Hello,
is my answer helping you in any way?
Am I right to consider that ssl session caching (allowing clients to
resume sessions without handshake) is not supported in Glassfish v2.1?
On Tue, Jun 1, 2010 at 6:05 PM, Cyril DANGERVILLE
<cyril.dangerville_at_gmail.com> wrote:
> Hi,
> I am refering to the attribute ssl-cache-entries of element
> http-service, as described in Sun Glassfish Enterprise Server v3
> Domain File Format Reference (p. 71).
>
> regards
> --Cyril
>
> On Tue, Jun 1, 2010 at 11:21 AM, Oleksiy Stashok
> <Oleksiy.Stashok_at_sun.com> wrote:
>> Hi Cyril,
>>
>> which setting in Glassfish v3 you mean?
>>
>> Alexey.
>>
>> On Jun 1, 2010, at 2:13 , Cyril DANGERVILLE wrote:
>>
>>> Hello,
>>> Tell me if you need more information.
>>> Btw, I noticed there was specific settings for ssl caching in
>>> Glassfish v3 but I can't find these for v2.1. Unfortunately, I have to
>>> use v2.1.
>>> Any idea?
>>>
>>> Thanks.
>>> --Cyril
>>>
>>> On Sun, May 30, 2010 at 5:18 PM, Cyril DANGERVILLE
>>> <cyril.dangerville_at_gmail.com> wrote:
>>>>
>>>> Hello,
>>>> the https listener config in my domain.xml:
>>>>
>>>> <http-listener acceptor-threads="4" address="172.17.5.213"
>>>> blocking-enabled="false" default-virtual-server="server"
>>>> enabled="true" family="inet" id="http-listener-2" port="8181"
>>>> security-enabled="true" server-name="" xpowered-by="true">
>>>> <ssl cert-nickname="s1as" client-auth-enabled="false"
>>>> ssl2-enabled="false" ssl3-enabled="true" tls-enabled="true"
>>>> tls-rollback-enabled="true"/>
>>>> </http-listener>
>>>>
>>>> and the java-config:
>>>>
>>>> <java-config classpath-suffix="" debug-enabled="false"
>>>> debug-options="-Xdebug
>>>> -Xrunjdwp:transport=dt_socket,server=y,suspend=n,address=9009"
>>>> env-classpath-ignored="true" java-home="${com.sun.aas.javaRoot}"
>>>> javac-options="-g" rmic-options="-iiop -poa -alwaysgenerate
>>>> -keepgenerated -g" system-classpath="">
>>>> <!-- various required jvm-options -->
>>>> <jvm-options>-XX:MaxPermSize=192m</jvm-options>
>>>>
>>>> <jvm-options>-Djava.endorsed.dirs=${com.sun.aas.installRoot}/lib/endorsed</jvm-options>
>>>>
>>>> <jvm-options>-Djava.security.policy=${com.sun.aas.instanceRoot}/config/server.policy</jvm-options>
>>>>
>>>> <jvm-options>-Djava.security.auth.login.config=${com.sun.aas.instanceRoot}/config/login.conf</jvm-options>
>>>> <jvm-options>-Dsun.rmi.dgc.server.gcInterval=3600000</jvm-options>
>>>> <jvm-options>-Dsun.rmi.dgc.client.gcInterval=3600000</jvm-options>
>>>>
>>>> <jvm-options>-Djavax.net.ssl.keyStore=${com.sun.aas.instanceRoot}/config/keystore.jks</jvm-options>
>>>>
>>>> <jvm-options>-Djavax.net.ssl.trustStore=${com.sun.aas.instanceRoot}/config/cacerts.jks</jvm-options>
>>>>
>>>> <jvm-options>-Djava.ext.dirs=${com.sun.aas.javaRoot}/lib/ext${path.separator}${com.sun.aas.javaRoot}/jre/lib/ext${path.separator}${com.sun.aas.instanceRoot}/lib/ext${path.separator}${com.sun.aas.derbyRoot}/lib</jvm-options>
>>>>
>>>> <jvm-options>-Djdbc.drivers=org.apache.derby.jdbc.ClientDriver</jvm-options>
>>>>
>>>> <jvm-options>-Djavax.management.builder.initial=com.sun.enterprise.admin.server.core.jmx.AppServerMBeanServerBuilder</jvm-options>
>>>>
>>>> <jvm-options>-Dcom.sun.enterprise.config.config_environment_factory_class=com.sun.enterprise.config.serverbeans.AppserverConfigEnvironmentFactory</jvm-options>
>>>>
>>>> <jvm-options>-Dcom.sun.enterprise.taglibs=appserv-jstl.jar,jsf-impl.jar</jvm-options>
>>>>
>>>> <jvm-options>-Dcom.sun.enterprise.taglisteners=jsf-impl.jar</jvm-options>
>>>> <jvm-options>-XX:NewRatio=2</jvm-options>
>>>> <!--
>>>> Use the following jvm-options element to disable the quick startup:
>>>> com.sun.enterprise.server.ss.ASQuickStartup=false
>>>> -->
>>>>
>>>> <jvm-options>-Dcom.sun.enterprise.server.ss.ASQuickStartup=false</jvm-options>
>>>> <jvm-options>-XX:+UseParallelGC</jvm-options>
>>>> <jvm-options>-XX:+UseParallelOldGC</jvm-options>
>>>> <jvm-options>-XX:LargePageSizeInBytes=2m</jvm-options>
>>>>
>>>> <jvm-options>-XX:ParallelGCThreads=${JVM_PARALLEL_GC_THREADS}</jvm-options>
>>>> <jvm-options>-Xmn1200m</jvm-options>
>>>> <jvm-options>-Xms2500m</jvm-options>
>>>> <jvm-options>-Xmx2500m</jvm-options>
>>>> <jvm-options>-server</jvm-options>
>>>> </java-config>
>>>>
>>>> Hope it helps.
>>>>
>>>> Thanks.
>>>> Cyril
>>>>
>>>> On Sun, May 30, 2010 at 2:10 AM, Martin Gainty <mgainty_at_hotmail.com>
>>>> wrote:
>>>>>
>>>>> What does your SSL connection look like in domain.xml?..here is mine for
>>>>> reference
>>>>>
>>>>> <http-listener acceptor-threads="1" address="0.0.0.0"
>>>>> blocking-enabled="false" default-virtual-server="server" enabled="true"
>>>>> family="inet" id="http-listener-2" port="9181" security-enabled="true"
>>>>> server-name="" xpowered-by="true">
>>>>> <ssl cert-nickname="s1as" client-auth-enabled="false"
>>>>> ssl2-enabled="false" ssl3-enabled="true" tls-enabled="true"
>>>>> tls-rollback-enabled="true"/>
>>>>> </http-listener>
>>>>>
>>>>> you will also need to configure javax.net.ssl.keyStore and
>>>>> javax.net.ssl.trustStore parameters as seen here
>>>>> <java-config classpath-suffix="" debug-enabled="false"
>>>>> debug-options="-Xdebug
>>>>> -Xrunjdwp:transport=dt_socket,server=y,suspend=n,address=9009"
>>>>> env-classpath-ignored="true" java-home="${com.sun.aas.javaRoot}"
>>>>> javac-options="-g" rmic-options="-iiop -poa -alwaysgenerate
>>>>> -keepgenerated
>>>>> -g" system-classpath="">
>>>>> <!-- various required jvm-options -->
>>>>> <jvm-options>-XX:MaxPermSize=192m</jvm-options>
>>>>> <jvm-options>-client</jvm-options>
>>>>>
>>>>>
>>>>> <jvm-options>-Djava.endorsed.dirs=${com.sun.aas.installRoot}/lib/endorsed</jvm-options>
>>>>>
>>>>>
>>>>> <jvm-options>-Djava.security.policy=${com.sun.aas.instanceRoot}/config/server.policy</jvm-options>
>>>>>
>>>>>
>>>>> <jvm-options>-Djava.security.auth.login.config=${com.sun.aas.instanceRoot}/config/login.conf</jvm-options>
>>>>>
>>>>> <jvm-options>-Dsun.rmi.dgc.server.gcInterval=3600000</jvm-options>
>>>>>
>>>>> <jvm-options>-Dsun.rmi.dgc.client.gcInterval=3600000</jvm-options>
>>>>> <jvm-options>-Xmx512m</jvm-options>
>>>>>
>>>>>
>>>>> <jvm-options>-Djavax.net.ssl.keyStore=${com.sun.aas.instanceRoot}/config/keystore.jks</jvm-options>
>>>>>
>>>>>
>>>>> <jvm-options>-Djavax.net.ssl.trustStore=${com.sun.aas.instanceRoot}/config/cacerts.jks</jvm-options>
>>>>>
>>>>>
>>>>> <jvm-options>-Djava.ext.dirs=${com.sun.aas.javaRoot}/lib/ext${path.separator}${com.sun.aas.javaRoot}/jre/lib/ext${path.separator}${com.sun.aas.instanceRoot}/lib/ext${path.separator}${com.sun.aas.derbyRoot}/lib</jvm-options>
>>>>>
>>>>>
>>>>> <jvm-options>-Djdbc.drivers=org.apache.derby.jdbc.ClientDriver</jvm-options>
>>>>>
>>>>>
>>>>> <jvm-options>-Djavax.management.builder.initial=com.sun.enterprise.admin.server.core.jmx.AppServerMBeanServerBuilder</jvm-options>
>>>>>
>>>>>
>>>>> <jvm-options>-Dcom.sun.enterprise.config.config_environment_factory_class=com.sun.enterprise.config.serverbeans.AppserverConfigEnvironmentFactory</jvm-options>
>>>>>
>>>>>
>>>>> <jvm-options>-Dcom.sun.enterprise.taglibs=appserv-jstl.jar,jsf-impl.jar</jvm-options>
>>>>>
>>>>>
>>>>> <jvm-options>-Dcom.sun.enterprise.taglisteners=jsf-impl.jar</jvm-options>
>>>>> <jvm-options>-XX:NewRatio=2</jvm-options>
>>>>> <!--
>>>>> Use the following jvm-options element to disable the quick
>>>>> startup:
>>>>> com.sun.enterprise.server.ss.ASQuickStartup=false
>>>>> -->
>>>>>
>>>>> Martin Gainty
>>>>> ______________________________________________
>>>>> Verzicht und Vertraulichkeitanmerkung/Note de déni et de confidentialité
>>>>>
>>>>> Diese Nachricht ist vertraulich. Sollten Sie nicht der vorgesehene
>>>>> Empfaenger sein, so bitten wir hoeflich um eine Mitteilung. Jede
>>>>> unbefugte
>>>>> Weiterleitung oder Fertigung einer Kopie ist unzulaessig. Diese
>>>>> Nachricht
>>>>> dient lediglich dem Austausch von Informationen und entfaltet keine
>>>>> rechtliche Bindungswirkung. Aufgrund der leichten Manipulierbarkeit von
>>>>> E-Mails koennen wir keine Haftung fuer den Inhalt uebernehmen.
>>>>>
>>>>> Ce message est confidentiel et peut être privilégié. Si vous n'êtes pas
>>>>> le
>>>>> destinataire prévu, nous te demandons avec bonté que pour satisfaire
>>>>> informez l'expéditeur. N'importe quelle diffusion non autorisée ou la
>>>>> copie
>>>>> de ceci est interdite. Ce message sert à l'information seulement et
>>>>> n'aura
>>>>> pas n'importe quel effet légalement obligatoire. Étant donné que les
>>>>> email
>>>>> peuvent facilement être sujets à la manipulation, nous ne pouvons
>>>>> accepter
>>>>> aucune responsabilité pour le contenu fourni.
>>>>>
>>>>>
>>>>>
>>>>>
>>>>>> Date: Sun, 30 May 2010 01:23:42 +0200
>>>>>> From: cyril.dangerville_at_gmail.com
>>>>>> To: users_at_glassfish.dev.java.net
>>>>>> Subject: SSL session caching
>>>>>>
>>>>>> Hello,
>>>>>> I can't figure out how to make the Glassfish v2.1 server cache SSL
>>>>>> sessions. SSL client authentication is disabled on the server. I am
>>>>>> testing with the openssl s_client like this:
>>>>>>
>>>>>> $ openssl s_client -connect 172.17.5.213:8181 -reconnect > ssl.log
>>>>>>
>>>>>> ssl.log (excerpt):
>>>>>>
>>>>>> CONNECTED(00000003)
>>>>>> ---
>>>>>> Certificate chain
>>>>>> 0 s:/C=US/ST=California/L=Santa Clara/O=Sun Microsystems/OU=Sun
>>>>>> GlassFish Enterprise Server/CN=sherlock2.layer7.theresis.org
>>>>>> i:/C=US/ST=California/L=Santa Clara/O=Sun Microsystems/OU=Sun
>>>>>> GlassFish Enterprise Server/CN=sherlock2.layer7.theresis.org
>>>>>> ---
>>>>>> Server certificate
>>>>>> -----BEGIN CERTIFICATE-----
>>>>>> MIIC5jCCAk+gAwIBAgIES+iM6DANBgkqhkiG9w0BAQUFADCBpTELMAkGA1UEBhMC
>>>>>> VVMxEzARBgNVBAgTCkNhbGlmb3JuaWExFDASBgNVBAcTC1NhbnRhIENsYXJhMRkw
>>>>>> FwYDVQQKExBTdW4gTWljcm9zeXN0ZW1zMSgwJgYDVQQLEx9TdW4gR2xhc3NGaXNo
>>>>>> IEVudGVycHJpc2UgU2VydmVyMSYwJAYDVQQDEx1zaGVybG9jazIubGF5ZXI3LnRo
>>>>>> ZXJlc2lzLm9yZzAeFw0xMDA1MTAyMjQ3MDRaFw0yMDA1MDcyMjQ3MDRaMIGlMQsw
>>>>>> CQYDVQQGEwJVUzETMBEGA1UECBMKQ2FsaWZvcm5pYTEUMBIGA1UEBxMLU2FudGEg
>>>>>> Q2xhcmExGTAXBgNVBAoTEFN1biBNaWNyb3N5c3RlbXMxKDAmBgNVBAsTH1N1biBH
>>>>>> bGFzc0Zpc2ggRW50ZXJwcmlzZSBTZXJ2ZXIxJjAkBgNVBAMTHXNoZXJsb2NrMi5s
>>>>>> YXllcjcudGhlcmVzaXMub3JnMIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCI
>>>>>> SaVC0IuOgoSFEb+5VMObCfr+s3N9TBHm4tcDgybxoqAutuu8lUQLBP7uIHrAnr5q
>>>>>> loON5NnYqTBIUFqFvoRmiBO6rGJLcmdrYFAyGfpuJ/uy6g5cviF0/azhNS+qlOOn
>>>>>> UjgxZ9W6HC8GecgQAk+oZiWIRdKb1TbQrsuBWjETSQIDAQABoyEwHzAdBgNVHQ4E
>>>>>> FgQU1EWazuIGgynlmMR2rkHHDVgjeqkwDQYJKoZIhvcNAQEFBQADgYEAKjMATvjC
>>>>>> FdVu4BC6ZPRTo3wztZ3zp0t9sd2JdwCxAiEnS+cqUYaMRz+0RlvIz5junKV9q/iS
>>>>>> q9vS2/VMd/Mlt8Uj7jNUa4r9mHahgomEBLAGIKozO4VambCMop0CZIdAerrBY3j8
>>>>>> 3qgjtFv7c/bWiRY3V29LX7tKn4AKXnpuAm8=
>>>>>> -----END CERTIFICATE-----
>>>>>> subject=/C=US/ST=California/L=Santa Clara/O=Sun Microsystems/OU=Sun
>>>>>> GlassFish Enterprise Server/CN=sherlock2.layer7.theresis.org
>>>>>> issuer=/C=US/ST=California/L=Santa Clara/O=Sun Microsystems/OU=Sun
>>>>>> GlassFish Enterprise Server/CN=sherlock2.layer7.theresis.org
>>>>>> ---
>>>>>> No client certificate CA names sent
>>>>>> ---
>>>>>> SSL handshake has read 1326 bytes and written 284 bytes
>>>>>> ---
>>>>>> New, TLSv1/SSLv3, Cipher is DHE-RSA-AES256-SHA
>>>>>> Server public key is 1024 bit
>>>>>> Compression: NONE
>>>>>> Expansion: NONE
>>>>>> SSL-Session:
>>>>>> Protocol : TLSv1
>>>>>> Cipher : DHE-RSA-AES256-SHA
>>>>>> Session-ID:
>>>>>> 4C019F2A8D1CE2323C13BFD5CC335D61C56A9A5E4C22CAEB414559B12383909B
>>>>>> Session-ID-ctx:
>>>>>> Master-Key:
>>>>>>
>>>>>>
>>>>>> 3B6FF13C5090F1AEE01D0BBD793BF3699701D33A1FD5FDF649D3BD2DE68A65A8BDC583C506D06FDE0D522F6AF06971B0
>>>>>> Key-Arg : None
>>>>>> Krb5 Principal: None
>>>>>> Start Time: 1275174644
>>>>>> Timeout : 300 (sec)
>>>>>> Verify return code: 18 (self signed certificate)
>>>>>> ---
>>>>>>
>>>>>> So it is not reusing the SSL session as it should be.
>>>>>>
>>>>>> What am I missing?
>>>>>>
>>>>>> Thanks for any help.
>>>>>>
>>>>>> --Cyril
>>>>>>
>>>>>> ---------------------------------------------------------------------
>>>>>> To unsubscribe, e-mail: users-unsubscribe_at_glassfish.dev.java.net
>>>>>> For additional commands, e-mail: users-help_at_glassfish.dev.java.net
>>>>>>
>>>>>
>>>>> ________________________________
>>>>> The New Busy is not the too busy. Combine all your e-mail accounts with
>>>>> Hotmail. Get busy.
>>>>
>>>
>>> ---------------------------------------------------------------------
>>> To unsubscribe, e-mail: users-unsubscribe_at_glassfish.dev.java.net
>>> For additional commands, e-mail: users-help_at_glassfish.dev.java.net
>>>
>>
>>
>> ---------------------------------------------------------------------
>> To unsubscribe, e-mail: users-unsubscribe_at_glassfish.dev.java.net
>> For additional commands, e-mail: users-help_at_glassfish.dev.java.net
>>
>>
>