162 Chapter 7 REST Programming Let’s show these settings in a real-world setting (see Listing ). In our secure application, we need to secure all REST resources. Here are the relevant contents of our file. In this case, we are completely disabling the non-SSL listener and defining our SSL-specific settings. Listing /config/—SSL-Only Configuration Sample /config/http/port = 0 /config/https/port = 443 /config/https/sslconfig = { "keyStore": "./config/", "keyStorePassword": "JTotMC8+LCw=", "keyStoreType": "JKS" } Refer to Chapter 9, “Security Model,” for more information on setting up your actual keystore and truststore values, as these are specific to your Java environment. For more information on setting up SSL, refer. | 162 Chapter 7 REST Programming Let s show these settings in a real-world setting see Listing . In our secure application we need to secure all REST resources. Here are the relevant contents of our file. In this case we are completely disabling the non-SSL listener and defining our SSL-specific settings. Listing config Configuration Sample config http port 0 config https port 443 config https sslconfig keyStore . config keyStorePassword xor JTotMC8 LCw keyStoreType JKS Refer to Chapter 9 Security Model for more information on setting up your actual keystore and truststore values as these are specific to your Java environment. For more information on setting up SSL refer to the following resources. For IBM Java key management using the ikeyman tool see http ibmdl pub software dw jdk security 50 . For Sun s keytool utility refer to http j2se docs guide security jsse CreateKeystore. For another good resource for defining a secure environment using keystores see the Using the Java Secure Socket Extension in WebSphere Application Server article from the IBM WebSphere Developer Technical Journal by Messaoud Benantar at http developerworks websphere techjournal 0502_benantar . Although we are providing references to more information on SSL see the following articles for IBM at http developerworks java jdk security 50 secguides jsse2Docs and from Sun at http j2se docs guide security jsse . If you are not ready to purchase a valid certificate from a recognized certificate authority you can still move forward in your development using a local dummy keystore. Simply include the dependency and a dummy keystore is automatically available for use. Please refer to Chapter 9 for more details. Testing and Documentation After you have .
