Java Secure Socket Extension 1.0
This document provides an overview of the components of the Java Secure
Socket Extension API, which is a standard extension to
the Java platform. It is not a tutorial; readers are expected to know
the basics of socket programming in Java, and to be comfortable reading
the JSSE API Reference pages.
Secure socket implementations will also include a variety of additional
components, beyond these standard APIs. Components of note include
implementations of cryptographic algorithms, secure key management
including some notion of "login" to control access to private keys,
using X.509 certificate chains to implement authentication policies, and
tools to administer that X.509 authentication infrastructure. These
extension APIs do not depend on how those functions are performed.
The Java Secure Socket Extension is a standard common api
to security protocols similar to the Secure Sockets Layer (SSL) developed
by Netscape Communications Corporation. Protocols supported by this
API include SSL version 2 and 3, TLS version 1, and WTLS version 1. TLS,
Transport Layer Security, is an Internet standard protocol derived
from SSL version 3. WTLS is a derivative of TLS under development
by the Wireless Application Protocol Forum for constrained wireless
networking environments. The reference implementation for JSSE
currently supports SSL version 3 and TLS version 1.
javax.net.ssl
This is a "high level" API, which does not provide full access to
specialized features sometimes needed by secure applications. For example,
controls over what private keys (and, equivalently, sessions)
are used to authenticate with remote peers are not currently available
through these APIs. A future revision will provide additional standard
common APIs in these areas. In the meantime, this is configured in
an implementation-specific manner.
There are five basic features in this high level API:
- SSLSockets and SSLServerSockets, used like any other sockets
unless specific secure socket features are required.
- Socket factories, with which authentication contexts (holding
private keys, certificate chains, and similar data) are associated.
The constructors on secure sockets are not publicly accessible, so
these APIs must be used to acquire them.
- Secure socket session capabilities, including authentication.
Several connections can belong to the same session.
- A handshake completion event notification facility. When
they wish to create a new session, perhaps one with a different
quality of protection, applications can start a secure socket handshake.
When that completes, they can be notified using the standard
Java Beans event notification model.
- Additional exceptions which may be thrown. These are all
subtypes of
IOException
since that is the exception
which may be thrown during the I/O operations which produce the
need to report such exceptions.
javax.net
(not specific to secure sockets)
This includes basic socket and server socket factories. By using
factories, rather than constructors, systems have policy hooks
through which different kinds or configurations of sockets may easily
be substituted.
This approach contrasts with the approach currently used inside
the java.net package, where sockets are implemented using a class which
mirrors the weakly typed C-Language UNIX "sockets" API, and only one
"implementation factory" exists per Java Virtual Machine.
javax.security.cert
(not specific to secure sockets)
This holds basic X.509 certificate support usable on Java platforms
prior to Java 2. Conversion between these certificates and the
java.security.cert
certificates in Java 2 is trivial.
com.sun.net.ssl
This package holds classes for key and trust management and creation
of secure socket factories that are provided with the Sun JSSE
reference implementation but are not part of the JSSE 1.0 standard API.
An overview is available here.
Additional API overview is available here.
java-security@java.sun.com