see on page 95 of Servlet Specs, they have given

End user authentication using HTTPS (HTTP over SSL) is a strong authentication mechanism. This mechanism requires the user to possess a Public Key Certificate (PKC).

even in HFSJ, they have mentioned that certificate is required for CLIENT-CERT. and I don't have any experience in this field, so I dn't know anything about application server generates their own 128 bit SSL certificates in testing environment...

Narendra Dhande
Ranch Hand

Joined: Dec 04, 2004
Posts: 950
Hi sushma

Here is link , if you are interested in how to configure free SSL for tomcat using Java keytool

Free SSL for tomcat

wood burning stoves
subject: Mock Exam question 2
Similar Threads
Book Promotion : Hacking Exposed: J2EE and Java
configuring Tomcat for SSL
Mock exam Q
Passed 700,701 and 340 last Thursday