Re: SSL application question

On 23/05/2010, at 9:28 AM, Albert York wrote:

I understand that the browser is expecting an SSL response but why
isn't that request going to my application, like the unsecured
request?

What is stopping it?

My understanding is that if your application is running under the control of an HTTP server then the HTTP server takes care of the SSL. Additionally the server handles reading and writing the encrypted data in the flow after successful negotiation. The browser makes a secure request via the use of https: in the URL. The port number is of no account other than there is an accepted default non-secure (80) and secure (443) port.

Therefore an unsecure (http:) request arrives and the HTTP server passes it to your application. When a secure (https:) request is received the HTTP server attempts to perform the SSL negotiation. This is failing probably because the HTTP server doesn't have an SSL configuration for your application and it sends a negative response to the browser client.

I think you'll need to define an application ID to the HTTP server and use DCM to associate that ID with a current certificate.

If you want your application to handle the SSL negotiation then I think you'll need to talk to the client directly. I think that cannot be done via an HTTP server so you'd need either a special client (not a browser) or you need to make your application into an HTTP server and handle at least the parts of the HTTP protocol needed to support your application.

Easiest approach is to work with the HTTP server and have it handle the SSL connectivity for you.

Regards,
Simon Coulter.
--------------------------------------------------------------------
FlyByNight Software OS/400, i5/OS Technical Specialists

http://www.flybynight.com.au/
Phone: +61 2 6657 8251 Mobile: +61 0411 091 400 /"\
Fax: +61 2 6657 8251 \ /
X
ASCII Ribbon campaign against HTML E-Mail / \
--------------------------------------------------------------------