This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit

Difference between revisions of "SSL Best Practices"

Jump to: navigation, search
Line 26: Line 26:
==Examples with Tomcat==
==Examples with Tomcat==
==Examples with JBoss==
==Examples with JBoss==
==Examples with Jetty==
See [ How to configure SSL] for Jetty
[[Category:OWASP Java Project]]
[[Category:OWASP Java Project]]

Revision as of 16:21, 12 August 2008



What is SSL

SSL is the abbreviation of Secured Socket Layer. It is a protocol enabling to settle a secured communication between two hosts. The origin host is viewed as an SSL client and the destination host as an SSL server.

SSL has also been normalised as the TLS (Transport Layer Security) protocol.

SSL is used on top of a transport level protocol like HTTP or FTP in order to secure it.

SSL enables :

  • authentication of the destination host for the origin host or mutual authentication of both the origin and the destination hosts
  • data confidentiality through encryption
  • data integrity checking through hashing.

SSL relies on two types of encryption :

  • public key encryption in the initiation phase, where authentication takes place
  • secret key encryption when a session has been established and data is sent between two peers which trust each other.

SSL only secures the communication between two endpoints : in the origin and destination points, data is in clear text, unless it is encrypted by another means, at the application level.

How SSL is implemented in J2EE

HTTPS best practices in general

HTTPS best practices in J2EE

Examples with Tomcat

Examples with JBoss

Examples with Jetty

See How to configure SSL for Jetty