Want to convert Applet to SSL

[john price]

I want to convert my Applet to SSL. I have used SSL (with a full program, not an Applet). It is currently signed and works fine. What will I have to do extra for SSL to work for the Applet? I am NOT talking about the coding part. That is already taken care of. Will the signing of the JAR file be enough to work for the SSL? For example,
Current : JAR signed, No SSL
Wanted : JAR signed, SSL

What would I have to do to convert between current and wanted? Please note that the answer my be "nothing". I am just trying to figure it out. Also, I have limited experience with SSL, but I'm not stupid.

Thanks,
John Price

[john price]

My keystore for the JAR currently is "keystore". Can I just use the same keystore? And in the beginning of the code, I would have to do something like (?) :

System.getSecurityManager().checkPermission(new SecurityPermission(setProperty("javax.net.ssl.trustStore", "keystore"));
System.getSecuirtyManager().checkPermission(new SecuirtyPermission(setProperty("javax.net.ssl.trustStorePassword", "123456");

John Price

[Rob Spoor]

Moving to our Applets forum.

[john price]

I think I figured part of it out. I got it running (server and client side). When I try to connect client and server, I get this error in the server :

C:\Users\cc11rocks\Documents\JavaCrap\AppletClientServer>java -jar AppletServer.jar
Connection (Main) : /*************** //*'d out, For my eyes only (it's the client's IP address).
1 //Amount of users online
Got a connection! //Server and client have connected
12456 //Connection cut off at specific location in code
0 //Amount of users online
javax.net.ssl.SSLHandshakeException: no cipher suites in common //Error message
        at sun.security.ssl.Alerts.getSSLException(Unknown Source)
        at sun.security.ssl.SSLSocketImpl.fatal(Unknown Source)
        at sun.security.ssl.Handshaker.fatalSE(Unknown Source)
        at sun.security.ssl.Handshaker.fatalSE(Unknown Source)
        at sun.security.ssl.ServerHandshaker.chooseCipherSuite(Unknown Source)
        at sun.security.ssl.ServerHandshaker.clientHello(Unknown Source)
        at sun.security.ssl.ServerHandshaker.processMessage(Unknown Source)
        at sun.security.ssl.Handshaker.processLoop(Unknown Source)
        at sun.security.ssl.Handshaker.process_record(Unknown Source)
        at sun.security.ssl.SSLSocketImpl.readRecord(Unknown Source)
        at sun.security.ssl.SSLSocketImpl.performInitialHandshake(Unknown Source
)
        at sun.security.ssl.SSLSocketImpl.readDataRecord(Unknown Source)
        at sun.security.ssl.AppInputStream.read(Unknown Source)
        at sun.nio.cs.StreamDecoder.readBytes(Unknown Source)
        at sun.nio.cs.StreamDecoder.implRead(Unknown Source)
        at sun.nio.cs.StreamDecoder.read(Unknown Source)
        at java.io.InputStreamReader.read(Unknown Source)
        at java.io.BufferedReader.fill(Unknown Source)
        at java.io.BufferedReader.readLine(Unknown Source)
        at java.io.BufferedReader.readLine(Unknown Source)
        at AppletServer$ClientHandler.run(AppletServer.java:93)
        at java.lang.Thread.run(Unknown Source)

Both are now running. I am getting this error when I try to connect them. How can I fix this?
NOTE : The server and client are being tested on the same machine

Thanks,
John Price

EDIT : Line 93 :

while ((message = reader.readLine()) != null) {

[john price]

I've had this issue before on a different program...Here is the solution I found :

SSLSocketFactory sslsocketfactory = (SSLSocketFactory) SSLSocketFactory.getDefault();
sock = (SSLSocket) sslsocketfactory.createSocket("IP_ADDRESS", PORT); //Replace with own
final String[] enabledCipherSuites = { "SSL_DH_anon_WITH_RC4_128_MD5" }; //Default Anonymous Cipher Suite 
sock.setEnabledCipherSuites(enabledCipherSuites);

The easiest way to fix this is to set the cipher suite in your program (client & server). Does no one know about SSL?

John Price

[Paul Clapham]

Let's put it this way... I wrote an applet and signed it with a certificate which we purchased from one of the well-known organizations (hint... its name starts with V...).

Then I put it into a page of our web application, which was accessed via SSL using a (different) certificate which we purchased from that same well-known organization. And what happened? Instead of our users being asked nicely if they want to accept the applet which was signed with the well-known organization's certificate, they get harsh messages that the applet has a malformed certificate chain. (Or something like that, it was a while ago that this happened.)

So we switched to not using SSL for that page and then the signed applet worked just fine. In answer to your question about whether anybody understands SSL, then, I'm tempted to suggest the answer is "No".

[john price]

I avoided all that certificate "crap" by setting the suite directly. I still sign and self-certify the Applet. So far, the only thing that pops up is a "Run" dialog I think. But that dialog is for the keystore/signed part of the Applet. SSL itself isn't the problem for me. Thank you for sharing your experiences and your honest assumption. Where can I find out more about SSL (in Java, not generally)? For example, is there a Java SSL forum?

Thanks,
John Price