The network layer also provides an easy to use secure sockets implementation that is fully integrated with the Secure Keystore (P6R::p6IKeystore), enabling both local and remote management of SSL related certificates and keys.
All TCP sockets export the P6R::p6ITcpSecureSocket interface which provides all the SSL/TLS related methods for the socket. Once initialized, the standard P6R::p6ITcpSocket interface is used to communicate over the secure socket enable you to use the exact same code for both secure and insecure sockets (other than initialization).
SSL/TLS does however require some setup in order to use it. In order to make a secure connection to a remote server (client connection) the server's trusted root certificate must stored in the keystore and if client authentication is also used, then the client certificates and associated private key must also be stored in the keystore. The following sections describe how this is accomplished.
The keystore provides an SSL Helper interface (P6R::p6IKeystoreSSL) which provides helper methods that make it easier to import certificates into the correct namespaces and under the correct names so that the SSL networking layer can automatically find the certificates and keys when they are needed.
To establish a secure connection to a server your client will need to have the server's trusted root certificate in the keystore. This is usually obtained through an out of band mechanism. Web browsers come with the certs for the most popular certificate authorities pre-populated. You may want only one or two for your particular server, or if you are connecting to servers that are out of your control you may need to do something more along the lines of what the web browsers do.
Here is a simple example of loading a root certificate into a keystore using the P6R:p6IKeystoreSSL helpers:
What the P6R::p6IKeystoreSSL::setTrustedRootCertFromFile() method does is to create a new P6R::p6ICert instance that it uses to load the root certificate file using the P6R::p6ICert::loadCert() method. It then calls P6R::p6IKeystoreSSL::setTrustedRootCert() with the newly loaded certificate. setTrustedRootCert() first calculates the certificates subject hash which will be used as the "name" under which the certificate is stored and then it calls the keystores setCertificate() method, specifiying P6SSL_TRUSTEDROOT_NAMESPACE as the namespace, and the hash as the name.
Later when making an SSL connection, the SSL layer will look the certificate up using the subject hash.
Having the root certificate, allows SSL to verify that the server is trusted, client authentication allows the server to verify that the client is trusted. To enable client authentication, you will need to store a client certificate which has been signed by the server's certificate authority and the associated private key.
Following is a simple example of import the client certidicate and public key from files into the keystore:
You will need the hostname of the server to pass in to the helper functions. The help functions store the both the certificate and the private key in the P6SSL_CLIENTAUTH_NAMESPACE namespace and use the hostname with the P6SSL_KEYSTORE_CLIENT_CERT_SUFFIX appended for the certificate name and the hostname with the P6SSL_KEYSTORE_CLIENT_PRVK_SUFFIX appended for the key's name.
The hostname passed in MUST BE IDENTICAL to the one passed into the P6R::p6ITcpSecureSocket::initSecureSocket() used to initialize the associated connection to the server. The SSL layer uses this information to lookup the client certifiate and private key when the connection is made.