C H A P T E R 12 |
Configuring the RI |
This chapter describes the options used to configure a custom RI. This chapter is useful only if you have a source release of the development kit. For real cards, there are a few items such as Protection Domains and Certificates that must be setup at manufacturing time. The RI provides a means of configuring some factory settings by using the config.properties file under the lib folder.
This chapter contains the following sections:
In the lib\config.properties file, the following properties must be added to add an authenticator:
The following items describe the contents of the preceding list of properties:
The Java Card 3 platform RI assigns a protection domain to an application based on the certificate used to sign the application bundle with the Packager tool. In the lib\config.properties file the following properties must be added to add a new protection domain:
The following items describe the contents of the preceding list of properties:
A custom keystore can be crested by using the keytool command to generate the certificates and private keys. The keytool command runs in batch mode without prompting for input values.
Enter the following keytool command and options on the command line:
keytool -genkey -alias alias -keyalg RSA keytool -selfcert -alias alias keytool -list -rfc java DumpPrivateKey
This is how the PolicyManager.java certificate and key were generated.
For scripting, use the following keytool command:
keytool -keystore keystore -storepass keystore-password \ -alias alias -keypass alias-password -genkey \ -keyalg RSA -dname "cn=X, ou=U, o=O, c=US"
An SSL implementation requires four algorithms:
Note - It is beyond the scope of this document to fully describe SSL configuration and setup. There are many excellent books on this subject, and we direct advanced users to this literature. |
The Java Card 3 platform implements the SSL key establishment algorithm through the use of the following set of certificates and keys as key=value pairs in lib\config.properties. In the file lib\config.properties, the following properties must be added to add SSL support:
Custom implementations require that the developer generate corresponding custom certificates and keys. The certificates and keys are used by the Card Manager to verify the digital signature of a WAR file and are used in SSL and HTTPS transactions.
1. Generate a server key and certificate signing request (csr):
openssl genrsa -out s.key 1024
openssl req -new -key s.key -out server.csr
2. Generate a CA key and self-signed certificate:
openssl genrsa -out ca.key 1024
openssl -req new -x509 -days 365 -key ca.key -out ca.crt
3. Sign the csr and create the certificate:
Copyright © 2009 Sun Microsystems, Inc. All rights reserved.