Path: csiph.com!eternal-september.org!feeder.eternal-september.org!news.eternal-september.org!.POSTED!not-for-mail
From: Andreas Leitgeb <avl@logic.at>
Newsgroups: comp.lang.java.programmer
Subject: Corba with SSL - what do I need for that?
Date: Mon, 19 Jun 2017 15:47:14 -0000 (UTC)
Organization: A noiseless patient Spider
Lines: 38
Message-ID: <slrnokfsmu.o2q.avl@logic.at>
Reply-To: avl@logic.at
Injection-Date: Mon, 19 Jun 2017 15:47:14 -0000 (UTC)
Injection-Info: mx02.eternal-september.org; posting-host="1d8bda2c0be9597693fd4ed138b9042f"; logging-data="23405"; mail-complaints-to="abuse@eternal-september.org";	posting-account="U2FsdGVkX19d/OB97q7dKdCAOipdYBYM"
User-Agent: slrn/1.0.2 (Linux)
Cancel-Lock: sha1:Ob6iOmwZELesPluKIWAe08MYmaY=
Xref: csiph.com comp.lang.java.programmer:36676

My Java WebStart application uses Corba (Java's included ORB) to communicate
with a Server written in C++ and using TAO.  I need to get it working with 
secure connections. Only server side has certificates, client hasn't.

I think I've got the server side functional. It produces an IOR file,
that the client fetches over https, and that contains the block of lines:
      The component <3> ID is 2020 (TAG_SSL_SEC_TRANS)
            port = 50004
            target_supports = 0xa6
                Integrity
                Confidentiality
                EstablishTrustInTarget
                NoDelegation
            target_requires = 0x86
                Integrity
                Confidentiality
                NoDelegation
in "tao_catior"s dump of that IOR file.

The so-far-unchanged webstart application still tries to talk plain IIOP
to the server (as seen with wireshark), which the server correctly rejects.

I think there are three possible reasons, why client still tries plain iiop:

  1.) I have yet to set some properties for the ORB to enable SSL on client
        side. (I've so far seen that there exists a class 
          javax.rmi.ssl.SslRMIClientSocketFactory
        but haven't yet found any properties to set to that name.

  2.) Java's included ORB just doesn't really support SSL - I may need
        to switch to use JacORB.

  3.) My assumption that the server side is working correctly may be wrong.

If (based on your own experience and/or on my provided data) you can
rule out or point to one of them, or add other plausible reasons,
I'd appreciate very much.