ssl - Someone is requesting a certificate in order to communicate with my web service -
i have simple web service. server regular, public-facing https server valid ssl cert. partner using service telling me "i need certificate" , "oracle requires install in our cert wallet.". should send them? can access web service myself web browser or no problems without installing anything. oracle thing or specific method they're accessing service?
they're being little silly; can information , check against public ca, assuming that's how you've set things up; they've not checked whether info verifiable. (if wasn't signed public ca, they'd right ask there's no way sure you're not being spoofed.) still, there's no harm in giving information out through other channels too.
what want public part of key pair (not private part!) used establish server's identity https. it's fine hand out; have copy of printed in local newspaper , not decrease security @ all. there's fair chance you've got information still when setting server up; it's information returned certificate authority (usually in pem file). if not, can extract information server's keypair keytool:
keytool -exportcert -rfc -file publickey.pem -keystore path/to/keystore -alias thealias there many other options keytool (e.g., different formats of keystore) , might need experiment right set.
Comments
Post a Comment