https web service in Tibco & PC

Error:

1.Certificate signature validation failed , Signature does not match
use wrong public certification

2.java.net.SocketException:Connection reset
the client tls protocol version not match

3.javax.net.ssl.SSLException:Unrecognized SSL message,plaintext connection?
将SSL发去80或者将non-ssl发去443

4.javax.net.ssl.SSLPeerUnverifiedException:peer not authenticated
When use Fiddler to monitor SoapUI request , require to import certification into c:\Program Files(X86)\SmartBear\SoapUI-4.6.2\jre\lib\security\cacerts

5.javax.security.auth.login.FailedLoginException:key '...' cannot be retrieved,no key for alias '...' found a cerfificate entry instead in key store
If JKS use in server side, it should include private key and public certificatin . But there's no import key parameter in keytool function , so can use openssl convert the key and cert to PFX file and then use keytool to convert PFX file to JKS file.

Refers link:

tibco web service over ssl

https://tibcobwblog.com/2015/03/09/implementing-https-service-with-tibco-businessworks-6-1/comment-page-1/

c# web service over ssl

https://msdn.microsoft.com/en-us/library/hh556232(v=vs.110).aspx

解决PKIX(PKIX path building failed) 问题 unable to find valid certification path to requested target

http://www.cnblogs.com/wanghaixing/p/5630070.html java InstallCert 172.16.4.133

TLS/SSL Tools and Settings

https://technet.microsoft.com/en-us/library/cc776467(v=ws.10).aspx#w2k3tr_schan_tools_hivv

openssl制作双向认证经过验证可行
http://www.360doc.com/content/12/0524/15/2150778_213390447.shtml

verify TLS version

OpenSSL> s_client -showcerts -connect 172.16.3.170:443

OpenSSL> s_client -debug -connect 172.16.3.170:443

[解决]小程序要求的 TLS 版本必须大于等于 1.2

http://www.cnblogs.com/minamiko/p/6128455.html "HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\Protocols\TLS 1.2" DisabledByDefault Enabled DWord 32bit Restatt!

generate CSR  from JKS

http://www.entrust.net/knowledge-base/technote.cfm?tn=8425
keytool -certreq -keyalg RSA -alias myalias -file certreq.txt -keystore c:\yoursite.mykeystore

generate CERT from JKS

keytool -export -alias certificatekey -keystore keystore.jks -rfc -file public.cert
keytool -importcert -file d:\temp\129\cert.cert -keystore d:\temp\qareq.jks -alias "qaca"

openssl、x509、crt、cer、key、csr、ssl、tls 这些都是什么鬼?

http://www.cnblogs.com/yjmyzz/p/openssl-tutorial.html

How to enable Schannel event logging in IIS

https://support.microsoft.com/en-us/help/260729/how-to-enable-schannel-event-logging-in-iis

SoapUI not working with fiddler for REST service testing

http://stackoverflow.com/questions/22569356/soapui-not-working-with-fiddler-for-rest-service-testing

keytool -importcert -file c:\FiddlerRoot.cer -keystore cacerts

TLS Cipher Suites in Windows 7

https://msdn.microsoft.com/en-us/library/windows/desktop/mt767780(v=vs.85).aspx

TLS 1.3 & TLS 1.2 Handshake & Resumption Supporting tagline

http://abbypan.github.io/2016/09/27/tls-13-resumption

Cipher suite

https://en.wikipedia.org/wiki/Cipher_suite

SSL协议详解

http://kb.cnblogs.com/page/162080/

密码套件格式：每个套件都以“SSL”开头，紧跟着的是密钥交换算法。用“With”这个词把密钥交换算法、加密算法、散列算法分开，例如：SSL_DHE_RSA_WITH_DES_CBC_SHA, 表示把DHE_RSA(带有RSA数字签名的暂时Diffie-HellMan)定义为密钥交换算法；把DES_CBC定义为加密算法；把SHA定义为散列算法。

How to restrict the use of certain cryptographic algorithms and protocols in Schannel.dll

https://support.microsoft.com/en-us/help/245030/how-to-restrict-the-use-of-certain-cryptographic-algorithms-and-protocols-in-schannel.dll

CertMgr.msc

How to disable SSL 2.0 or SSL 3.0 from IIS Server

https://blogs.msdn.microsoft.com/webapps/2014/10/29/how-to-disable-ssl-2-0-or-ssl-3-0-from-iis-server/