Thread: [Simpleweb-Support] SSL client certificate request: Safari 5 problem?

Brought to you by: niallg

simpleweb-support

[Simpleweb-Support] SSL client certificate request: Safari 5 problem?

From: Andrew B. <and...@sd...> - 2010-07-08 08:14:48

Niall and Fabio kindly sent me links to example code for delivering web content over SSL, see http://sourceforge.net/mailarchive/forum.php?thread_name=AANLkTilp2LqrCGMJ5Io6hxFOJMLZqIYGNutDmYslm-gP%40mail.gmail.com&forum_name=simpleweb-support.

As I need to use an existing signed certificate inside a Java keystore I've adopted/adapted Fabio's example which reads from the keystore file.

I have set the SSLContext to "TLS".

I've tested against a keystore containing a bona-fide signed certificate issued by Thawte and all is well across a range of browsers: Internet Explorer on Windows and Firefox, Opera, Chrome on Windows and Mac.

However on Safari 5 (but NOT 4) on the Mac I encounter a message asking for a client certificate, see screenshot:

Upon selecting a certificate (doesn't matter which), Safari then gives a message:

"Safari can’t open the page “xxxx” because Safari can’t establish a secure connection to the server “xxxx”.

On Windows behaviour is slightly different, Safari 5 simply displays the message without prompting for client certificate.

As this works fine with other browsers, including earlier version of Safari could this be an Safari 5 issue that needs to be addressed by Apple?

Andy Barlow - Chief Technology Officer - MBCS CENG EURING CITP

e: and...@sd...
t: +44 (0)7830 302 268

The information in this email or facsimile is confidential and is intended solely for the addressee(s) and access to this email or facsimile by anyone else is unauthorised. If you are not the intended recipient then any disclosure, copying, distribution or any action taken or omitted to be taken in reliance on it, is prohibited and may be unlawful. Information expressed in this email or facsimile is not given or endorsed by my firm or employer unless otherwise indicated by an authorised representative independent of this message.

Re: [Simpleweb-Support] SSL client certificate request: Safari 5 problem?

From: Bruno H. <Bru...@ma...> - 2010-07-08 22:58:00

Hi,

SimpleWeb always requests (but doesn't require) a client certificate 
during the SSL handshake.

Safari's client-certificate mechanism was broken (it wouldn't prompt 
when it should have) so that's probably why the message didn't appear in 
version 4. I guess this has been fixed in Safari 5 (but I haven't tried).

For the certificate to be accepted, it would need to be verifiable by 
the server, so its emitter (or something higher up in the chain) should 
be in the server's trust store.

If you're not really using client-certificate authentication and seeing 
this only as a side-effect of SimpleWeb requesting a client certificate 
by default (I think it's hard-coded in fact), I'd suggest clicking on 
Cancel rather than choosing a certificate. This shouldn't send a 
client-cert and thus the server wouldn't have to verify it.

Best wishes,

Bruno.

On 08/07/2010 10:14, Andrew Barlow wrote:
> Niall and Fabio kindly sent me links to example code for delivering web
> content over SSL, see
> http://sourceforge.net/mailarchive/forum.php?thread_name=AANLkTilp2LqrCGMJ5Io6hxFOJMLZqIYGNutDmYslm-gP%40mail.gmail.com&forum_name=simpleweb-support
> <http://sourceforge.net/mailarchive/forum.php?thread_name=AANLkTilp2LqrCGMJ5Io6hxFOJMLZqIYGNutDmYslm-gP%40mail.gmail.com&forum_name=simpleweb-support>.
>
> As I need to use an existing signed certificate inside a Java keystore
> I've adopted/adapted Fabio's example which reads from the keystore file.
>
> I have set the SSLContext to "TLS".
>
> I've tested against a keystore containing a bona-fide signed certificate
> issued by Thawte and all is well across a range of browsers: Internet
> Explorer on Windows and Firefox, Opera, Chrome on Windows and Mac.
>
> However on Safari 5 (but NOT 4) on the Mac I encounter a message asking
> for a client certificate, see screenshot:
>
>
> Upon selecting a certificate (doesn't matter which), Safari then gives a
> message:
>
> "Safari can’t open the page “xxxx” because Safari can’t establish a
> secure connection to the server “xxxx”.
>
> On Windows behaviour is slightly different, Safari 5 simply displays the
> message without prompting for client certificate.
>
> As this works fine with other browsers, including earlier version of
> Safari could this be an Safari 5 issue that needs to be addressed by Apple?
>
> Andy Barlow - Chief Technology Officer - MBCS CENG EURING CITP
>
> e: and...@sd... <mailto:and...@sd...>
> t: +44 (0)7830 302 268

Re: [Simpleweb-Support] SSL client certificate request: Safari 5 problem?

From: <nia...@rb...> - 2010-07-09 09:06:55

Hi,

Currently this is hardcoded in the handshake as setWantClientAuth, it should really be configurable. I will add better configuration options in the next release. You can override this in a hacky kind of way. To do this you would need to wrap the SSLEngine for the org.simpleframework.transport.Socket in your own SSLEngine like so.

public class MySSLEngineWrapper extends SSLEngine {
   private final SSLEngine realEngine;
   // .. add proxy methods that delegate to the realEngine here
   public void setWantClientAuth(boolean value) {
      realEngine.setWantClientAuth(false); // here wa set false always because we do not want auth
   }
}

This should work, but its a bit ugly.

Niall

Niall Gallagher
RBS Global Banking & Markets
Office: +44 2070851454



________________________________
From: Andrew Barlow [mailto:and...@sd...]
Sent: 09 July 2010 08:53
To: Bruno Harbulot
Cc: GALLAGHER, Niall, GBM
Subject: Re: [Simpleweb-Support] SSL client certificate request: Safari 5 problem?

Thanks Bruno

I don't need to authenticate the client certificate.

Do you know of any way to switch this off in Simple?

AndyB

On 8 Jul 2010, at 23:57, Bruno Harbulot wrote:

Hi,

SimpleWeb always requests (but doesn't require) a client certificate during the SSL handshake.

Safari's client-certificate mechanism was broken (it wouldn't prompt when it should have) so that's probably why the message didn't appear in version 4. I guess this has been fixed in Safari 5 (but I haven't tried).

For the certificate to be accepted, it would need to be verifiable by the server, so its emitter (or something higher up in the chain) should be in the server's trust store.

If you're not really using client-certificate authentication and seeing this only as a side-effect of SimpleWeb requesting a client certificate by default (I think it's hard-coded in fact), I'd suggest clicking on Cancel rather than choosing a certificate. This shouldn't send a client-cert and thus the server wouldn't have to verify it.


Best wishes,

Bruno.



On 08/07/2010 10:14, Andrew Barlow wrote:
Niall and Fabio kindly sent me links to example code for delivering web
content over SSL, see
http://sourceforge.net/mailarchive/forum.php?thread_name=AANLkTilp2LqrCGMJ5Io6hxFOJMLZqIYGNutDmYslm-gP%40mail.gmail.com&forum_name=simpleweb-support
<http://sourceforge.net/mailarchive/forum.php?thread_name=AANLkTilp2LqrCGMJ5Io6hxFOJMLZqIYGNutDmYslm-gP%40mail.gmail.com&forum_name=simpleweb-support>.

As I need to use an existing signed certificate inside a Java keystore
I've adopted/adapted Fabio's example which reads from the keystore file.

I have set the SSLContext to "TLS".

I've tested against a keystore containing a bona-fide signed certificate
issued by Thawte and all is well across a range of browsers: Internet
Explorer on Windows and Firefox, Opera, Chrome on Windows and Mac.

However on Safari 5 (but NOT 4) on the Mac I encounter a message asking
for a client certificate, see screenshot:


Upon selecting a certificate (doesn't matter which), Safari then gives a
message:

"Safari can't open the page "xxxx" because Safari can't establish a
secure connection to the server "xxxx".

On Windows behaviour is slightly different, Safari 5 simply displays the
message without prompting for client certificate.

As this works fine with other browsers, including earlier version of
Safari could this be an Safari 5 issue that needs to be addressed by Apple?

Andy Barlow - Chief Technology Officer - MBCS CENG EURING CITP

e: and...@sd...<mailto:and...@sd...> <mailto:and...@sd...>
t: +44 (0)7830 302 268

Andy Barlow - Chief Technology Officer - MBCS CENG EURING CITP

e: and...@sd...<mailto:and...@sd...>
t: +44 (0)7830 302 268

The information in this email or facsimile is confidential and is intended solely for the addressee(s) and access to this email or facsimile by anyone else is unauthorised. If you are not the intended recipient then any disclosure, copying, distribution or any action taken or omitted to be taken in reliance on it, is prohibited and may be unlawful. Information expressed in this email or facsimile is not given or endorsed by my firm or employer unless otherwise indicated by an authorised representative independent of this message.


***********************************************************************************
The Royal Bank of Scotland plc. Registered in Scotland No 90312. 
Registered Office: 36 St Andrew Square, Edinburgh EH2 2YB. 
Authorised and regulated by the Financial Services Authority. The
Royal Bank of Scotland N.V. is authorised and regulated by the 
De Nederlandsche Bank and has its seat at Amsterdam, the 
Netherlands, and is registered in the Commercial Register under 
number 33002587. Registered Office: Gustav Mahlerlaan 10, 
Amsterdam, The Netherlands. The Royal Bank of Scotland N.V. and 
The Royal Bank of Scotland plc are authorised to act as agent for each 
other in certain jurisdictions.
 
This e-mail message is confidential and for use by the addressee only.
If the message is received by anyone other than the addressee, please 
return the message to the sender by replying to it and then delete the 
message from your computer. Internet e-mails are not necessarily 
secure. The Royal Bank of Scotland plc and The Royal Bank of Scotland 
N.V. including its affiliates ("RBS group") does not accept responsibility 
for changes made to this message after it was sent. 

Whilst all reasonable care has been taken to avoid the transmission of 
viruses, it is the responsibility of the recipient to ensure that the onward
transmission, opening or use of this message and any attachments will 
not adversely affect its systems or data. No responsibility is accepted 
by the RBS group in this regard and the recipient should carry out such 
virus and other checks as it considers appropriate. 

Visit our website at www.rbs.com

***********************************************************************************

Re: [Simpleweb-Support] SSL client certificate request: Safari 5 problem?

From: <nia...@rb...> - 2010-07-13 10:37:03

Hi,

I am removing this from the Handshake as it is not required, in future implementations wanting client authentication will have to intercept the SSLEngine in the transport layer to set the value. This allows for customization without forcing the client to ask for the certificate. This should be released this week some time.

Niall  

-----Original Message-----
From: Bruno Harbulot [mailto:Bru...@ma...] 
Sent: 09 July 2010 10:05
To: Andrew Barlow
Cc: GALLAGHER, Niall, GBM
Subject: Re: [Simpleweb-Support] SSL client certificate request: Safari 5 problem?

Hi,

setWantClientAuth(true) is hard-coded in org.simpleframework.transport.Handshake (run() method): 
http://www.simpleframework.org/doc/source/org.simpleframework.transport.Handshake.html

There would need to be a way to pass a parameter there, I'm not sure how.

Best wishes,

Bruno.

On 09/07/2010 09:52, Andrew Barlow wrote:
> Thanks Bruno
>
> I don't need to authenticate the client certificate.
>
> Do you know of any way to switch this off in Simple?
>
> AndyB
>
> On 8 Jul 2010, at 23:57, Bruno Harbulot wrote:
>
>> Hi,
>>
>> SimpleWeb always requests (but doesn't require) a client certificate 
>> during the SSL handshake.
>>
>> Safari's client-certificate mechanism was broken (it wouldn't prompt 
>> when it should have) so that's probably why the message didn't appear 
>> in version 4. I guess this has been fixed in Safari 5 (but I haven't 
>> tried).
>>
>> For the certificate to be accepted, it would need to be verifiable by 
>> the server, so its emitter (or something higher up in the chain) 
>> should be in the server's trust store.
>>
>> If you're not really using client-certificate authentication and 
>> seeing this only as a side-effect of SimpleWeb requesting a client 
>> certificate by default (I think it's hard-coded in fact), I'd suggest 
>> clicking on Cancel rather than choosing a certificate. This shouldn't 
>> send a client-cert and thus the server wouldn't have to verify it.
>>
>>
>> Best wishes,
>>
>> Bruno.
>>
>>
>>
>> On 08/07/2010 10:14, Andrew Barlow wrote:
>>> Niall and Fabio kindly sent me links to example code for delivering 
>>> web content over SSL, see 
>>> http://sourceforge.net/mailarchive/forum.php?thread_name=AANLkTilp2L
>>> qrCGMJ5Io6hxFOJMLZqIYGNutDmYslm-gP%40mail.gmail.com&forum_name=simpl
>>> eweb-support 
>>> <http://sourceforge.net/mailarchive/forum.php?thread_name=AANLkTilp2
>>> LqrCGMJ5Io6hxFOJMLZqIYGNutDmYslm-gP%40mail.gmail.com&forum_name=simp
>>> leweb-support> 
>>> <http://sourceforge.net/mailarchive/forum.php?thread_name=AANLkTilp2
>>> LqrCGMJ5Io6hxFOJMLZqIYGNutDmYslm-gP%40mail.gmail.com&forum_name=simp
>>> leweb-support 
>>> <http://sourceforge.net/mailarchive/forum.php?thread_name=AANLkTilp2LqrCGMJ5Io6hxFOJMLZqIYGNutDmYslm-gP%40mail.gmail.com&forum_name=simpleweb-support>>.
>>>
>>> As I need to use an existing signed certificate inside a Java 
>>> keystore I've adopted/adapted Fabio's example which reads from the keystore file.
>>>
>>> I have set the SSLContext to "TLS".
>>>
>>> I've tested against a keystore containing a bona-fide signed 
>>> certificate issued by Thawte and all is well across a range of 
>>> browsers: Internet Explorer on Windows and Firefox, Opera, Chrome on Windows and Mac.
>>>
>>> However on Safari 5 (but NOT 4) on the Mac I encounter a message 
>>> asking for a client certificate, see screenshot:
>>>
>>>
>>> Upon selecting a certificate (doesn't matter which), Safari then 
>>> gives a
>>> message:
>>>
>>> "Safari can't open the page "xxxx" because Safari can't establish a 
>>> secure connection to the server "xxxx".
>>>
>>> On Windows behaviour is slightly different, Safari 5 simply displays 
>>> the message without prompting for client certificate.
>>>
>>> As this works fine with other browsers, including earlier version of 
>>> Safari could this be an Safari 5 issue that needs to be addressed by 
>>> Apple?
>>>
>>> Andy Barlow - Chief Technology Officer - MBCS CENG EURING CITP
>>>
>>> e: and...@sd... 
>>> <mailto:and...@sd...>
>>> <mailto:and...@sd...>
>>> t: +44 (0)7830 302 268
>
> Andy Barlow - Chief Technology Officer - MBCS CENG EURING CITP
>
> e: and...@sd... <mailto:and...@sd...>
> t: +44 (0)7830 302 268
>
> /The information in this email or facsimile is confidential and is 
> intended solely for the addressee(s) and access to this email or 
> facsimile by anyone else is unauthorised. If you are not the intended 
> recipient then any disclosure, copying, distribution or any action 
> taken or omitted to be taken in reliance on it, is prohibited and may 
> be unlawful. Information expressed in this email or facsimile is not 
> given or endorsed by my firm or employer unless otherwise indicated by 
> an authorised representative independent of this message./
>

***********************************************************************************
The Royal Bank of Scotland plc. Registered in Scotland No 90312. 
Registered Office: 36 St Andrew Square, Edinburgh EH2 2YB. 
Authorised and regulated by the Financial Services Authority. The
Royal Bank of Scotland N.V. is authorised and regulated by the 
De Nederlandsche Bank and has its seat at Amsterdam, the 
Netherlands, and is registered in the Commercial Register under 
number 33002587. Registered Office: Gustav Mahlerlaan 10, 
Amsterdam, The Netherlands. The Royal Bank of Scotland N.V. and 
The Royal Bank of Scotland plc are authorised to act as agent for each 
other in certain jurisdictions.

This e-mail message is confidential and for use by the addressee only.
If the message is received by anyone other than the addressee, please 
return the message to the sender by replying to it and then delete the 
message from your computer. Internet e-mails are not necessarily 
secure. The Royal Bank of Scotland plc and The Royal Bank of Scotland 
N.V. including its affiliates ("RBS group") does not accept responsibility 
for changes made to this message after it was sent. 

Whilst all reasonable care has been taken to avoid the transmission of 
viruses, it is the responsibility of the recipient to ensure that the onward
transmission, opening or use of this message and any attachments will 
not adversely affect its systems or data. No responsibility is accepted 
by the RBS group in this regard and the recipient should carry out such 
virus and other checks as it considers appropriate. 

Visit our website at www.rbs.com

***********************************************************************************

Re: [Simpleweb-Support] SSL client certificate request: Safari 5 problem?

From: Niall G. <gal...@ya...> - 2010-07-26 19:48:15

Hi,

I have released 4.1.21 which fixes this issue by not requesting client authentication. If client authentication is needed it can be done just before the handshake begins by setting it on the SSLEngine associated with the org.simpleframework.transport.Socket.

Regards,
Niall

--- On Thu, 7/8/10, Andrew Barlow <and...@sd...> wrote:

From: Andrew Barlow <and...@sd...>
Subject: [Simpleweb-Support] SSL client certificate request: Safari 5 problem?
To: sim...@li...
Date: Thursday, July 8, 2010, 1:14 AM

Niall and Fabio kindly sent me links to example code for delivering web content over SSL, see http://sourceforge.net/mailarchive/forum.php?thread_name=AANLkTilp2LqrCGMJ5Io6hxFOJMLZqIYGNutDmYslm-gP%40mail.gmail.com&forum_name=simpleweb-support.
As  I need to use an existing signed certificate inside a Java keystore I've adopted/adapted Fabio's example which reads from the keystore file.
I have set the SSLContext to "TLS".
I've tested against a keystore containing a bona-fide signed certificate issued by Thawte and all is well across a range of browsers: Internet Explorer on Windows and Firefox, Opera, Chrome on Windows and Mac.
However on Safari 5 (but NOT 4) on the Mac I encounter a message asking for a client certificate, see screenshot:

Upon selecting a certificate (doesn't matter which), Safari then gives a message:
"Safari can’t open the page “xxxx” because Safari can’t establish a secure connection to the server “xxxx”.
On Windows behaviour is slightly different, Safari 5 simply displays the message without prompting for client certificate.
As this works fine with other browsers, including earlier version of Safari could this be an Safari 5 issue that needs to be addressed by Apple?
Andy Barlow - Chief Technology Officer - MBCS CENG EURING CITP 
e: and...@sd...: +44 (0)7830 302 268

The information in this email or facsimile is confidential and is intended solely for the addressee(s) and access to this email or facsimile by anyone else is unauthorised. If you are not the intended recipient then any disclosure, copying, distribution or any action taken or omitted to be taken in reliance on it, is prohibited and may be unlawful. Information expressed in this email or facsimile is not given or endorsed by my firm or employer unless otherwise indicated by an authorised representative independent of this message.



-----Inline Attachment Follows-----

------------------------------------------------------------------------------
This SF.net email is sponsored by Sprint
What will you do first with EVO, the first 4G phone?
Visit sprint.com/first -- http://p.sf.net/sfu/sprint-com-first
-----Inline Attachment Follows-----

_______________________________________________
Simpleweb-Support mailing list
Sim...@li...
https://lists.sourceforge.net/lists/listinfo/simpleweb-support

Re: [Simpleweb-Support] SSL client certificate request: Safari 5 problem?

From: Andrew B. <and...@sd...> - 2010-07-27 08:01:19

Thanks Niall - works like a charm on Safari 5 now...

AndyB
On 26 Jul 2010, at 20:48, Niall Gallagher wrote:

> Hi,
> 
> I have released 4.1.21 which fixes this issue by not requesting client authentication. If client authentication is needed it can be done just before the handshake begins by setting it on the SSLEngine associated with the org.simpleframework.transport.Socket.
> 
> Regards,
> Niall
> 
> --- On Thu, 7/8/10, Andrew Barlow <and...@sd...> wrote:
> 
> From: Andrew Barlow <and...@sd...>
> Subject: [Simpleweb-Support] SSL client certificate request: Safari 5 problem?
> To: sim...@li...
> Date: Thursday, July 8, 2010, 1:14 AM
> 
> Niall and Fabio kindly sent me links to example code for delivering web content over SSL, see http://sourceforge.net/mailarchive/forum.php?thread_name=AANLkTilp2LqrCGMJ5Io6hxFOJMLZqIYGNutDmYslm-gP%40mail.gmail.com&forum_name=simpleweb-support.
> 
> As  I need to use an existing signed certificate inside a Java keystore I've adopted/adapted Fabio's example which reads from the keystore file.
> 
> I have set the SSLContext to "TLS".
> 
> I've tested against a keystore containing a bona-fide signed certificate issued by Thawte and all is well across a range of browsers: Internet Explorer on Windows and Firefox, Opera, Chrome on Windows and Mac.
> 
> However on Safari 5 (but NOT 4) on the Mac I encounter a message asking for a client certificate, see screenshot:
> <clientcertificate.png>
> 
> 
> Upon selecting a certificate (doesn't matter which), Safari then gives a message:
> 
> "Safari can’t open the page “xxxx” because Safari can’t establish a secure connection to the server “xxxx”.
> 
> On Windows behaviour is slightly different, Safari 5 simply displays the message without prompting for client certificate.
> 
> As this works fine with other browsers, including earlier version of Safari could this be an Safari 5 issue that needs to be addressed by Apple?
> 
> Andy Barlow - Chief Technology Officer - MBCS CENG EURING CITP 
> 
> e: and...@sd...
> t: +44 (0)7830 302 268
> 
> The information in this email or facsimile is confidential and is intended solely for the addressee(s) and access to this email or facsimile by anyone else is unauthorised. If you are not the intended recipient then any disclosure, copying, distribution or any action taken or omitted to be taken in reliance on it, is prohibited and may be unlawful. Information expressed in this email or facsimile is not given or endorsed by my firm or employer unless otherwise indicated by an authorised representative independent of this message.
> 
> 
> -----Inline Attachment Follows-----
> 
> ------------------------------------------------------------------------------
> This SF.net email is sponsored by Sprint
> What will you do first with EVO, the first 4G phone?
> Visit sprint.com/first -- http://p.sf.net/sfu/sprint-com-first
> 
> -----Inline Attachment Follows-----
> 
> _______________________________________________
> Simpleweb-Support mailing list
> Sim...@li...
> https://lists.sourceforge.net/lists/listinfo/simpleweb-support
> 
> ------------------------------------------------------------------------------
> The Palm PDK Hot Apps Program offers developers who use the
> Plug-In Development Kit to bring their C/C++ apps to Palm for a share 
> of $1 Million in cash or HP Products. Visit us here for more details:
> http://ad.doubleclick.net/clk;226879339;13503038;l?
> http://clk.atdmt.com/CRS/go/247765532/direct/01/_______________________________________________
> Simpleweb-Support mailing list
> Sim...@li...
> https://lists.sourceforge.net/lists/listinfo/simpleweb-support

Andy Barlow - Chief Technology Officer - MBCS CENG EURING CITP 

e: and...@sd...
t: +44 (0)7830 302 268

The information in this email or facsimile is confidential and is intended solely for the addressee(s) and access to this email or facsimile by anyone else is unauthorised. If you are not the intended recipient then any disclosure, copying, distribution or any action taken or omitted to be taken in reliance on it, is prohibited and may be unlawful. Information expressed in this email or facsimile is not given or endorsed by my firm or employer unless otherwise indicated by an authorised representative independent of this message.

[Simpleweb-Support] Getting started with SSL

From: Brad M. <br...@br...> - 2010-08-02 02:46:50

Attachments: SslSimpletonServer.java

package com.ettrema.berry.simple;

import java.io.File;
import java.io.FileInputStream;
import java.io.IOException;
import java.io.PrintStream;
import java.net.InetSocketAddress;
import java.net.SocketAddress;
import java.security.KeyStore;

import javax.net.ssl.KeyManagerFactory;
import javax.net.ssl.SSLContext;

import org.simpleframework.http.Request;
import org.simpleframework.http.Response;
import org.simpleframework.http.core.Container;
import org.simpleframework.transport.connect.Connection;
import org.simpleframework.transport.connect.SocketConnection;
import org.slf4j.Logger;
import org.slf4j.LoggerFactory;

/**
 *
 * @author brad
 */
public class SimpleSSLHelloWorld implements Container{

    private static final Logger log = LoggerFactory.getLogger(SimpleSSLHelloWorld.class);

    public static int count = 0;

    public static String EMTPY_STRING = "";


    public static String KEYSTORE_PROPERTY = "javax.net.ssl.keyStore";

    public static String KEYSTORE_PASSWORD_PROPERTY = "javax.net.ssl.keyStorePassword";

    public static String KEYSTORE_TYPE_PROPERTY = "javax.net.ssl.keyStoreType";

    public static String KEYSTORE_ALIAS_PROPERTY = "javax.net.ssl.keyStoreAlias";

    public int serverPort = 443;

    private String keystore;

    private String password;

    public SimpleSSLHelloWorld(int serverPort, String keystore, String password) throws Exception {
        // System.setProperty("javax.net.debug", "all");
        setServerPort( serverPort );
        setKeystore( keystore );
        setPassword( password );

        SocketAddress address = new InetSocketAddress(serverPort);

        SSLContext sslContext = SimpleSSLHelloWorld.createSSLContext();

        SocketConnection connectionHttps = new SocketConnection(this);
        connectionHttps.connect(address, sslContext);

        System.out.println("Simple Server started on port: " + serverPort);
    }

    public int getServerPort() {
        return serverPort;
    }

    public void setServerPort( int serverPort ) {
        this.serverPort = serverPort;
    }


    public String getKeystore() {
        return keystore;
    }

    public void setKeystore( String keystore ) {
        this.keystore = keystore;
        System.setProperty(SimpleSSLHelloWorld.KEYSTORE_PROPERTY, keystore); //"C:\\keystores\\proxy.keystore");
    }

    public String getPassword() {
        return password;
    }

    public void setPassword( String password ) {
        this.password = password;
        System.setProperty(SimpleSSLHelloWorld.KEYSTORE_PASSWORD_PROPERTY, password); // "proxypasswd");
    }
        


    public void handle(final Request request, final Response response) {
        log.debug( "handle");
        try {
            SimpleSSLHelloWorld.logRequest(request);

            SimpleSSLHelloWorld.dummyResponse(response);

            SimpleSSLHelloWorld.logResponse(response);
        } catch (Exception e) {
            e.printStackTrace();
        }
    }

    public static SSLContext createSSLContext() throws Exception {
        log.debug( "createSSLContext");
        String keyStoreFile = System.getProperty(SimpleSSLHelloWorld.KEYSTORE_PROPERTY);
        String keyStorePassword = System.getProperty(SimpleSSLHelloWorld.KEYSTORE_PASSWORD_PROPERTY,
                SimpleSSLHelloWorld.EMTPY_STRING);
        String keyStoreType = System.getProperty(SimpleSSLHelloWorld.KEYSTORE_TYPE_PROPERTY, KeyStore.getDefaultType());

        KeyStore keyStore = SimpleSSLHelloWorld.loadKeyStore(keyStoreFile, keyStorePassword, null);
        FileInputStream keyStoreFileInpuStream = null;
        try {
            if (keyStoreFile != null) {
                keyStoreFileInpuStream = new FileInputStream(keyStoreFile);

                keyStore = KeyStore.getInstance(keyStoreType);
                keyStore.load(keyStoreFileInpuStream, keyStorePassword.toCharArray());
            }
        } finally {
            if (keyStoreFileInpuStream != null) {
                keyStoreFileInpuStream.close();
            }
        }

        KeyManagerFactory keyManagerFactory = KeyManagerFactory.getInstance(KeyManagerFactory.getDefaultAlgorithm());
        keyManagerFactory.init(keyStore, keyStorePassword.toCharArray());

        SSLContext sslContext = SSLContext.getInstance("SSL");
        // sslContext.init(keyManagerFactory.getKeyManagers(), new TrustManager[]{new NaiveX509TrustManager()}, null);
        sslContext.init(keyManagerFactory.getKeyManagers(), null, null);

        return sslContext;
    }

    public static KeyStore loadKeyStore(final String keyStoreFilePath, final String keyStorePassword,
            final String keyStoreType) throws Exception {
        KeyStore keyStore = null;
        File keyStoreFile = new File(keyStoreFilePath);

        if (keyStoreFile.isFile()) {
            keyStore = KeyStore.getInstance(keyStoreType != null ? keyStoreType : KeyStore.getDefaultType());
            keyStore.load(new FileInputStream(keyStoreFile), keyStorePassword != null ? keyStorePassword
                    .toCharArray() : SimpleSSLHelloWorld.EMTPY_STRING.toCharArray());
        }

        return keyStore;
    }

    public static void logRequest(final Request request) throws IOException {
        StringBuilder builder = new StringBuilder();

        builder.append(">>> REQUEST\n");
        builder.append(request);
        builder.append(request.getContent());

        System.out.println(builder);
    }

    public static void logResponse(final Response response) throws IOException {
        StringBuilder builder = new StringBuilder();

        builder.append("<<< RESPONSE\n");
        builder.append(response);

        if (response.getContentLength() > 0) {
            builder.append("... ").append(response.getContentLength()).append(" bytes ...\n");
        }

        System.out.println(builder);
    }

    public static void dummyResponse(final Response response) throws IOException {
        PrintStream body = response.getPrintStream();
        long time = System.currentTimeMillis();

        response.set("Content-Type", "text/plain");
        response.set("Server", "SSL HelloWorld/1.0 (Simple 4.0)");
        response.setDate("Date", time);
        response.setDate("Last-Modified", time);

        body.println("Hello World: " + ++SimpleSSLHelloWorld.count);
        body.close();
    }
}