Recently I'm involved in a project in which we have the following (simplest) scenario. Two machines are using RMI in a network. We want to use RMI over SSL in order to make it secure. And we want to be able to read certificates in both sides, server and client. In both sides we want to check the contents of the certificates before actually establishing a connection.

For this purpose I wrote a very basic implementation of ServerSocket. In this class I delegate the methods to SSLServerSocket and CryptoBroker is a class which provides a Context, with which we construct an SSLServerSocket.  You should write your own methods to do this.

/**
 * 
 */
package test.ssl;
 
import java.io.IOException;
import java.net.InetAddress;
import java.net.Socket;
import java.security.cert.X509Certificate;
 
import javax.net.ssl.SSLPeerUnverifiedException;
import javax.net.ssl.SSLServerSocket;
import javax.net.ssl.SSLServerSocketFactory;
import javax.net.ssl.SSLSession;
import javax.net.ssl.SSLSocket;
 
import org.apache.log4j.Logger;
 
import detos.conframe.ssl.CryptoBroker;
 
/**
 * @author gurito Our own implementation of ServerSocket The goal is to check a
 *         certificate before actually establishing a connection private
 *         KeyStore ks;
 */
public class ServerSocket extends java.net.ServerSocket {
 
    private static final Logger LOG = Logger.getLogger(ServerSocket.class);
    private final SSLServerSocket s;
    private final SSLServerSocketFactory ssf;
 
    /**
     * @throws Exception,
     *             IOException
     */
    public ServerSocket() throws Exception, IOException {
        CryptoBroker cb = CryptoBroker.getInstance("config/cacert.pem",
                "config/server.pem");
        ssf = cb.getContext().getServerSocketFactory();
        s = (SSLServerSocket) ssf.createServerSocket();
    }
 
    /**
     * @param port
     * @throws IOException
     */
    public ServerSocket(int port) throws IOException, Exception {
        CryptoBroker cb = CryptoBroker.getInstance("config/cacert.pem",
                "config/server.pem");
        ssf = cb.getContext().getServerSocketFactory();
        s = (SSLServerSocket) ssf.createServerSocket(port);
    }
 
    /**
     * @param port
     * @param backlog
     * @throws IOException
     */
    public ServerSocket(int port, int backlog) throws IOException, Exception {
        CryptoBroker cb = CryptoBroker.getInstance("config/cacert.pem",
                "config/server.pem");
        ssf = cb.getContext().getServerSocketFactory();
        s = (SSLServerSocket) ssf.createServerSocket(port, backlog);
    }
 
    /**
     * @param arg0
     * @param arg1
     * @param arg2
     * @throws IOException
     */
    public ServerSocket(int arg0, int arg1, InetAddress arg2)
            throws IOException, Exception {
        CryptoBroker cb = CryptoBroker.getInstance("config/cacert.pem",
                "config/server.pem");
        ssf = cb.getContext().getServerSocketFactory();
        s = (SSLServerSocket) ssf.createServerSocket(arg0, arg1, arg2);
    }
 
    /**
     * accept() listens for connections and, after checking the certificate,
     * establishes one.
     * 
     * @return SSLSocket
     * @throws IOException
     */
    @Override
    public Socket accept() throws IOException {
        s.setEnableSessionCreation(true);
        s.setNeedClientAuth(true);
        SSLSocket zokete = (SSLSocket) s.accept();
        if (zokete.isConnected()) {
            LOG.info("connected");
            SSLSession session = zokete.getSession();
            checkCertificates(session);
        }
        return zokete;
    }
 
    private boolean checkCertificates(SSLSession session) {
        // TODO Do something here
        if (session != null) {
            LOG.info("Successfully established a session!!!");
            try {
                X509Certificate[] certs = (X509Certificate[]) session
                        .getPeerCertificates();
                String name = certs[0].getSubjectX500Principal().getName();
                LOG.info("Name of the cert: " + name);
            } catch (SSLPeerUnverifiedException e) {
                // TODO Auto-generated catch block
                LOG.error("Caught an Exception: " + e + " --> "
                        + e.getMessage());
            }
            return true;
        }
        return false;
    }
 
}