Mock Exam question 2

[Narendra Dhande]

Hi,
This is the question from j2eecertificate

Question : Which of the following statement regarding the authentication method CLIENT-CERT are true ? ( Check all answers)

1. Supported by all application servers as it is mandeted by the servlet specification.
2. Authentication is performed when the SSL connection is establised.
3. All the commonly browsers support it.
4. All the data between the client and server is encrypted.
5. Requires a digital certificate which has been issued from a recognised certification authority.

The answers given are 2,3,4,5. Look correct. But I have little dout.

Is the SSL connection is mandeted by spec to use CLIENT-CERT authentication, though most of the application servers implemented it. Some application server generates their own 128 bit SSL certificates in testing environment, so the purchasing of digital certificate is not required if you are not using it for productin environment.

so I think option 2 and 5 are ambiguous. Can anyone provide explaination please.


Thanks

[Sushma Sharma]

Hi,

However, there is not much specified in Servlet Specs about security, but If you see on page 95 of Servlet Specs, they have given

End user authentication using HTTPS (HTTP over SSL) is a strong authentication mechanism. This mechanism requires the user to possess a Public Key Certificate (PKC).

even in HFSJ, they have mentioned that certificate is required for CLIENT-CERT. and I don't have any experience in this field, so I dn't know anything about application server generates their own 128 bit SSL certificates in testing environment...

Regards,

[Narendra Dhande]

Hi sushma

Here is link , if you are interested in how to configure free SSL for tomcat using Java keytool

Free SSL for tomcat

Thanks