SSL connection not made for RMI calls in Websphere

According to my last question and using the help, I was able to successfully find the ejb deployed in websphere using the thin client.

Cannot search if SSL is enabled in Websphere 8.5

I also made SSL mandatory for inbound and outbound communications.

To complete my testing, I thought about capturing traffic with Wireshark to ensure that all communication happens over SSL instead of TCP / IP, but, to my surprise, when I saw packets in wirehark, it still uses TCP / IP and all data was transmitted in text format.

My understanding is that when "SSL-Required" is activated at the transport level, all messages and handshakes should occur through SSL, and not through TCP / IP. Do I understand correctly?

Server Configuration:

enter image description here

Customer example:

public static void main(String args[]) throws NamingException { Properties ejbProps = new Properties(); ejbProps.put("org.omg.CORBA.ORBClass", "com.ibm.CORBA.iiop.ORB"); ejbProps.put(Context.INITIAL_CONTEXT_FACTORY, "com.ibm.websphere.naming.WsnInitialContextFactory"); ejbProps.put(Context.PROVIDER_URL, "corbaloc:iiop:160.XX.XX.XX:2809"); InitialContext ffmContext = new InitialContext(ejbProps); Object remoteObject = ffmContext .lookup("ejb/MyAppEar-CLUSTER/MyAppEJB.jar/BatchIdTrackingBean#indi.nh.business.framework.bos.di.BatchIdTrackingBeanRemote"); BatchIdTrackingBeanRemote serviceTester = (BatchIdTrackingBeanRemote) PortableRemoteObject .narrow(remoteObject, BatchIdTrackingBeanRemote.class); System.out.println(serviceTester); } 

Wireshark Capture: enter image description here

Here XXX126 is my client location, from which I run the thin client, and XXX241 is my websphere application server, where I search.

Update: By analyzing more, I found that when I turned on "SSL-Required", all the data is transmitted via TCP / IP, but it is encrypted, I understand that it should be displayed as SSL instead of TCP in wirehark, is it ?, and when I made the transport type only "TCP / IP", then transferring data through GIOP, and I can see all the data in text format.

Can anyone confirm this behavior?

+5
source share

Source: https://habr.com/ru/post/1242736/


All Articles