> From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] > > > a new API ( or even better, a new property string to be set on Call > > object ) so that HTTPSender knows which alias to use. Look at JSSE > > examples for how to do this. > > Now this is information I still not have. I only saw examples where > they're setting the keystore environment variable. This one is pretty > easy, I can do that. But I didn't see any example, where a certain > certificate is choosed by alias. [That's way I said this is > off-topic :) ]
Look at the "Java Security" book by Scott Oak. He has some cool examples ... > > > Another interesting aspect is the validation/verification of > > the certificate > > I had no problem here. Of course I'm not much of an expert, but > I managed to put this into practice (at least I think so). Both server > and client authentication worked. I mean the certificate was accepted > if is was in the trust-store. That's all I know. The default verification by JSSE is okay in number of cases. But if you want extra functionality ( like verification against a Certificate Revocation List ), you will have to either get a more capable provider or write your own code. All depends on the requirements of your production environment ... /Pankaj.
