SSL in Tomcat

First Create Certificate file (key store) by using java 'keytool" command utility.

Change the underlined words to suit you.

Second, copy the 'cert.cer' file into tomcat/conf.

Third, modify the 'server.xml' file in conf folder like this below:

<Connector port="8443" protocol="HTTP/1.1" SSLEnabled="true"
               maxThreads="150" scheme="https" secure="true"
               clientAuth="false" sslProtocol="TLS" keystore="conf/cert.cer" keypass="phucnt123"/>

Fourth, edit your web.xml file in tomcat/conf and add the following inside of your container element:     
<!-- Require HTTPS for everything except /img (favicon) and /css. -->
    <security-constraint>
        <web-resource-collection>
            <web-resource-name>HTTPSOnly</web-resource-name>
            <url-pattern>/*</url-pattern>
        </web-resource-collection>
        <user-data-constraint>
            <transport-guarantee>CONFIDENTIAL</transport-guarantee>
        </user-data-constraint>
    </security-constraint>
    <security-constraint>
        <web-resource-collection>
            <web-resource-name>HTTPSOrHTTP</web-resource-name>
            <url-pattern>*.ico</url-pattern>
            <url-pattern>/img/*</url-pattern>
            <url-pattern>/css/*</url-pattern>
        </web-resource-collection>
        <user-data-constraint>
            <transport-guarantee>NONE</transport-guarantee>
        </user-data-constraint>
    </security-constraint>
 
Now, start Tomcat and run your web application, you will see your web application will run with HTTPS.

That's it!

Websockets or Comet or Both? What’s supported in the Java EE land

In preparation for the Atmosphere Framework 1.0.0 release, I’ve started listing what Java EE (or WebServer) supports in terms of Native Comet and WebSockets. This blog describes who supports what. I’ve also added a section describing what transport (WebSocket, Http Streaming, Long Polling or JSONP) Browsers are supporting, again tested using Atmosphere. Of course, Atmosphere supports both matrix, but that’s not the goal of this blog. I’ve also not included SPDY or Server Side Events Support because they are yet to be implemented by the majority of Servers.

Server Supports

The following table describes what Atmosphere supports but it can also be seen as what available in Java EE in general. The third and fourth columns are describing if the server has native support for Comet and WebSocket, by either supporting the ugly Servlet 3.0 API or if they have native implementation. The same apply for WebSockets native support (there is no WebSocket standard yet). Last four columns list the “most” popular transport, e.g WebSockets, Http Streaming (also called Forever Frame), Long-Polling and JSSONP. Note that servers like Tomcat 5 doesn’t support native Comet or WebSocket, but Comet can always be emulated by blocking a thread (this is what Atmosphere is doing when deployed there).
(LP: long-Polling HS: Http Streaming)

Server	Version	Native Comet	Native WebSocket	WebSockets	LP	HS	JSONP
Netty	3.3.x	X	X	X	X	X	X
Jetty	5.x				X	X	X
Jetty	6.x	X			X	X	X
Jetty	7.x	X	X	X	X	X	X
Jetty	8.x	X	X	X	X	X	X
GlassFish	2.x	X			X	X	X
GlassFish	3.x to 3.1.1	X			X	X	X
GlassFish	3.1.2	X	X	X	X	X	X
Tomcat	5.x				X	X	X
Tomcat	6.x	X			X	X	X
Tomcat	7.0.26 and lower	X			X	X	X
Tomcat	7.0.27 and up	X	X	X	X	X	X
JBoss	5.x				X	X	X
JBoss	6.x	X			X	X	X
JBoss	7.x	X			X	X	X
WebLogic	10.x	X			X	X	X
WebLogic	11.x and up	X			X	X	X
Resin	2.x				X	X	X
Resin	3.x	X	X		X	X	X
WebSphere	7.x				X	X	X
WebSphere	8.x	X			X	X

Supported Browsers

The current list of Browsers have been tested with Atmosphere using the atmosphere.js Javascript library and the transport they supports.

Browser	Version	WebSockets	Long-Polling	Http Streaming	JSONP
Firefox	3.x to 8.x		X	X	X
Firefox	9.x to 11.x	X	X	X	X
Chrome	12.x and lower		X	X	X
Chrome	13.x and higher	X	X	X	X
Internet Explorer	6x to 9.x		X	X	X
Internet Explorer	10.x	X	X	X	X
Opera	10.x and lower		X		X
Opera	11.x	X	X		X
Safari	4.x		X	X	X
Safari	5.x	X	X	X	X
Android	2.x and up		X	X	X
Safari (iOS)	1.x to 4.x		X	X	X
Safari (iOS)	5.x	X	X	X	X

Note that I haven’t listed private/commercial/proprietary WebSockets implementations like Kaazing and JWebSocket or Pusher or framework like Cometd (who only works properly on Jetty).

Source: http://jfarcand.wordpress.com/2012/04/19/websockets-or-comet-or-both-whats-supported-in-the-java-ee-land/

Java Serializable Interface

When should i implment Serializble interface?

1. From What's this "serialization" thing all about?:

        It lets you take an object or group of objects, put them on a disk or send them through a wire or wireless transport mechanism, then later, perhaps on another computer, reverse the process: resurrect the original object(s). The basic mechanisms are to flatten object(s) into a one-dimensional stream of bits, and to turn that stream of bits back into the original object(s).

        Like the Transporter on Star Trek, it's all about taking something complicated and turning it into a flat sequence of 1s and 0s, then taking that sequence of 1s and 0s (possibly at another place, possibly at another time) and reconstructing the original complicated "something."

    So, implement the Serializable interface when you need to store a copy of the object, send them it to another process on the same system or over the network.

    2. Because you want to store or send an object.

    3. It makes storing and sending objects easy. It has nothing to do with security.