In order to communicate with certain data sources, some sort of authentication and encryption may be needed. SSL is a technology that offers both types of security. It can for example be used to secure IMAP and HTTP communication.
We provide several classes that can help establish communication over SSL. These classes were inspired by code found in the Javamail package (see the SSLNOTES.TXT file) and the code for handling certificates as found in Java Webstart and the Java plugin.
More specifically, we provide a SSLSocketFactory implementation that uses a custom TrustManager implementation. This StandardTrustManager encapsulates the default TrustManager provided by the JRE for validating certificates using the JRE's root certificates and adds functionality to permanently accept or temporarily accept or deny unvalidatable certificates.
The classes reponsible for this functionality are summarized on the following diagram:
When a certificate cannot be validated by the default TrustManager and the StandardTrustManager does not already have the certificate in one of its certificates stores for denied or accepted certificates, than the decision is delegated to a TrustDecider and recorded afterwards in the appropriate certificate store of the StandardTrustManager.
The CertificateStore interface and it's implementations are used by StandardTrustManager. They enable the user to use multiple sources of certificate information in making trust decisions. These classes are presented on the following diagram:
As already said. If a Standard trust manager cannot make a decision, it delegates it to a TrustDecider. This interface is conceived as means to provide some interface for the user to make a decision by himself. Related classes are summarized on the following diagram.
An implementation of a TrustDecider is available for use in Swing-based GUI application. This TrustDecider follows a pattern commonly found in web browsers and mail readers, where the certificate is shown to the user using a dialog and the user is asked whether the certificate should be trusted and to what extent.
Clearly, this is only appropriate for Swing-based desktop applications. Therefore, other TrustDecider implementations can just as easily be made, e.g. for use in a server-based environment or using the SWT framework.
In order to see how this SSLSocketFactory needs to be setup, one can best take a look at the example code. The GUI-based ImapCrawler (specifically, the org.semanticdesktop.aperture.examples.imapcrawler.CrawlerFrame class) shows to install a custom SSLSocketFactory that uses the StandardTrustManager instead of the default TrustManager. This code also shows how to deal with various Java versions, as in Java 5 a better way to setup the SSLSocketFactory has become available.
These security classes have only been tested for IMAP communication. They may also work transparently for HTTPS, but I currently lack the knowledge to make that judgement and have also not tried it out yet.
