Connection and Configuration Verification Tool for SSL/TLS
Creator/Architect
Jinwoo Hwang, Software Engineer, IBM
Jinwoo@us.ibm.com
http://jinwoohwang.sys-con.com/
Welcome to Connection and Configuration Verification Tool for SSL/TLS. This tool allows you to verify Secure Sockets Layer (SSL) and Transport Layer Security (TLS) connection and configuration. This tool is provided “as is” without warranty of any kind, either express or implied, including, but not limited to, the implied warranties or conditions of non-infringement, merchantability or fitness for a particular purpose. Feel free to contact Jinwoo if you have any comments or suggestions.
Introduction
Connection and Configuration Verification Tool for SSL/TLS verifies connections and configurations over the Secure Sockets Layer (SSL) protocol and the Transport Layer Security (TLS) protocol as a SSL/TLS client or as a SSL/TLS server. It allows to you take a look at private keys and certificates in key stores and trust stores. It can also import certificates from your trusted SSL/TLS servers if you choose to do so. You can import and export certificates from stores.
Prerequisite
Features
How to start Connection and Configuration Verification Tool for SSL/TLS
You need to use IBM Java™ runtime environment version 6 or higher to run this tool.
Depending on your system’s Java runtime environment, you could execute a jar file simply by just clicking the file from your operating system’s graphical user interface or typing in the path name of the jar file from a command line interface just like an ordinary executable file.
If that is not supported, you need to use your command line interface.
Usage : <Java path>java –jar cvt< version>.jar
For example, /usr/java6/bin/java -jar cvt101.jar will start version 1.0.1 with Java runtime located in the directory, /usr/java6/bin/.
How to use Connection and Configuration Verification Tool for SSL/TLS
When you first start the tool, you will have a chance to read and accept license agreement.
If you decline the license agreement, the program will terminate and you should promptly return the unused media and documentation to the party from whom it was obtained for a refund of the amount paid. If the program was downloaded, destroy all copies of the program.
After you accept the license agreement, you should be able to see the following initial screen of the tool.
You can navigate the tool with menus, icons in tool bars and key short cuts for example Control X to exit from the tool. The console frame provides messages from the tool.
How to use File menu, key stores and trust stores
Under the File menu, there are Open Trust Store, Open Key Store, Create Key/Trust Store and Exit menu items.
If you select File->Open Trust Store menu item, you can browse X.509 certificates, issuers and expiration dates in a trust store.
When a certificate is selected, subject’s common name, organization name, organization unit name, state/province name, locality name and country name as well as certificate’s version, serial number, SHA-1(a secure hash algorithm) fingerprint, MD5 (a message-digest algorithm) fingerprint, validity dates, issuer’s X.500 distinguished name, public key algorithm, format, key size, signature format, signature size, public key and signature are displayed.
If you select Trust Store Information tab, you can see provider name, provider version, trust store type, class name, signature algorithms, cipher algorithms and message digest algorithms.
If you select File->Open Key Store menu item, you can browse private keys and associated certificates.
If you select Key Store Information tab, you can see provider name, provider version, key store type, class name, signature algorithms, cipher algorithms and message digest algorithms.
How to use Network menu, start client and server
Under Network menu, there are Start Client and Start Server menu items.
If you select Network->Start Client menu item, you can connect to a server over SSL/TLS. You need to fill in cryptographic protocol, for example SSLv3, host name, port number, trust management algorithm, trust store type, location of trust store and password.
If you want to authenticate client, you need to enable “Client Authentication Enabled” check box, key management algorithm, key store type, location of key store and password before starting client.
If everything goes well, you will see the following message:
If the server is not trusted, you can choose to trust it or not.
You can find information about the connection such as protocol, local address, local port, remote address, remote port, cipher suite, connection time, session id, client authentication, supported protocols, enabled protocols, supported cipher suites and enabled cipher suites.
If you select Certificates tab, you can browse certificates sent from the server.
You can start SSL or TLS server by selecting File->Start Server menu item. You need to fill in cryptographic protocol, for example SSLv3, cryptographic port number, key management algorithm, key store type, location of key store and password.
If you want to authenticate client, you need to enable “Client Authentication Enabled” check box, and specify trust management algorithm, trust store type, location of trust store and password before starting client.
When a SSL/TLS server is started, you can find protocol, local port number, local address in use as well as supported protocols, enabled protocols, supported cipher suites and enabled cipher suites.
You can pause the server by clicking Pause button. You can also find out how long the server was running by looking at Up Time at the top of the frame.
Under View menu, there are Options, User Interface Profiles, Help Contents Browser, Show Console and Clear Console menu items.
If you select View-> Options, you can change default settings for cryptographic port, cryptographic protocol, trust store type, key store type, trust management algorithm, key management algorithm and connection time out in seconds.
You can change user interface experience with View->User Interface Profiles menu item. There are Nimbus, System and Java user interface options.
You can choose your system’s web browser or the tool’s internal web browser to read the tool’s help contents documents by selecting View->Help Contents Browser menu item.
The Help menu has Help Contents, About and License Agreement menu items.
If you select Help->Help Contents, you can read this document from the tool.
You can read basic information about the tool by selecting Help->About menu item.
You can review the license agreement by selecting Help->License Agreement menu item.
(C) Copyright IBM Corporation 2011. All Rights Reserved. Note to U.S. Government Users Restricted Rights -- Use, duplication or disclosure restricted by GSA ADP Schedule Contract with IBM Corp.
AIX, Cloudscape, DB2, IBM, iSeries, OS/390, WebSphere, and z/OS are trademarks or registered trademarks of IBM Corporation in the United States and/or other countries.
Oracle and Java are registered trademarks of Oracle and/or its affiliates. Other names may be trademarks of their respective owners.
Microsoft, Windows, and Windows NT are trademarks of Microsoft Corporation in the United States and/or other countries.
UNIX is a registered trademark of The Open Group.
Hewlett-Packard, HP and HP-UX are registered trademarks of Hewlett-Packard Company.
Other company, product, and service names may be trademarks or service marks of others.
The following paragraph does not apply to the United Kingdom or any other country where such provisions are inconsistent with local law:
INTERNATIONAL BUSINESS MACHINES CORPORATION PROVIDES THIS TOOLS "AS IS" WITHOUT WARRANTY OF ANY KIND, EITHER EXPRESS OR IMPLIED, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OR CONDITIONS OF NON-INFRINGEMENT, MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. Some states do not allow disclaimer of express or implied warranties in certain transactions, therefore, this statement may not apply to you. This information could include technical inaccuracies or typographical errors. Changes are periodically made to the information herein; these changes will be incorporated in new editions of the tool. IBM may make improvements and/or changes in the product(s) and/or the program(s) described in this tools at any time without notices.