Borland VisiBroker® 7.0 - Borland Technical Publications

Using IIOP/HTTPSUsing IIOP/HTTPSYou can make use of HTTPS, featured in most browsers. The following guidelinesshould be followed:■■■■■The VisiBroker proxy server GateKeeper must be running with SSL enabled on theexterior.An applet that only uses IIOP/HTTPS requires no pre installation of software (eitherclasses or native libraries) on the client as long as the browser or applet viewer isHTTPS enabled.An applet using IIOP/HTTPS cannot use the X509Certificate[] class to set orexamine identities. All certificate and private key administration is handled by thebrowser. Furthermore, when the ORBalwaysTunnel parameter in the applet tag is setto true, the ORB cannot resolve SSLCurrent objects.To enable an applet to use only IIOP/HTTPS, set ORBalwaysTunnel to true in theHTML page. If ORBalwaysTunnel is set to false (or unspecified) the ORB first tries touse IIOP/SSL, which requires the SSL classes and native SSL library to be installedlocally.In general, IIOP/HTTPS is not available to Java applications because HTTPS is notsupported by the JDK. However, there are no restrictions in VisiBroker for Java thatprevent the addition of HTTPS support to the JDK and the use of IIOP/HTTPS inJava applications.Netscape Communicator/NavigatorYou can freely use Netscape Communicator with IIOP/HTTPS, however, someversions of Navigator require the installation of the CA certificate before allowing anIIOP/HTTPS connection. Follow these guidelines to use IIOP/HTTPS with NetscapeNavigator:■■■■■Make sure your server certificates are issued by a CA already trusted by Navigator.Install the root certificate into Navigator as a trusted certificate. Opening a certificatefile (for example, cacert.crt in bank_https) gives you the opportunity to install thecertificate.Use the GateKeeper to download the root certificate to the browser. The bank_httpsexample shows how to do this.Commercial CAs usually provide a link that allows you to install their root certificate.GateKeeper, by default, does not ask for the client identity. You can enable thisfunction by setting ssl_request_client_certificate to true in the GateKeeperconfiguration file.Microsoft Internet ExplorerTo use IIOP/HTTPS with Microsoft Internet Explorer, you must make sure that theHTTPS connection requires no user interaction. For example, if the browser visits aHTTPS site with an untrusted root certificate, the browser will ask for permission beforeestablishing an HTTPS connection. The Microsoft JVM, due to a known bug, fails onthis connection.22 VisiBroker Security Guide