Client authentication
via certificates is unnecessary for many applications, as
username/password often provides a sufficient level of
authentication.
On the occasions where it is required, the client's
certificate and private key
must be supplied. Two formats are supported - the PEM format and Java
keystore.
Note that for a client certificate to be validated by a server the certificate
must either be (1) installed on the server, or (2) have been issued by
a CA whose certificate is recognized by the server.
The PEM format certificate and private key must be formatted as below:
-----BEGIN xxx PRIVATE KEY-----
... client's private key ...
-----END xxx PRIVATE KEY-----
-----BEGIN CERTIFICATE-----
... client's certificate ...
-----END CERTIFICATE-----
where xxx defines the keytype which must be
either RSA or DSA.
The loadClientCertificate
method is used to load the client's private key and certificate in PEM
format from the supplied file.
Alternatively, setClientCertificate
can be used to supply a Java Certificate object and PrivateKey. To load a certificate and a
private key from a Java keystore, code similar to the following should
be used:
KeyStore
keyStore =
KeyStore.getInstance("JKS");
keyStore.load(new
FileInputStream(keyStoreFileName, keyStorePassword.toCharArray());
Certificate
certificate = keyStore.getCertificate(alias);
PrivateKey privateKey =
(PrivateKey)keyStore.getKey(alias, privateKeyPassword.toCharArray());
ftp.setClientCertificate(certificate, privateKey);
The
topic Obtaining Keys and
Certificates
for instructions on producing keys and certificates.
A general overview of private/public keys is presented in the topic Public
Key Cryptography.
