Java Secure Socket Extension 1.0

This document provides an overview of the components of the Java Secure Socket Extension API, which is a standard extension to the Java platform. It is not a tutorial; readers are expected to know the basics of socket programming in Java, and to be comfortable reading the JSSE API Reference pages.

Secure socket implementations will also include a variety of additional components, beyond these standard APIs. Components of note include implementations of cryptographic algorithms, secure key management including some notion of "login" to control access to private keys, using X.509 certificate chains to implement authentication policies, and tools to administer that X.509 authentication infrastructure. These extension APIs do not depend on how those functions are performed.

The Java Secure Socket Extension is a standard common api to security protocols similar to the Secure Sockets Layer (SSL) developed by Netscape Communications Corporation. Protocols supported by this API include SSL version 2 and 3, TLS version 1, and WTLS version 1. TLS, Transport Layer Security, is an Internet standard protocol derived from SSL version 3. WTLS is a derivative of TLS under development by the Wireless Application Protocol Forum for constrained wireless networking environments. The reference implementation for JSSE currently supports SSL version 3 and TLS version 1.

javax.net.ssl

This is a "high level" API, which does not provide full access to specialized features sometimes needed by secure applications. For example, controls over what private keys (and, equivalently, sessions) are used to authenticate with remote peers are not currently available through these APIs. A future revision will provide additional standard common APIs in these areas. In the meantime, this is configured in an implementation-specific manner.

There are five basic features in this high level API:

  1. SSLSockets and SSLServerSockets, used like any other sockets unless specific secure socket features are required.
  2. Socket factories, with which authentication contexts (holding private keys, certificate chains, and similar data) are associated. The constructors on secure sockets are not publicly accessible, so these APIs must be used to acquire them.
  3. Secure socket session capabilities, including authentication. Several connections can belong to the same session.
  4. A handshake completion event notification facility. When they wish to create a new session, perhaps one with a different quality of protection, applications can start a secure socket handshake. When that completes, they can be notified using the standard Java Beans event notification model.
  5. Additional exceptions which may be thrown. These are all subtypes of IOException since that is the exception which may be thrown during the I/O operations which produce the need to report such exceptions.

javax.net (not specific to secure sockets)

This includes basic socket and server socket factories. By using factories, rather than constructors, systems have policy hooks through which different kinds or configurations of sockets may easily be substituted.

This approach contrasts with the approach currently used inside the java.net package, where sockets are implemented using a class which mirrors the weakly typed C-Language UNIX "sockets" API, and only one "implementation factory" exists per Java Virtual Machine.

javax.security.cert (not specific to secure sockets)

This holds basic X.509 certificate support usable on Java platforms prior to Java 2. Conversion between these certificates and the java.security.cert certificates in Java 2 is trivial.

com.sun.net.ssl

This package holds classes for key and trust management and creation of secure socket factories that are provided with the Sun JSSE reference implementation but are not part of the JSSE 1.0 standard API. An overview is available here.

Additional API overview is available here.


java-security@java.sun.com