Lesson - 04 : Web Security - Client Certificate Authentication

1. To apply security for a servlet or a jsp we have two approches
1. By the programmer
2. By the Container

2. Declarative Security Models
1. Basic Authentication
2. Digest Authentication
3. Form Based Authentication
4. Client Certificate Authentication

Client Certificate Authentication
1. This model is used to transfer the data between a client and server over a SecureSocketLayer(SSL).
2. In this model first a server will send a certificate to browser(client). If the certificate accepted then server allows the communication in a secure connection. If not accepted communication is not allowed.
3. In real time third party certificate authority creates a secure certificate for data transfer using RSA algorithm(Rivest Saber Adleman).

To create a local certificate we can use key tool given by JDK.
To test client-certificate authentication do the following
generate a local certificate using keyTool
C:\＞keytool -genkey -alias test1 -keyalg RSA
The generated certificate is stored in
c:\Documentand settings\welcome\keystore
Add the generated certificate to server.xml file
In server.xml put non SSL connector tag in ＜comments＞ and SSL ＜connector＞ tag at out of comments.
Add two attributes called keystoreFile and keystorePass to the SSl ＜connector＞ tag.
＜connector port="8443" protocol="http/1.1" SSLEnable="true" maxThreads="150" scheme="https" secure="true" clientAuth="flase" sslProtocol="TLS" keystoreFile="c:\Documentand settings\welcome\keystore" keystorePass="xx"/＞

Sample Projects : https://github.com/SadaLearningHub1/JSP-Projects