In Synergy/DE version 9.3 we added support for network encryption for the xfNetLink .NET and xfNetLink Synergy clients. With 9.5.1a, you now have the ability to use encryption with xfServerPlus methods when connecting to an xfNetLink Java client.
In order to use encryption with a Java client, you will need to set up xfServerPlus to run in encrypted mode using OpenSSL. See the Developing Distributed Synergy Applications: Using xfNetLink & xfServerPlus manual for detailed instructions. When setting up xfServerPlus for encryption, you will need a certificate (.pem) file. This file will also be used by the Java client. You can get one from a certificate authority or you can create one with OpenSSL.
Once you have a certificate file and xfServerPlus is running in encrypted mode, you will need to add the certificate file to the Java keystore file that the Java encryption libraries will use. The xfNetLink Java client uses the standard encryption libraries that are part of the JRE. These libraries require you to add your certificates to a keystore file. The JRE comes with a default keystore file that contains certificates from several well-known certificate authorities. The default file, named cacerts, is located in the java.home\lib\security directory and has a default password of “changeit”. Every time you update your JRE, you will also get a new cacerts file. To simplify this step in the process, Synergex supplies a Java utility named genCert. We recommend that you use this utility to add your certificates to the default keystore file and save it with a new name. This way, when you update the JRE, your certificates will not be lost.
When you run the genCert utility, it connects to your xfServerPlus host and port to retrieve your certificates. It then creates a copy of the distributed cacerts file, adds your certificates to it, and saves it with a new name. You can put the new keystore file in any location you wish and direct the Java client to use this keystore file when using encryption. There is also a Keytool Java key and certificate management utility that you can use to maintain and list the certificates in the keystore file. See the Javadoc for more information on this utility.
Once your certificates have been added to the keystore file, you can then use encryption the same as you would with the other clients. You have two choices: master or slave encryption. Master encryption encrypts all method calls between xfNetLink Java and xfServerPlus, while slave encryption allows you to use the Method Definition Utility (or xfAttributes) to specify which methods you want encrypted. The advantage to slave encryption is that because it allows you to encrypt only the methods that will pass sensitive data, it is more efficient.
The xfServerPlus side controls the mode of encryption being used and the level of cipher suites to choose from. When you start xfServerPlus, you will choose to use either master or slave encryption on a port. On the Java side, you will need to regenerate your Java class wrappers if they already exist before you can start using encryption. You must also tell the encryption routines which keystore file you will be using and its password. You can do this either by setting properties in the xfNetLnk.ini file or at the generated component level by calling the setSSLCertFile and setSSLPassword methods.
Both the xfServerPlus and the Java side will need to be able to support the same cipher suite before encryption can begin. When you first connect to an xfServerPlus encrypted port, the encryption handshaking occurs, SSL ciphers are negotiated, and the cipher suite is chosen. The suite used depends on the level of encryption specified when xfServerPlus was started—high, medium, or low. If a cipher suite cannot be negotiated, or if the certificate has expired, the connection will fail and an exception will be thrown.
You do not need to make any changes in your code; just make your method calls and the data will be sent over an encrypted socket. With master mode, all calls will be encrypted and passed over SSL encrypted sockets. With slave mode, only the methods marked as encrypted will be passed over SSL encrypted sockets; non-encrypted calls will be transported on standard sockets, which will be much faster. Depending on the level of encryption used and the cipher suite, the time will vary per call as all data passed must be encrypted and decrypted on each end. Because the cipher negotiation is made for each connection, you will get the best performance if you make a connection, perform all of your method calls (rather than a single call), and then disconnect. Using pooling can also improve performance because the connections (and therefore the cipher negotiations) are made when the pool is first populated. When using logging, encrypted method calls and parameters are not displayed in the logs, so be sure to have your calls working before using encryption. For more information about xfNetLink Java and encryption, see the Developing Distributed Synergy Applications: Using xfNetLink & xfServerPlus manual.
