Using the native iSeries JSSE provider

The native iSeries™ JSSE provider offers the full suite of JSSE classes and interfaces including implementations of the JSSE KeyStore class and the SSLConfiguration class.

To use the native iSeries provider effectively, use the information in this topic, and also see SSLConfiguration Javadoc information.

Protocol values for the SSLContext.getInstance method

The following table identifies and describes the protocol values for the SSLContext.getInstance method of the native iSeries JSSE provider.

Protocol value	Supported SSL protocols
SSL	SSL version 2, SSL version 3, and TLS version 1
SSLv2	SSL version 2
SSLv3	SSL version 3
TLS	SSL version 2, SSL version 3, and TLS version 1
TLSv1	TLS version 1
SSL_TLS	SSL version 2, SSL version 3, and TLS version 1

Native iSeries KeyStore implementation

The native iSeries provider offers an implementation of the KeyStore class of type IbmISeriesKeyStore. This keystore implementation provides a wrapper around the Digital Certificate Manager support. The contents of the keystore are based on a particular application identifier or keyring file, password, and label. JSSE loads the keystore entries from the Digital Certificate Manager. To load the entries, JSSE uses the appropriate application identifier or keyring information when your application makes the first attempt to access keystore entries or keystore information. You cannot modify the keystore, and you must make all configuration changes by using the Digital Certificate Manager.

For more information about using the Digital Certificate Manager, see the following topic:

Digital Certificate Manager

Recommendations when using the native iSeries provider

The following are recommendations to make the native iSeries provider run as efficient as possible.

For the native iSeries JSSE provider to work, your JSSE application must use only components from the native implementation. For example, your native iSeries JSSE-enabled application cannot use an X509KeyManager object created by using the pure Java™ JSSE provider to successfully initialize an SSLContext object created by using the native iSeries JSSE provider.
Additionally, you have to initialize the implementations of X509KeyManager and X509TrustManager in the native iSeries provider by using either an IbmISeriesKeyStore object or a com.ibm.as400.SSLConfiguration object.

Note: The recommendations mentioned may change in future releases, so that the native iSeries JSSE provider could allow you to plug in non-native components (for example, JKS KeyStore or IbmX509 TrustManagerFactory).