1.1

For the remainder of this section, the term SSL is used for SSL/TLS and the term peer is used for the other part
of the communication (The server's peer is the client and vice versa).
SSL for SQLFire (both for client and for server) operates in three possible modes:
The default, no SSL encryptionoff
SSL encryption, no peer authenticationbasic
SSL encryption and peer authenticationpeerAuthentication
You can set peer authentication on the server or on the client or on both. Peer authentication means that the other
side of the SSL connection is authenticated based on a trusted certificate installed locally.
Alternatively, you can install a Certification Authority (CA) certificate locally and the peer has a certificate
signed by that authority. How to achieve this is not described in this document. Consult your Java environment
documentation for details.
Attention: If a plaintext client tries to communicate with an SSL server or an SSL client tries to
communicate with a plaintext server, the plaintext side of the communication will see the SSL communication
as noise and report protocol errors.
Generate Key Pairs and Certificates
For SSL operation, the server always needs a key pair. In general, fpr one end of the communication to authenticate
its partner, the first end needs to install a certificate generated by the partner.
If the server runs in peer authentication mode (the server authenticates the clients), then each client needs its
own key pair. The key pair is located in a file which is called a key store and the JDK's SSL provider needs the
system properties javax.net.ssl.keyStore and javax.net.ssl.keyStorePassword to access
the key store.
The certificates of trusted parties are installed in a file called a trust store. The JDK's SSL provider needs the
system properties javax.net.ssl.trustStore and javax.net.ssl.trustStorePassword to
access the trust store.
Generate Key Pairs
Key pairs are generated with keytool -genkey. The simplest way to generate a key pair is to do the following:
keytool -genkey <alias> -keystore <keystore>
keytool prompts for needed information like identity details and passwords.
For example, to generate the server key pair:
keytool -genkey -alias mySQLFireServer -keystore serverKeyStore.key
Generate a client key pair:
keytool -genkey -alias aSQLFireClient -keystore clientKeyStore.key
Consult the JDK documentation for more information on keytool.
Generate Certificates
Generate certificates with keytool -export as follows:
keytool -export -alias <alias> -keystore <keystore> \
-rfc -file <certificate file>
251
Configuring Authentication and Authorization