implementing SSl in jsp

[ami]

Hello

I have created 3 tier online book store. Here I am using jsp ,Tomcat as
webserver and My_SQL as backend. Now I want to implement a secure JDBC
"tunnel" between server-side application (or the shopping cart
application) and the back-end database server. JDBC queries and their
respective results exchanged between the application and the DBMS
should be protected from potential intercepters. Can anyone suggest
how to accomplish this?

Please help.

 

[Roedy Green]

Can anyone suggest
how to accomplish this?

Put the servers on the same LAN behind a firewall.

 

[Abhijat Vatsyayan]

Why "implementing SSL in JSP" ? Looks like I am missing something.

Assuming that you want JDBC queries from tomcat to the DB server to go
over a secure channel -

If your JDBC (driver) talks to the server using a well know and fixed
set of TCP/IP ports and it does not support SSL, you can use ssh to
setup port forwarding. You can also try to setup VPN tunnels between the
two machines. VPN tunnel might work for protocols others than TCP/IP.

Abhijat

 

[Thomas Hawtin]

I have created 3 tier online book store. Here I am using jsp ,Tomcat as
webserver and My_SQL as backend. Now I want to implement a secure JDBC
"tunnel" between server-side application (or the shopping cart
application) and the back-end database server. JDBC queries and their
respective results exchanged between the application and the DBMS
should be protected from potential intercepters. Can anyone suggest
how to accomplish this?

My first google suggests inserting useSSL=true into the connect URL.

Another way of doing it is to use port forward with ssh. I'm writing
this in Thunderbird over ssh port forwarding, and it works fine.

Tom Hawtin

 

[shamikm78]

Hi,
have a look at this article http://www.velocityreviews.com/forums/t147650-implementing-ssl-in-jsp.html. The author has implemented the tunnel which you can adopt for your tunnel setup between server side and the database. This is a well known way of handling JDBC DML query in case you do not have a driver which itself supports SSL. For example, PostgreSQL does support SSL, if you configure the driver properly. Its easy to configure also similarly Oracle also does support it. I am not sure about MySQL but I feel the current JDBC drivers of MySQL might support it as well. In that case you do not have to implement the tunnel yourself using JSSE.