Java: Self-signed certificate verification procedure with SSL?

1
votes

I have a client/server SSL socket implementation in Java, where a self-signed certificate has been generated and imported into the client truststore. The server has a copy of the self-signed certificate in its keystore.

The cipher suite agreed is TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA, which is an epileptic Diffie- Hellman Variant. The self-signed certificate uses an RSA keypair, and the public key is listed on the certificate for encryption.

What I'm not completely sure about is how the client validation process with self-signed certificates works in Java. I understand how TLS typically verifies a certificate; using the CA's public key on its signature, then comparing the decrypted hash against a generated thumbprint.

How is the signature verified using self-signed certificates? I'm debugging on the client side in Java (using parameters -Djava.protocol.handler.pkgs=com.sun.net.ssl.internal.www.protocol -Djavax.net.debug=ssl) and I see no mention of a self-signed public key for decrypting the signature, or a thumbprint hash. The certificate signatures and public RSA key are certainly mentioned though.

Many thanks.

1
javasslssl-certificatekeystore
What exactly is an "epileptic Diffie-Hellman Variant"? - Jim Garrison
So the client has imported the self signed cert into the truststore. In that case won't the SSL trust manager simply lookup to the truststore and verify the cert the same way it does with other certs.? - Varun
@JimGarrison It is a variant of the Diffie-Hellman key agreement scheme for a shared secret symmetric session key. My apologies, I didn't really need to include the full cipher information as part of my query. - user10941
@Varun How does this procedure work with respect to standard TLS server certificate validation? Is the validation procedure identical? It will most likely be calling isServerTrusted from the client's side. Thanks. - user10941
You haven't needed to set the handler package since about JDK 1.3. You must be using some very old reference material. - user207421

1 Answers

2
votes

The client verifies the signature using the public key of the server as supplied in the server certificate. Only the owner of that certificate has the corresponding private key, so only the certificate owner can produce a valid signature that can be verified via the public key in the certificate. So this proves ownership of the certificate. The fact that the certificate is self-signed has nothing to do with it at this stage.