SSL certificate compatibility list

anselme

Hi,

When deploying LightStreamer as an SSL service, are there any specific issues to take care of, and more precisely, are there any SSL certificate compatibility issues?

E.g. our experience with GoDaddy certificates is that they are a bit tricky to install even on standard Apache web servers, hence we suspect that there might be some obstacles in conjunction with LightStreamer. What's your experience?

Thanks!

Alessandro Alinone

Hi,

No special issues exist in generating SSL certificates for Lightstreamer.

Just use "keytool" (part of Java JDK) to generate your certificate and submit it to your favorite CA for certification.

For more information, see "SSL Certificates.pdf" inside the Lightstreamer distribution.

colmfield

What about where we don't have control over the issuing of reqs to CAs, as in a large company where cert reqs all go through a specific dept?

I have had certs issued for me, so I have the .pfx and .cer files, but when I try to use them in a keystore (using keytool), I get an exception: javax.net.ssl.SSLHandshakeException: no cipher suites in common.

Is it possible to convert a .cer file into a Java keystore or do I need to have generated the request using the same alias etc.?

Alessandro Alinone

The certificate should be in a format compatible with Java Secure Socket Extension (JSSE).

The easiest way to create it is via the keytool application, as explained in the "SSL Certificates.pdf" document.

The possibility to convert other certificate formats into a Java compatible one should be investigated on a case-by-case basis.

Hope that helps

colmfield

Thanks for the reply.

I ended up using Keystore Explorer to import the Private Key and create a new keystore. Easy in the end!

http://www.lazgosoftware.com/kse/index.html

Alessandro Alinone

That's a good tip!

Thanks

edulib

If you want to replace keytool with a GUI tool then you can also use CERTivity.
http://www.edulib.com/products/keystores-manager/

It can handle different types of keystores (JKS, JCEKS, PKCS12, BKS, UBER, Windows) and digital signatures.