OpenSSL supports several certificate formats. Certificates are based on the DSA signature algorithm and the RSA algorithm for public-key cryptography according to PKCS algorithms.  The certificate format depends on the application, as there is no agreement on file format standards.

Private keys are usually available in the PEM and DER format. The related files have names of the following type:

*key-rsa.pem for pem files
*key-rsa.der for der files

For OpenSSL applications, the PEM format should suffice. For Java applications, the DER format might be more suitable for importing the private key and certificates.

For certificates, the available formats are PEM, DER and PKCS12 with file names of the following type:

*cert.pem for pem files
*cert.der for der files
*cert.p12 for pkcs12 files

In general, the PEM formats are mostly used in the Unix world, PCKS12 in the Microsoft world and DER in the Java world.

Certificate files are ASN.1-encoded objects that may be encrypted according to DES (Data Encryption Standard). The files can optionally be encrypted using a symmetric cipher algorithm, such as 3DES.

An unencrypted PEM file might look something like this:

    —–BEGIN CERTIFICATE—–
    MB4CGQDUoLoCULb9LsYm5+/WN992xxbiLQlEuIsCAQM=
    —–END CERTIFICATE—–

The string beginning with MB4C… is the Base64-encoded, ASN.1-encoded object.

An encrypted file would have headers describing the type of encryption used, and the initialization vector:

    —–BEGIN RSA PRIVATE KEY—–
    Proc-Type: 4,ENCRYPTED
    DEK-Info: DES-EDE3-CBC,C814158661DC1449
    AFAZFbnQNrGjZJ/ZemdVSoZa3HWujxZuvBHzHNoesxeyqqidFvnydA==
    —–END RSA PRIVATE KEY—–

The two headers Proc-Type and DEK-Info declare the type of encryption, and the string starting with AFAZ… is the Base64-encoded, encrypted, ASN.1-encoded object.

As web browsers make use of Java applications, they import/export certificates in pkcs12 file format, i.e. public and private keys are packed in one single file using the PKCS#12 algorithm. Other applications require the pem format with unpacked public and private keys, thus the user must remember the appropriate file format for each application and must perform format conversions as appropriate.

The following tables report a summary of formats used for INFN-Grid applications and two simple scripts with format conversion commands.

INFN-Grid Certificates Format Summary
Certificate Type     Certificate Format
CA Authority Certificate     DER
Personal Certificate from CA     PKCS12
Grid Access Certificate     PEM

=========================
CONVERT pkcs12 to pem
=========================
#!/bin/sh
echo “copy your cert to cert.p12 – then run this script”
openssl pkcs12 -clcerts -nokeys -in cert.p12 -out usercert.pem
openssl pkcs12 -nocerts -in cert.p12 -out userkey.pem

=========================
CONVERT pem to pkcs12
=========================
#!/bin/sh
echo “Verify that you are using the correct certificate pair (key/cert)”
openssl pkcs12 -export -out one.identity.neteller.com.p12 -inkey ./one.identity.neteller.com.key -in ./one.identity.neteller.com.cert

** NOTE: specify the -in and -inkey parameters as PEM format files…

If your running JRockit, you might also be interested in how to update Verisign CA root certificates.

This might be required if you start seeing errors such as this:
javax.net.ssl.SSLHandshakeException: sun.security.validator.ValidatorException: PKIX path building failed: sun.security.provider.certpath.SunCertPathBuilderException: unable to find valid certification path to requested target

Tweet This Post

<project name="foo" basedir="." default="usage">

...

<target name="usage">
        <java classname="org.apache.tools.ant.Main">
            <arg value="-projecthelp"/>
            <classpath>
                <pathelement location="${lib.dir}/ant/ant.jar"/>
                <pathelement location="${lib.dir}/ant/ant-launcher.jar"/>
                <pathelement location="${lib.dir}/ant/xerces_2.8.0.jar"/>
            </classpath>
        </java>
    </target>

...

</project>

Tweet This Post

Tweet This Post

After an initial attempt to hardcode a hibernate query to return the raw sql using .getStringVal() as follows:

  SELECT x.id, x.xmlData xmldata.getStringVal(), lines.*
  FROM xml_requests x
       XMLTable('declare default element namespace
				"http://www.foo.com/fooservice";
                for $i in /XXXResponse/ResponseData/*/node()
                where $i/*:Error/*:Code = "0"
                return $i'
                PASSING x.xmldata
                COLUMNS GivenName NVARCHAR2(200)
	          PATH './*:PersonAdresseData/*:Person/*:Navn/*:Fornavne',
                    Surname  NVARCHAR2(200)
	          PATH './*:PersonAdresseData/*:Person/*:Navn/*:Efternavn') lines
  WHERE ....

I found that the query would blow up if the xml string returned exceeded some threshold.  Approx ~ 2000 chars as I’m using an oracle database.

Solution was relatively simple thanks to the various support libraries Oracle brings to the table.

Add the xdb.jar and xmlparserv2.jar libraries from the Oracle installation into your Grails application /lib directory and then modify the .gsp page to handle the custom type accordingly as below:

  <div class="list">
    <table>
      <thead>
      <tr>
        <g:each var="key" in="${list[0].keySet()}">
          <g:sortableColumn property="${key}" title="${key}"/>
        </g:each>
      </tr>
      </thead>
      <tbody>
      <g:each in="${list}" status="i" var="item">
        <tr class="${(i % 2) == 0 ? 'odd' : 'even'}">
          <g:each var="key" in="${list[0].keySet()}">
            <td>
            <g:if test="${item[key] instanceof oracle.xdb.XMLType}">
              ${item[key].getStringVal()}
            </g:if>
            <g:else>
              ${item[key]}
            </g:else>
            </td>
          </g:each>
        </tr>
      </g:each>
      </tbody>
    </table>
  </div>

** The above code will dynamically render a table view using the column names as headers in an HTML table. In my eaxmple one the columns I wanted to display was XMLType and stored in Oracle XDB format.

Tweet This Post

The system is out of resources.
Consult the following stack trace for details.
java.lang.OutOfMemoryError: Java heap space

It’s no different than OutOfMemoryError in other java applications. When you run javac in Sun JDK, it’s invoking com.sun.tools.javac.main.Main located in %JAVA_HOME%\lib\tools.jar.

If you are compiling with javac task in Apache Ant, set fork attribute to true, to run javac in a separate process with its own heap size settings. If fork is set to false, or not set (default is false), javac will run in the same process as Ant, which has a default maximum heap size of 64m.

<javac fork="true">
       srcdir="${basedir}/src"
       destdir="${basedir}/build/classes"
       classpath="${project.classpath}"
       memoryinitialsize="256m"
       memorymaximumsize="256m"&gt;
</javac>

Setting fork to true will also limit any memory leaks in javac implementation to its own child process, without affecting the parent Ant process.

Tweet This Post

To work around this I’ve found that declaring a <div/> within the header facet allows you to override the style to behave as desired… below is an example of a table that uses a default headerClass for the majority of columns but is overridden to left align where applicable.

Code:

<h:panelGrid width=”100%” id=”memberTransactionTableBody” border=”0″ cellspacing=”0″ cellpadding=”0″ columns=”1″>
<h:column>
<h:form id=”form”>

<h:dataTable rowClasses=”accountTransactionRowDefault, accountTransactionRowAlternate”
headerClass=”accountColumnHeader StrongText”
footerClass=”accountColumnFooter”
width=”100%”
cellpadding=”0″ cellspacing=”0″ border=”0″ columnClasses=”account-padding,account-date,account-description,account-debit,

account-credit,account-currency,account-status”
styleClass=”accountTransactionText”
var=”transaction”
value=”#{transactionHandler.transactionBean.transactionHistory}”
rows=”40″>

<h:column> </h:column>

<h:column>
<f:facet name=”header”>
<div style=”float: left;”>
#{messages['message.account.column.date']}
</div>
</f:facet>
<h:outputText value=”#{transaction.dateTimeStamp}”/>
<f:facet name=”footer”> </f:facet>
</h:column>

<h:column>
<f:facet name=”header”>
<div style=”float: left;”>
#{messages['message.account.column.description']}
</div>
</f:facet>
<h:outputText value=”#{transaction.description}”/>
</h:column>

<h:column>
<f:facet name=”header”>
#{messages['message.account.column.debit']}
</f:facet>
<h:outputText value=”#{transaction.debit}”/>
</h:column>

<h:column>
<f:facet name=”header”>
#{messages['message.account.column.credit']}
</f:facet>
<h:outputText value=”#{transaction.credit}”/>
</h:column>

<h:column>
<f:facet name=”header”>
#{messages['message.account.column.currency']}
</f:facet>
<h:outputText value=”#{transaction.currency}”/>
</h:column>

</h:dataTable>

</h:form>
</h:column>
</h:panelGrid>

Tweet This Post

Not the most elegant of solutions.. but works nonetheless. Heres an example using the selenium rc framework:

public void testNewSignInDEValidMember() throws Exception {

try {
selenium.open(“/tests/”);
selenium.click(“link=Member Fixture UI”);
selenium.waitForPageToLoad(“30000″);
selenium.select(“memberFixture:address:country”, “label=GERMANY”);
selenium.select(“memberFixture:member:currency”, “label=EUR”);
selenium.type(“memberFixture:address:city”, “Berlin”);
selenium.type(“memberFixture:address:provinceState”, “”);
selenium.click(“memberFixture:submit”);
selenium.waitForPageToLoad(“30000″);
String accountId = selenium.getText(“accountId”);
… etc…

} catch (Throwable ex) {
log.error(“Failure Occurred! ” + ex);
ex.printStackTrace();

// Do custom logic here… (ie: screencapture)

throw new Exception(ex);
}

Tweet This Post

Levels To Use

The six logging levels provided by the commons logging API and my suggested uses for them are (in order):

• trace the least serious; not to be used unless very fine grained tracing is required in a complex piece of code.
• debug used to print debugging information, helpful in development and for debugging; this will almost certainly be disabled when running in production.
• info informatory messages to the logging destination, which help understanding the flow of control within an application; significant application events should be logged at this level (account creation, account closed, etc.).
• warn information related to some faulty and unexpected behavior of the system, which needs attention in near future or else can cause malfunctioning of the application.
• error error related messages; this will very likely be configured to email the associated error message and exception to the operations/support team and should be used sparingly.
• fatal system critical information, for problems which are causing the application to crash; not to be used.

Utilizing the commons api for logging allows for a simple migration to any of the supported logging implementation with little or no code change. Logging messages within your code is simple:

import org.apache.commons.logging.Log;
import org.apache.commons.logging.LogFactory;

public class SomeClass {
private static final transient Log log = LogFactory.getLog(SomeClass.class);
...

public void someMethod() {

log.info("This is the log message");

... do something ...

}

public void someOtherMethod() {

if (log.isDebugEnabled()) {
... do something complex...
log .debug(theResult);
}

}
}

Log4J Implementation

In order to activate the log4j functionality within tomcat you must tell tomcat how to use log4j.Ensure that the log4j.jar is available in TOMCAT_HOME/common/lib and copy the log4j.properties.sample file to TOMCAT_HOME/common/classes/log4j.properties. Log4J only supports one instance per container so we configure the logging properties at the container level so that the individual webapps do not interfere with eachother.

Sample Log4J Properties File

###############################################################################
# Set default logging level and default appenders.
#
# Syntax: log4j.[logger]=[level], appenderName, appenderName, ...
###############################################################################
log4j.rootLogger=INFO, console, file

log4j.appender.console=org.apache.log4j.ConsoleAppender
log4j.appender.console.layout=org.apache.log4j.PatternLayout
log4j.appender.console.layout.ConversionPattern=%d %p [%c] - %m%n

log4j.appender.file=org.apache.log4j.RollingFileAppender
log4j.appender.file.File=${catalina.home}/logs/stdout.log
log4j.appender.file.MaxFileSize=512KB
log4j.appender.file.MaxBackupIndex=3
log4j.appender.file.layout=org.apache.log4j.PatternLayout
log4j.appender.file.layout.ConversionPattern=%d %p [%c] - %m%

### We don't want items outside of com.neteller to log to our custom
### log files so set additivity to false.
log4j.additivity.com.xxx=false

###############################################################################
# Backend classes
###############################################################################

### Spring
#log4j.logger.org.springframework=WARN

### Hibernate
#log4j.logger.net.sf.hibernate=INFO
#log4j.logger.net.sf.hibernate.SQL=DEBUG

### EHCache
#net.sf.hibernate.cache=DEBUG

###############################################################################
# UI classes
###############################################################################

### MyFaces
#log4j.logger.org.apache.myfaces.el.VariableResolverImpl=info
#log4j.logger.org.apache.myfaces=WARN

### Tiles logging
#log4j.logger.org.apache=info

###############################################################################
# Configure member (com.xxx.*) specific logger.
###############################################################################
### Direct log message to the member specific log file as well as to the
### default console (as we defined in tomcat's log4j properties file).
log4j.logger.com.xxx.yyy=DEBUG, console, yyylog

log4j.appender.yyylog=org.apache.log4j.RollingFileAppender
log4j.appender.yyylog.File=${catalina.home}/logs/member.log
log4j.appender.yyylog.MaxFileSize=512KB
log4j.appender.yyylog.MaxBackupIndex=3
log4j.appender.yyylog.layout=org.apache.log4j.PatternLayout
log4j.appender.yyylog.layout.ConversionPattern=%d %p [%c] - %m%n

### Override specific categories to the appropriate logging level here.
#log4j.logger.com.yyylog.service=debug

Tweet This Post