Escolar Documentos
Profissional Documentos
Cultura Documentos
Select Language
Pow ered by
Translate
1996-2011 2008-07-30 Roedy Green, Canadian Mind Products The CurrCon Java Applet displays prices on this web page converted with todays exchange rates into your local international currency, e.g. Euros, US dollars, Canadian dollars, British Pounds, Indian Rupees CurrCon requires Java version 1.5 or later , preferably 1.7.0. If you cant see the prices in your local currency, troubleshoot CurrCon.
certificate How Certificates Work Vendors Selecting a Vendor What Can You Use Certificates For? Private Key Vs Public Key The Root Certificate Matching Problem Netscape 4.79 Jar Signing Java 1.3+ Jar Signings RSA vs DSA Manipulating Certificates Certificate Expiry
Viewing Certificates Installing/updating Root The Formats of Digital Certificate Certificates The Types of Digital Certificate Cracking Security Cost Free Phony Self-Signed Certificates Obscure Certificates
What Certificates Do you Need? Why You Want A Real Certificate Learning More What Is in A Certificate? Links
mindprod.com/jgloss/certificate.html
1/11
10/7/2011
install a copy of the signers certificate.
The signature consists of a digest of the material signed, an encryption of the digest using the signers private key, the signers name and public key, and the signing authoritys name. You could not trust a signing authoritys public key embedded in the signature. You must get that separately. Certificates are primarily concerned with digital signatures, though they can be used for encryption. Certificates contain your public keys so that other people can encrypt the mail they send you so that if anyone intercepts it, they cannot make any sense of it. You can safely hand out your public keys to others since they do not contain your private keys. Unfortunately, Netscape includes your private key whenever it exports a certificate. You must be very careful not to let others discover it. The certificate-issuing authority at no time is privy to your private key. Your browser generates your random private key when you purchase your certificate, and sends only the public key to the certificate authority. The process of purchasing a certificate may require installing the certificate authoritys public key in your browser, three visits to the certificate authoritys website, and some email. Depending on the cost/class of the certificate, the certificate authority may need a substantial amount of time to check you out before issuing the certificate. You need passphrases for your browser and for each certificate. If you forget a passphrase, you are totally hosed. You will never be able to use the certificate again. Thankfully, some certificates offer a hint (which you compose) in case you forget the passphrase. For a technical overview of how the public and private keys work, see my essay on digital signatures .
Pretty Good Privacy. root certificates. Sun Java version 1.3 or later user certs.
mindprod.com/jgloss/certificate.html
2/11
10/7/2011
X.509/DER BASE64 encoded. Sometimes a chain of certificates. ? X.509/DER binary format
*.cer
*.crl *.crt
Certificate Revocation List. Used by cryptext.dll. Thawte root certificates, Sun Java version 1.3 or later cacerts.. Certificate request, contains the public key, signed with the private key. Netscape export of the entire set of keys. Contains multiple certs with private keys. Suns keyring format. Can optionally include private key, authentication chain and friendly name. Sun never imports/exports the private key, though .keystore contains it. user certs. Can optionally include private key, authentication chain and friendly name. Sun never imports/exports the private key, though .keystore contains it. IBMs Keyman will create and manage this format of keyring. IE binary public key export. Can optionally contain multiple certs, e.g. a certificate chain. IBMs Keyman will create and manage this format of keyring. Looks like a signed document without content. Certificate request response. Your signed certificate back from the signing authority ready to import. ASCII format. Used by cryptext.dll. Privacy Encoded Mail format for sending certs embedded in email, typically SSL cert. Base64 ASCII-amoured. Authenticode private key. *.spc is the public key Authenticode public/private key, used for signing XML and PAD files. Authenticode public key. *.pvk is the public key Windows certificate store. Windows certificate trust list. Used my cryptext.dll. user certificates.
*.csr, *.p10
PKCS #10
*.db
proprietary binary?
*.p12, *.pfx
PKCS #12
*.p7b *.pk7c
PKCS #7
*.p7r
PKCS #7
*.pem
PEM
*.pfx
MS proprietary
*.pvk
PKCS #12
mindprod.com/jgloss/certificate.html
3/11
10/7/2011
Cost
Certificates vary in cost depending mainly on how much research the certificate authority does to verify you are really you, and how much information is in the certificate that the authority is attesting is true. If you are buying a certificate for an SSL webserver, for example, Thawte are about 1/3 the price of industry leader Verisign. Thawtes developer certificates work for Netscape and Microsoft, Java version 1.1, Java version 1.2, Java version 1.3 or later plugin, and Web Start. Unfortunately, Verisign bought out Thawte in 2000-02, so prices will likely gradually rise. With Verisign you need to buy three separate certificates. Thawte has greatly improved over the last year and issued my certificate within one day after I faxed the necessary documentation. Thawte is in South Africa. Verisign is in the USA. Your secrets are probably better kept by a different government than the one wanting to pry on them. All it would take is a court order to discover your Verisign secrets. Thawte has better documentation. There has been a historical tendency of certificate companies to presume extremely high technical knowledge on the part of their users. It is not quite as bad as you might think since, in theory, the signing authority does not know your private key. Personal certificates are often free, especially ones with a short expiry date. Corporate ones are hundreds of dollars per year. For SSL server certificates, or Developer Object/Applet signing certificates, you want to choose a certificate authority already built into the standard browsers such as Netscape, Internet Explorer and Opera, e.g. Thawte.
What Is in A Certificate?
The certificate may contain information such as: email address your name address birthdate gender SIN/SSA number passport number company name DUNS number (Dun & Bradstreet number) your website URL personal public encryption/signing key. Some certificates also contain your personal private key, but these are never distributed. All the ones you download do not contain a private key.
mindprod.com/jgloss/certificate.html
4/11
10/7/2011
The information is not in human-readable form. You need a program to decode and display it. You may be required to provide additional information such as Business License, Certificate of Business Registration and Articles of Incorporation which are kept on file at the signing authority, but which are not included in the certificate as vouched for information. None of this information has any effect on how and where you can use your certificate. Some certificates may have a lifetime of only minutes. The signing authority is guaranteeing the information is true. They use their private key to sign the certificate attesting to its authenticity. Infuriatingly, there is almost always two crucial things missing : 1. The URL where you can download the official version of the certificate. 2. The URL of where you can view the certificates human-readable fingerprint to verify it is valid.
mindprod.com/jgloss/certificate.html
5/11
10/7/2011
Java
Firefox
Sea Alternatively, click Edit Preferences Privacy & Security Monkey Certificates Manage Certificates import . I have not been able figure out where Internet Explorer hides its certificates, possibly somewhere in the registry. It exports them to *.pfx or *.p12 files. When you export from IE, you have the option of including the private key. I have not been able figure out where Internet Explorer hides its certificates, possibly somewhere in the registry. It exports them to *.pfx or *.p12 files. When you export from IE, you have the option of including the private key.
IE 7
IE 6
Safari
click start Control Panel network Internet Options Content Trusted Root Certificate Authorities. Click start Control Panel Internet Options Content I have not been able figure out where Windows hides Certificates. its certificates, possibly somewhere in the registry.
Windows
Cracking Security
There are plenty of indirect ways to crack the security provided by digital certificates: Wait for the user to make an error, such as accidentally publish his private key. The procedures to use security measures are still quite complicated and easily screwed up. Put up a spoofing display that simply asks the user for passphrases. A dutiful user will mindlessly provide them. The security systems in Windows9x and NT are made of swiss cheese. Crack them and replace crucial bits of code in browsers or signing tools.
Obscure Certificates
There is a third kind of certificate, legitimate like one from Thawte or Verisign, but with most of the hassle of a phony one. What if you bought your certificate from an small signing authority company that almost no one had heard of, or used a free one, its root certificate would not be built-in to Netscape or Internet Explorer. You would have to manually import either the signing authority root certificate or your certificate into every clients machine before your signed Applet would be recognised. This would be a major hassle if you are dealing with the general public. This problem even happens sometimes with mainstream companies. For example Thawte sold codesigning certificates in 2004-04, but the root certificate to verify them was not present in JDK 1.5 beta, or any of the browsers. It had to be manually installed, making using the certificate as clumsy as a phony selfsigned certificate. Download the root certificate and install it in all the cacerts. files on machines that use you application.
The Root Certificate Matching Problem Why Verisign Jar-Signing Certificates Were All But Useless.
mindprod.com/jgloss/certificate.html 6/11
10/7/2011
Verisign jar-signing certificates are all but useless because of a bug in Netscape 4.79. This problem is resolved simply because all the offending certificates have all expired. Verisign made an minor mistake that is causing severe troubles. They issued several public root jar-signing certificates with the same public key, but different expiry dates. These have been pre-installed in the major browsers. Unfortunately Netscape is not too bright about how to find the matching root signing authority certificate for a jar. It just takes the first match on public key. This can cause it to pick the wrong root certificate and refuse to accept the jar. You can encourage it to find the correct one by removing the other Verisign root jar-signing certificates. However, if you do that, it wont be able to verify jars signed by other vendors. I suppose you could remove all but the most recent root Verisign jar-signing certificate and trust all vendors will soon upgrade their certificates. Other solutions: use Thawte certificates which dont have the problem, or wait for Netscape to use improved matching logic.
mindprod.com/jgloss/certificate.html
7/11
10/7/2011
Make sure you dont inadvertently give the privilege of rewriting the policy file to a suspect program. Fine grain policies where you ask the use for permission are pointless because the user does not understand the questions. Further the many questions just irritate him. (As I discovered with the old Netscape fine grain permissions.) I have little to say about it other than my documentation on how to use keytool. I asked in a newsgroup for an explanation of what AccessControllers were for. Hold your breath, here was the response. The Java AccessController uses the set of ProtectionDomains on the call stack to implement permissions based on code bases (e.g., classes loaded from my local machine can read and write local files, but Applets loaded from the network cant). When you check for a permission, the AccessController examines each ProtectionDomain on the call stack in the AccessController, ensuring that the associated PermissionCollection for each such ProtectionDomain implies the requested permission. In other words that the methods caller, or the caller of that method etc. have permission to do the naughty deed. You can attach a DomainCombiner to an AccessControlContext that you create (if you have permission to create an AccessControlContext), and then your DomainCombiner gets the opportunity (or responsibility) to touch/modify the set of ProtectionDomains before they are checked for the given permission. JAAS authorization is implemented this way, by attaching a javax.security.auth.SubjectDomainCombiner to the AccessControlContext created in javax.security.auth.Subject.doAs(); this SubjectDomainCombiner uses the JAAS policy object to add the subjects permissions into the permission set of each of the ProtectionDomains on the call stack. Maybe you didnt really need a signed Applet after all
RSA vs DSA
In the beginning, there were RSA signed Applets using a proprietary Netscape jar-signing scheme. Then with JDK 1.2, they were replaced by Sun-style DSA-signed Applets. Then with Java version 1.3, they were augmented by RSA-signed Applets. Thawte now sells only RSA-style Java version 1.3 or later certificates. If you create a self-signed certificate, and choose DSA, it will work on JDK 1.2+. If you create self-signed RSA certificate will work only on Java version 1.3 or later. Pretty much all certificates are RSA now. Whether you choose DSA or RSA, the SHA-1 digests in the MANIFEST.MF manifest will be the same either way, as will the digests in the *.SF file. For reasons unknown, the SHA-1 digests in MANIFEST.MF dont match those in the *.SF file. The only thing that literally gets digitally signed (manifest encrypted with the private key) is the digest of the entire *.SF digests file. If you choose DSA, then your public key certificate will appear in a *.DSA member of the jar. If you choose RSA, then your public key certificate will appear in a *.RSA member of the jar.
Manipulating Certificates
You can manipulate certificates directly with Java. Here is an example of how you would extract the public key from a PKCS12 certificate.
KeyStore ks = KeyStore.getInstance ( "PKCS12" ); // for security, KeyStore wants certificate password as char[] char[] password = "Sesame".toCharArray(); ks.load( new FileInputStream( "yourcert.p12" ), password ); Certificate c = ks.getCertificate( "thecert" ); PublicKey p = c.getPublicKey();
To do the equivalent with the .keystore file use .getInstance ( "JKS" ) instead of .getInstance ( "PKCS12" ).
Certificate Expiry
According to Thawte, you can buy a code-signing certificate from them, valid for one or two years. You can sign code for one or two years, then the certificate stops working. However the code you sign stays valid up to ten years. You get to choose how long you want it to remain valid when you do the signing. However, since jarsigner.exe has no -expiry option, I dont know just how you would specify that.
Learning More
See IBM Redbook Java 2 Network Security for notes on how to create your own certificates (you as
mindprod.com/jgloss/certificate.html
8/11
10/7/2011
issuing authority), for Netscape, IE, and Java 2.
Oracles Javadoc on HttpsURLConnection.getServerCertificates : Gets you are array of Certificates starting with the certificate for the host followed by the chain of authorities. HttpsURLConnection is as subclass of HttpURLConnection that URL.openConnection returns. : available: on the web at Oracle.com in the current JDK 1.7.0 or in the old JDK 1.6.0_27 on your local Windows J: drive. Oracles Technote Guide on Certificates : available: on the web at Oracle.com in the current JDK 1.7.0 on your local Windows J: drive.
There are some noticeable gaps in Suns security classes. You cant produce an X.509 certificate for example. The BouncyCastle classes often come to the rescue. recommend bookDigital Certificates: Applied Internet Security paperback ISBN13: 978-0-201-30980-5 publisher: Addison-Wesley published: 1998-10-09 by: Jalal Feghhi, Jalil Feghhi, Peter Williams The main thing wrong with this book is its age. It is a surprisingly easy to follow book. The JCE itself is daunting, but this book tames it with lots of code examples and an informal style. Consider this book an introduction to the JCE, not the final authority on high security. The end of the book degenerates into a bit of sales pitch for the authors employer, Verisign, showing you the Verisign way of doing business. The book, is inconsistent in its intended audience. For example, the S/MIME section seems aimed at the JCE for dummies crowd. Yet near the end of the book, the authors throw an alphabet soup of undefined terminology at you as if you were a roomful of Versign techies. abebooks anz abebooks.de amazon.de iberlibro.com amazon.es abebooks.fr amazon.fr abebooks.it amazon.it oreilly safari Applet Appletviewer ASN.1 BER blowfish BouncyCastle cacert.org: free certs in a web of trust cacerts. capabilities certificate vendors cryptography DER digital signatures Digitally Signing XML DSA DUNS number El Cheapo Certificate Authority Student Project email encryption fingerprint IE: Internet Explorer abebooks.co.uk amazon.co.uk abebooks.ca amazon.ca Chapters Indigo abebooks.com amazon.com Barnes&Noble powells.com sony e-books
mindprod.com/jgloss/certificate.html
9/11
10/7/2011
Install the Canadian Mind Products DSA code Signing Certificate installing certificates Installing/updating Root Certificates JaBaCats: lets you generate SSL certificates jar jarsigner.exe Java Plug-In JavaCA: lets you be an X.509 certificate authority javakey JCE JSSE keyman keystore KeyTool IUI: third party GUI version of keytool keytool.exe List of certificate authorities that Google Checkout supports MD5 Netscape OCSP PER Personal Bookshelf (Securing Java) PGP PKCS policy file policytool pvkimprt.exe: Authenticode certificate conversion RSA sandbox Security self-signed certificates SET SHA-1 signcode signed Applets signtool SSL student projects(Certificate viewer) Thawte timestamp Verisign viewing/editing certificates in Vista X-ca certificate management X.509 v3 You can get the freshest copy of this or possibly from your local J: drive (Java virtual drive/mindprod.com website mirror) page from: http://mindprod.com/jgloss/certificate.html J:\mindprod\jgloss\certificate.html Please email your feedback for publication, letters to the editor, errors, omissions, typos, formatting errors, ambiguities, unclear wording, broken/redirected link reports, suggestions to improve this page or comments to Roedy Green : considered for posting, please explicitly specify that. Canadian Mind Products view Blog mindprod.com IP:[65.110.21.43] Your face IP:[122.248.161.91] If you want your message kept confidential, not
mindprod.com/jgloss/certificate.html
10/11
10/7/2011
Feedback You are visitor number 187,676.
mindprod.com/jgloss/certificate.html
11/11