1.1.1

Table Of Contents
Generate Certificates
Generate certicates with keytool -export as follows:
keytool -export -alias <alias> -keystore <keystore> \
-rfc -file <certificate file>
For example, to generate a server certicate:
keytool -export -alias mySQLFireServer -keystore serverKeyStore.key \
-rfc -file myServer.cert
Generate a client certcate:
keytool -export -alias aSQLFireClient -keystore clientKeyStore.key \
-rfc -file aClient.cert
The certicate le may then be distributed to the relevant parties.
Install Certificate in a Trust Store
Install a certicate in a trust store with keytool -import as follows:
keytool -import -alias <alias> -file <certificate file> \
-keystore <trust store>
Install a client certicate in the server's trust store:
keytool -import -alias aSQLFireClient -file aClient.cert
-keystore serverTrustStore.key
Install the server certicate in a client's trust store:
keytool -import -alias mySQLFireServer -file myServer.cert
-keystore clientTrustStore.key
Start the Server with SSL/TLS
You activate SSL at the server side with the property derby.drda.sslMode (default off) or the -ssl option
for the server start command.
For server SSL/TLS, a server key pair needs to be generated. If the server is going to do client authentication,
the client certicates need to be installed in the trust store.These operations are described in Generate Key Pairs
and Certicates on page 255.
Starting the Server with Basic SSL Encryption on page 256
Starting a Server That Authenticates Clients on page 257
Starting the Server with Basic SSL Encryption
When the SSL mode is set to basic, the server only accepts SSL encrypted connections.
The properties javax.net.ssl.keyStore and javax.net.ssl.keyStorePassword need to be
set with the proper values.
Example
sqlf server start
-J-Djavax.net.ssl.keyStore=serverKeyStore.key \
-J-Djavax.net.ssl.keyStorePassword=qwerty \
-sqlfire.drda.sslMode=basic
vFabric SQLFire User's Guide256
Deploying vFabric SQLFire