SSL and Tomcat using Java

Question

I'm new to SSL connections so here goes my question.

I have a desktop Java program in a JAR file. This JAR sends sensitive information over the internet to a remote Tomcat server. Of course I need to encrypt the data.

If I purchase an SSL cerfiticate say from Verisign, will the data sent over SSL be automatically encrypted?

I mean in my JAR, will I still need to do extra work like use Java encryption extensions API to manually encrypt my data over the SSL connection?

Thank you.

Answer 1

I mean in my JAR, will I still need to do extra work like use Java encryption extensions API to manually encrypt my data over the SSL connection?

Encryption will be done for you (with the Java Secure Socket Extension). Just establish your connection using https://. Maybe have a look at HTTP Client for a higher level API.

By the way, the certificate goes on the server side (unless you want to do client-authentication too in which case, well, you'll need a client certificate too).

And yes, you could use a self-signed certificate but one of the benefits of using a certificate signed by a well known Certificate Authority (CA) like Verisign, Thawte, etc is that you won't have to add it to the trust store of the client VM (unless you disable the verification mechanism).

Answer 2

Follow the SSL Configuration HOW-TO on how to setup https.