title: Java: TCP Encryption, SSL and Netty
body: <p>Ok so I have a peer to peer (client/server on one host) setup (over a local LAN), this is using Netty, a Java networking framework. I use raw TCP/IP (as in, no HTTP) for communication and transfers.</p>
  
  <p>Currently all data is transferred in "plain-text" and i'm starting the process of securing such transmitted data.</p>
  
  <p>I've had a good read of types of encryption/practices etc (but probably only touched the surface and its melting my brain already)</p>
  
  <p>Netty includes a SSL implemntation, heres some links to hopefully better explain myself:</p>
  
  <p><a href="http://docs.jboss.org/netty/3.2/xref/org/jboss/netty/example/securechat/package-summary.html" rel="nofollow">http://docs.jboss.org/netty/3.2/xref/org/jboss/netty/example/securechat/package-summary.html</a></p>
  
  <p>Inside "SecureChatTrustManagerFactory" there are 2 methods:</p>
  
  <pre><code>          public void checkClientTrusted(
                    X509Certificate[] chain, String authType) throws CertificateException {
                // Always trust - it is an example.
                // You should do something in the real world.
                // You will reach here only if you enabled client certificate auth,
                // as described in SecureChatSslContextFactory.
                System.err.println(
                        "UNKNOWN CLIENT CERTIFICATE: " + chain[0].getSubjectDN());
            }
  
            public void checkServerTrusted(
                   X509Certificate[] chain, String authType) throws CertificateException {
               // Always trust - it is an example.
                // You should do something in the real world.
                System.err.println(
                        "UNKNOWN SERVER CERTIFICATE: " + chain[0].getSubjectDN());
            }
  </code></pre>
  
  <p>"SecureChatKeyStore" contains a hard coded certificate from what I can see.</p>
  
  <p>So my questions are:</p>
  
  <ul>
  <li>Do I need to generate a certificate?</li>
  <li>if so, each time the application is run?</li>
  <li>if so, per client?</li>
  <li>if so, is this certification passed between client and server?</li>
  <li>if so, how is it done securely?</li>
  </ul>
  
  <p>I'm not entirely sure where to start.
  From what I can see the Netty implementation is saying "Here's the basis of creating secure connections, but we have left out the part that actually makes them secure/authenticated".</p>
  
  <p>Any other pointers/tips I should know about?</p>
  
  <p>Thank you in advance.</p>