Question

I can t understand general scheme using certificates. For example: I have account on the some website. I have name and password. What should I do to login to this site? - I should open _https://website:443/login and fill out fields, and if all is ok, I ll obtain admittance.

Now, I would like to perform these steps programmatically usin java + httpclient(apache). I ve written:

client = new DefaultHttpClient();

client.getParams().setParameter(ClientPNames.COOKIE_POLICY, 
                                CookiePolicy.BEST_MATCH);
client.setCookieStore(new BasicCookieStore());
client.getCredentialsProvider()
      .setCredentials(new AuthScope(ADDRESS, new Integer(PORT)),
                      new UsernamePasswordCredentials(USERNAME, USERPWD));

And I should create trustStore with server s certificate:

System.setProperty("javax.net.ssl.trustStore", "./KeyStore/myca");

where myca were made with InstallCert.java - Sun s product.

But I would like to perform all this steps programmatically, like Browser(FFox, or Opera) import server s certificate...User just want to use only my application, not a set of additional application.

How can I do perform it?

And now, the main problem: why do servers not require user s certificate? And how do I can use my own certificate to authenticate? (If I have user s certificate I will not need name password to login to server?)

Answer 1

why do servers not require user s certificate?

Servers do not require user certificates, because most users don t have one, don t now what it is and how to get one. And even if they would, such a certificate is either difficult or expensive to obtain, so many user won t get one.

So any server requiring a client certificate would reduce the number of users probably by a factor of 1000. Most server owners don t want that.

If I have user s certificate I will not need name password to login to server?

Depends on your requirements. Requiring a certificate + username/password would be considered a two factor authentication, which is a stronger form of protection, then just requiring one factor. It would get even stronger by asking for some kind of biometric identification.

How can I do perform it?

Perform exactly what? You are talking about doing things "programmatically", but you already present code ...?

And how do I can use my own certificate to authenticate?

This should be done in the configuration of your server. You need to setup a trust store containing the trustet root certificates + require client authenticatication in the ssl configuration. e.g search here for clientauth.

友情链接