Managing certificates with Java (the keystore is the key)

This is not a very difficult task, but I'm putting out here to mainly help me remember the syntax for the keytool utility (that comes with the JDK).

How to install a certificate:

1. Procure the desired certificate for installation into the keystore and copy it to the keystore installation location (see additional instructions at the end for details on how to do this from different browsers (if you don't already have the *.cer file).
   
   
2. Open a command window and navigate to the appropriate directory containing the keystore that you wish to modify (e.g. C:\Program Files\Java\jdk1.6.0_10\jre\lib\security\cacerts is the default keystore).
   
   
3. Execute the following command to import the certificate (from the *.cer file) to the keystore:
   
   keytool -import -file newcertificate.cer -alias new-certificate-name -keystore keystore-name
   
   where:
   
   newcertificate.cer is the name of the certificate file
   new-certificate-name is the name used to store that certificate (doesn't really matter, just something descriptive)
   keystore-name is the name of the keystore being updated (e.g. cacerts).

How to view the certificates already installed in a keystore:

1. Execute the following command to list all of the certificates in the keystore:
   
   keytool -list

How to retrieve a certificate using your browser:

1. Navigate to the desired URL (using https://), then depending on your browser, there are several ways to retrieve the cert:
   
   IE
   Either click on the small padlock icon in the lower right corner, or select File | Properties | Certificates from the menu.
   
   
   
   Then, select Details | Copy To File, and it will launch a wizard to export the certificate to a file (I typically use Base-64 encoded X.509)
   
   
   
   Firefox
   Very similar process, but instead of clicking the padlock, you click the highlighted logo on the left side of the address bar.
   
   
   
   And then select More Information | Details | View Certificate | Export.
   
   
   

More clouds...

I recently stumbled upon a couple articles that I think do a pretty good job at providing some more clarity around 'cloud computing'.

Cloud computing service models by Dan Orlando (IBM developerWorks)

Cloud Computing - A Primer by T. Sridhar (Cisco Internet Protocol Journal)

These are not necessarily vendor-neutral, but do add some detail about common terms and characteristics to be aware of related to cloud computing. Things like:

• elasticity
• virtualization
• resiliency
  
• multi-tenancy
• cloudbursting

Another thing that was covered is the movement towards standardization (which seems to be slow at best). The goal here is to minimize the effect of vendor-lock in (which is not really a motivator for most vendors).

However, there seem to be a couple efforts underway that look promising:

• Open Virtualization Format
  
• Simple Cloud API

To the cloud???

Many of you have likely seen the latest commercials from Microsoft using the tagline "To the cloud...". If you're like me (and probably most other people that are in IT), you've probably tried to figure out what a couple of people at the airport looking at family photos or watching TV has to do with this new buzzword "Cloud Computing"(or I guess that its more accurate to call it a buzz-phrase).

Well, I wish I could answer that question, but in an attempt to help wrap my head around this latest paradigm, I'll try to organize my thoughts around some of the concepts of cloud computing.

When talking about cloud computing, there are a couple of types of clouds that come up, mainly

• private clouds
• public clouds

Public and Private Clouds are just what you would expect them to be. Public clouds are generally computing infrastructures that were set up by some service provider to "sell" as a service to its customers. Private clouds are similar computing infrastructures, but generally created and maintained by an organization for its own use. Easy enough so far.

Regardless of whether or not it is public or private, the bigger question is "What the heck is a cloud?". Well, like a lot of new technology buzzwords or concepts, the answer is often "It depends". In this case, there seem to be many different "levels" for computing within a cloud. One good way of classifying the cloud computing options is to look at the level of the stack that they are servicing. With this approach, there appear to be a few different options for providing solutions from the cloud:

• IAAS (Infrastructure As A Service)
• PAAS (Platform As A Service)
• SAAS (Software As A Service)
• DAAS (Desktop As A Service)

IAAS
This seems to be the cloud offering that is at the lowest level of the stack. It is generally a computing infrastructure that is provided to the client (essentially at the operating system level). This is somewhat analogous to "virtualization", where a single physical machines can be partitioned and then treated as multiple logical machines (just on a different scale, with many physical machines serving as many more logical machines). However, it can sometimes be the inverse, with many physical machines looking like a single logical machine (more of a clustering approach). All of this is somewhat transparent to the individual logical machines.

PAAS
The Platform As A Service approach takes it up another level, generally providing some sort of software or application stack as part of the service (like a Java Application Server with a Database implementation, or a LAMP stack, or some other similar offering). This offering is generally considered as a deployment infrastructure for an application that can shrink and grow with user demand for that application.

SAAS
This approach takes it up yet another level, generally offering some sort of application as a service from the cloud. The classic example for this type of cloud offering is Salesforce.com (SFDC). Where it comes a bit more challenging in my mind is how to separate this from normal web applications. What is different in an SAAS offering that makes is "cloud"? Or is it just a fancy way of saying web application? For example, would you consider most online email offerings as "cloud" applications (or SAAS)? If that's the case, you can probably roll in Google Apps, as well as other web-based application services (including the software used to run this blog).

DAAS
The Desktop As A Service is a relatively newer term (at least to me), but the concept has been around for some time. It is roughly analagous to the desktop virtualization and conceptually similar to the platform virtualization discussed above. It seems to be a fancy method of referring to some of the remote access and remote control technologies used in the past, and not really indicative of the cloud computing movement that most enterprise vendors are pushing (near as I can tell).

In fact, referring to DAAS as a "cloud" technology doesn't quite make sense to me, but this seems to be at least part of Microsoft's vision for the cloud (based on the commercial that I mentioned in the beginning of this post, where there are a couple of people stuck at an airport, and appear to connect to their home PC over the web and look at photos or watch some recorded TV shows).

As you can see, there are many differing visions for this "cloud" future (depending on which vendor you ask), and I'm still not quite sure which one I buy into. In reality, I suspect there is a place for several, if not all, of these versions of the cloud. Like all other technology solutions, the correct choice will likely depend on the business problem that you are trying to solve...

Troubleshooting Web Services (tcpmon)

I stumbled across a useful little tool this week while struggling with the IBM Content Manager Web Services server. If you need to get a look at the SOAP requests and responses getting passed over the wire, here is a cheap (as in free) utility - its called tcpmon.

I think it was originally started under the Apache Axis project, but it is now hosted on java.net (click here to go to the tcpmon homepage).

While there are also commercial tools to do this, its always nice to find a simple and free tool that gets the job done. Its a pretty intuitive utility, that basically acts as a go-between for the client and server, echoing any tcp traffic that passes through it.

I won't go into too many details (there are plenty of other tutorials available on the internet, just a google away), but one thing worth pointing out is how to configure the target host and your client for the web service (since most of the examples don't contain any path info on the URLs, which is pretty common for any web service requests).

First, if the URL of your web service is http://my.service.com/services/myservice, configure tcpmon like this:

And then, when you create your client stub for the web service (if you are using Axis2 and pass in a String for the target endpoint), create it this way:

MyWebServiceStub stub = new MyWebServiceStub("http://localhost/services/myservice");

Instead of the normal way, without the tcpmon as the "man-in-the-middle".

MyWebServiceStub stub = new MyWebServiceStub("http://my.service.com/services/myservice");

A couple of other points worth mentioning:

• It can run as a standalone app (from a downloaded jar file) or over the web via JNLP. The 'official' version is also available as a NetBeans plug-in.
• Some enterprising developers also ported a plug-in version for eclipse available here (thanks guys). The main benefit here is that it is just runnable within eclipse, with the GUI visible as a console view. Installation is simple - just drop the jar file into the plugin folder for eclipse (.../ECLIPSE_HOME/plugin/).
  
• One thing I noticed within the GUI for the eclipse plug-in is that it also seems to have support for a proxy server (as a firewall pass through to external URLs). I don't see similar configuration options on the standalone version (not sure if this is a difference or not, but thought it was worth mentioning).
• If you run into trouble getting everything connected (getting a java.net.UnknownHostException), consider trying both the listener and target port to 80 (in case there are firewalls, or other security settings affecting communication over nonstandard ports that are often suggested in the tutorials).
• It can also be beneficial to just try configuring connectivity to a simple html page, to understand the setup before trying to snoop on a web service (paths, etc.)

Thanks to Charitha Kankanamge's Blog for pointing me in the right direction...

Code Syntax Highlighting - The Sequel

Time for an update. I've followed the advice of some fellow bloggers and configured the Syntax Highlighter JavaScript library.

Here's the world famous highlighter at work:

// Hello.java
import javax.swing.JApplet;
import java.awt.Graphics;

public class Hello extends JApplet
{
public void paintComponent(Graphics g)
{   
   g.drawString("Hello, world!", 65, 95);
}
}

So, was that worth the wait?

For the record, it wasn't really that hard, but I still think its something that should be built into the blog editor.

Thanks to Alex Gorbatchev, Carter Cole, Hendy Irawan, and all the other posters that helped get me here...

Technical Blogs (Code Syntax Highlighting)

I realize that I am relatively new to blogging, but I have to say that I am a bit surprised at the immaturity of some of the editing capabilities built into most blogging platforms (mainly in the formatting options that are available).

I've used plenty of wiki platforms that have very nice code formatting tags (along with many, many others) built right in, but apparently the easiest way to show some Java code examples on blogger is to use the SyntaxHighlighter JavaScript libraries from Alex Gorbatchev.

I'm not looking for anything fancy, just something simple, like this:

// Hello.java 

import javax.swing.JApplet;

import java.awt.Graphics;   

public class Hello extends JApplet 

{     

   public void paintComponent(Graphics g) 

   {         

      g.drawString("Hello, world!", 65, 95);     

   }     

}

One answer is to just copy and paste from another HTML/wiki editor (like I did above), but that seems like too much of a kludge to the developer in me. The blogger editor didn't really like it, it wasn't very clean, and I lost some of the formatting (courier font, etc.). There's got to be a better way.

After searching longer than I should have, for something that I figured would be a very easy thing (display code in a blog), I've found a couple posts that lay it pretty clearly. And honestly, I'm sure its not that hard, but to me this seems like a pretty big oversight (aren't blogs typically targeting a relatively technical audience, and I think code would be a pretty frequent topic for display in a blog).

I apologize if this comes across as being harsh, but I still remember the first time that I used an editor that had color syntax highlighting (yes, I know that I am dating myself, and yes, I said editor and not IDE, because thats all it was - TextPad, for those of you that are familiar). After my first experience with syntax highlighting, I was hooked - coolness factor aside, I think its a huge productivity boost and development aid. It was probably one of the first steps towards many of the productivity gains offered by today's IDEs (maybe that's a topic for another day?)

Maybe I'm wrong about blogger's capabilities, so please tell me if there is an easier way to do this. Otherwise, I guess that I'll get to work on pulling those JavaScript libraries into my blog template, so that I can actually start on the next post that I was planning...

Annotations - Good, Bad, or Ugly?

In my workplace, we are currently in the process of moving towards JDK 1.5 (I know, we're not on the cutting edge of technology, with many apps still on JDK 1.4 and even 1.3).

As such, I am finally taking the time to dig into some of the newer Java features. Annotations are one item that was introduced with JDK 1.5 (or I guess its called Java 5 now) that I haven't made up my mind about yet.

Annotations, simply put, are a facility within Java for providing meta-data about code. From what I can tell so far, there are a couple different flavors (or uses) for this meta-data:

• documentation (acting essentially as a form of structured comments within the source code)
• compiler information (to provide a little clearer instructions to the compiler about how to handle the code - things like @Deprecated, @Override, @SuppressWarnings are all pretty clear in what they are telling the compiler)
• specialized processing (I suspect that this will more likely be used by frameworks, etc.)

In fact, my main exposure to annotations so far are from the Spring documentation (can you tell that I'm a fan of Spring?) It seems to be a way to remove some of the restrictions based on naming conventions, as well as a means of simplifying the XML configuration files (which I admit can get cumbersome).

I can see some advantages for using annotations, but I can also see it getting easy to mix in environment specific or configuration information that really shouldn't be embedded in the code.

More to come on this topic, but to answer the question posed in the title of this blog, I suspect its going to be like many other technologies - has some benefits when used properly, but can be easily abused (or used for the wrong reason).