Solutions in this chapter:

• Configuring JSSE

• Using HTTPS URL Handlers

• Using SocketFactories

• Using Secure Server Sockets

• Using Secure Client Sockets

• Using JSSE Applications with WSDP

Introduction

The Java Secure Sockets Extension (JSSE) is an odd addition to the Web Services Developer Pack; it was added on somewhat late, and was made available as a Java platform extension. However, JSSE is a standard component of J2SE as of version 1.4. So you only need to include JSSE in an environment that uses a JVM release prior to 1.4 provided that the version is 1.2.1 or later.

JSSE provides a standard mechanism for establishing secure communication among TCP/IP sockets. It supports the Secure Socket Layer (SSL) and Transport Layer Security (TLS) security protocols. JSSE is designed to provide a standard, royalty-free implementation of these protocols for commercial applications.

What is interesting about JSSE is its approach: JSSE introduces the concept of a socket factory (and a server socket factory). Socket factories are helper classes that return socket instances; the socket instances in turn depend upon the socket factory used. The default socket factory, for example, returns insecure sockets; the default SSLFactory returns SSLSockets. Using SSLSocket automatically handles the handshaking required by the SSL protocol.

The user subsequently has to update the code to use socket factories instead of creating sockets directly. Once this is done, the application is ready for secure communication.

The use of SSL for transferring secure content over a network entails the use of...