SSL with client auth
Why oh why do we have to communicate securely? Can't we just trust that people won't be snooping on us?
Ok, so that's not realistic, especially with financial software customers... Still, dealing with tomcat and SSL with client auth can be a real pain. Especially when the communication is all happening in Java and the client is not a browser. I'd solved this the painful way via openssl, digitally signing and setting my internal certs to expire in 10 years hoping to never need to do it again... Well guess what? I wasn't careful enough and my CA cert was set to 1 year... Ack! So a year after I'd done all the work in OpenSSL, (and of course lost my notes on it,) customer software suddenly could not communicate properly! To make a long story short, the affected customers set back their clock to keep things running and I got them nice and patched in about a day.
And life goes on...
Labels: Other Java, work

