Change Client SSL Certificate Without Restarting JVM?

[mchenderson]

My client needs to connect to a JBoss server using different credentials at different times. I have a customised SSLSocketBuilder that successfully loads different keystores at the appropriate times. When changing client SSL certificate, I am successfully closing down all current SSL connections. Nevertheless, on making new SSL connections and listening for the handshake complete event, it is clear that the local SSL certificate used for the handshake is not changing.

Is there some about the implementation of SSL sockets in JBoss preventing the change in local SSL certificate from taking place?

If so, is there a way to force the change?

I am using JBoss 4.2.3.

Thanks in advance,

Michelle.

[ron_sigal]

Hi Michelle,

It sounds like you're doing the right thing.   When you create a new connection, org.jboss.remoting.AbstractInvoker.createSocketFactory() should call SSLSocketBuilder to get a new socket factory, and the new socket factory should be created with the new keystore.  Hmmm.

How is your client configured?  Have you looked at AbstractInvoker.createSocketFactory() to verify that the new socket factory is, in fact, being created by your SSLSocketBuilder.

-Ron

[mchenderson]

Hi Ron,

Thank you for your reply.

We have found a solution to this problem that meets our needs. In our customised SSLSocketBuilder, every time that we change the client SSL certificate we invoke createSocketFactorySSLContext followed by initialiseSocketFactorySSLContext. We also set useSSLSocketFactory to false so that it is our own customised socket factory that gets instantiated.

Best regards,

Michelle.