C H A P T E R  12

Configuring the RI

This chapter describes the options used to configure a custom RI. This chapter is useful only if you have a source release of the development kit. For real cards, there are a few items such as Protection Domains and Certificates that must be setup at manufacturing time. The RI provides a means of configuring some factory settings by using the config.properties file under the lib folder.

This chapter contains the following sections:


Configuring Authenticators

In the lib\config.properties file, the following properties must be added to add an authenticator:

The following items describe the contents of the preceding list of properties:


Creating Custom Protection Domains

The Java Card 3 platform RI assigns a protection domain to an application based on the certificate used to sign the application bundle with the Packager tool. In the lib\config.properties file the following properties must be added to add a new protection domain:

The following items describe the contents of the preceding list of properties:

Creating a Custom Keystore

A custom keystore can be crested by using the keytool command to generate the certificates and private keys. The keytool command runs in batch mode without prompting for input values.

Enter the following keytool command and options on the command line:

keytool -genkey -alias alias -keyalg RSA
keytool -selfcert -alias alias
keytool -list -rfc
java DumpPrivateKey

This is how the PolicyManager.java certificate and key were generated.

For scripting, use the following keytool command:

keytool -keystore keystore -storepass keystore-password \
	-alias alias -keypass alias-password -genkey \
	-keyalg RSA -dname "cn=X, ou=U, o=O, c=US"


Configuring SSL Support

An SSL implementation requires four algorithms:



Note - It is beyond the scope of this document to fully describe SSL configuration and setup. There are many excellent books on this subject, and we direct advanced users to this literature.


Adding SSL Support

The Java Card 3 platform implements the SSL key establishment algorithm through the use of the following set of certificates and keys as key=value pairs in lib\config.properties. In the file lib\config.properties, the following properties must be added to add SSL support:

Custom Certificates and Keys

Custom implementations require that the developer generate corresponding custom certificates and keys. The certificates and keys are used by the Card Manager to verify the digital signature of a WAR file and are used in SSL and HTTPS transactions.


procedure icon  Generating an SSL Certificate

1. Generate a server key and certificate signing request (csr):

openssl genrsa -out s.key 1024

openssl req -new -key s.key -out server.csr

2. Generate a CA key and self-signed certificate:

openssl genrsa -out ca.key 1024

openssl -req new -x509 -days 365 -key ca.key -out ca.crt

3. Sign the csr and create the certificate:

sign.sh server.csr