# Jigsaw
SSL configuration

Jigsaw Home / Documentation Overview

This is a two-step process. First the SSL certificates need to be created, and then the jigsaw server needs to be configured. One item not covered in this document is the importing of already existing certificates.

make sure that jdk 1.4 is being used

We are going to be using the SSL implementation from Sun. Mainly the keytool (http://java.sun.com/j2se/1.4/docs/tooldocs/solaris/keytool.html) is used to configure the SSL certificates. If keytool is not in your default PATH, you can find it in the "bin" directory of your JDK installation.

1. create a directory under jigsaw for the keystores
2. run the jdk's keytool to first generate the self signed certificate

   Example:

   `keytool -genkey -alias troi.example.com -keypass example -keystore /opt/jigsaw/dev/Jigsaw/keystore/troi.keystore -keyalg RSA`
3. run the keytool again to make a certificate request. This is what is sent to verisign or our own certificate authority. You can skip this if you want to sign it yourself.

   Example - specifying the output is put into a file:

   `keytool -certreq -alias troi.example.com -keypass example -keystore /opt/jigsaw/dev/Jigsaw/keystore/troi.keystore -file troi.csr`
   It will output something like:

             -----BEGIN NEW CERTIFICATE REQUEST-----
             MIICgTCCAj4CAQAwezELMAkGA1UEBhMCVVMxETAPBgAAAAgTCElsbGlub2lzMRYwFAYDVQQHEw1E
             b3duZXJzIEdyb3ZlMRAwDgYDVQQKEwdQZXJzZWNvMRkwFwYDVQQLExBCdXNpbmVzcyBTeXN0ZW1z
             MRQwEgYDVQQDEwtCcmlhbiBMYWlyZDCCAbgwggEsBgcqhkjOOAQBMIIBHwKBgQD9f1OBHXUSKVLf
             Spwu7OTn9hG3UjzvRADDHj+AtlEmaUVdQCJR+1k9jVj6v8X1ujD2y5tVbNeBO4AdNG/yZmC3a5lQ
             paSfn+gEexAiwk+7qdf+t8Yb+DtX58aophUPBPuD9tPFHsMCNVQTWhaRMvZ1864rYdcq7/IiAxmd
             0UgBxwIVAJdgUI8VIwvMspK5gqLrhAvwWBz1AoGBAPfhoIXWmz3ey7yrXDa4V7l5lK+7+jrqgvlX
             TAs9B4JnUVlXjrrUWU/mcQcQgYC0SRZxI+hMKBYTt88JMozIpuE8FnqLVHyNKOCjrh4rs6Z1kW6j
             fwv6ITVi8ftiegEkO8yk8b6oUZCJqIPf4VrlnwaSi2ZegHtVJWQBTDv+z0kqA4GFAAKBgQDc5Ki4
             7dX93se92yzYjxJIi99R9EZYHu4sNUH9obMQYO7o5u/3AOkxzqHLx60wWbf9JoCAlMe8q2i28NNC
             hjsN6LN7V0fgA05k/CzM9pMxbgeA0dqwQrtroWkJnFyzzFLrxjv7Rrh5RDGV/+ZeR72ZpHwy1GOj
             yDB2Dz+NE98sgKAAMAsGByqGSM44BAMFAAMwADAtAhRumfMg6P1KJmstMYga74KxaPLBfgIVAIwB
             bVanNqQb898bqHBkRybHIFqW
             -----END NEW CERTIFICATE REQUEST-----

   now we will import the response from the certificate authority.

   `keytool -import -alias sis.example.com -keystore sis.keystore -file sis.cer -keyalg RSA -trustcacerts`

   ans skip the next point (related to self-signature)

4. If you want to self-sign the certificate, you may proceed like this: Example:
   `keytool -selfcert -alias troi.example.com -keystore /opt/jigsaw/dev/Jigsaw/keystore/troi.keystore -keyalg RSA`
5. create a new configuration file called https-XXXXX.props where the XXXXX is the outside service (ex: enter.example.com). You can copy the default http- server.props to get started
6. edit the https-XXXXX.props file and add the following entries:

             #Explicitly enables general SSL support
             org.w3c.jigsaw.ssl.enabled=true
             # Points to the key store (cf. 4. above, don't forget to put the full path to the keystore)
             org.w3c.jigsaw.ssl.keystore.path=
             # Supplies the key store access password
             org.w3c.jigsaw.ssl.keystore.password=
             #Finally, the socket client factory has to be set to the SSL factory:
             org.w3c.jigsaw.http.ClientFactory=org.w3c.jigsaw.https.socket.SSLSocket
             ClientFactory

   Of course you may change the default port to use the default one for SSL: 443 (or any other you like and not yet used)

   You should also change the propfile value to match the name of your configuration file.

7. edit the server.props to use the new configuration file and add the following when creating the new server configuration

   Example - note the piece in bold. That lets jigsaw know which listener daemon to start:

   `https-server.org.w3c.jigsaw.daemon.class=org.w3c.jigsaw.https.httpsd`

This should cover the setup requirements. You should be able to start jigsaw and see something like the following when the start up occurs:

`Jigsaw[2.2.2]/SSL[1.0.2]: serving at http://troi:8002/`