SOA Specs Visualized
In a previous blog post, I listed a number of SOA Specs and Security Specs that I thought were important to be familiar with when working with DataPower and other SOA technologies. In this post, I made a quick (and dirty) Visio diagram that I tend to draw up on a whiteboard when I’m at a new client…
Symmetric Keys—Addendum
A couple of weeks ago I wrote a brief post about how to generate symmetric keys that can be used with DataPower. It demonstrates how to generate shared keys of various lengths using the Unix dd command. Today, someone asked how a shared key (or symmetric key) can be generated using the openssl…
SSL Handshake—The Visual
This is an old picture that I made for a 2010 JBoss World security presentation. It came in handy not so long ago when I was explaining the SSL Handshake to someone.
Protocol Transformations
Previously, I wrote a Wire Protocols post that outlined the common protocols that I’ve encountered when working with ESBs and SOA technology-especially DataPower. A primary function of an ESB is to provide the ability to convert service requests between these different protocols in a mostly…
Generating and Uploading a Shared Key (Symmetric Key) to DataPower Appliances
DataPower does not seem to provide a tool to generate a Shared Key that can be used with 3DES or AES algorithms. DataPower does provide a tool for generating X509 private keys, certificate requests, and self-signed certificates-in the Crypto Tools section-but we are concerned with Shared Keys…
JBossWorld 2010 Session — Securing JBoss Services
On June 24, 2010, I gave a presentation at JBoss World in Boston. This was my second time at JBoss World. The presentation covered Securing JBoss Services. It explored the use of JaasSecurityDomain MBeans to configure SSL in JBoss 4.3 (also relevent for newer versions of JBoss) for various…
Part 2: Custom Client-Server Java Application That CommunicatesOver A Mutually Authenticated SSL (MASSL) Connection
This is the second of a two-part series discussing Java and Mutually Authenticated SSL. This will gave you a taste of how a J2EE container is communicating (over SSL or MASSL) behind the scenes.
Part 1: Creating your own SSL certificates for a custom Java client-server application
If you replace the steps for creating your own CA private key & certificate and signing your own certificate (with the CA) with having certificates signed by a legitimate Certificate Authority, you've got the basic idea behind creating/ordering certs for most situations.