java - how to encrypt a 3-tier architecture communication -
I have a zinc app protected in a 2-level architecture. There is a Tommy in 1 thier that handles https requests and At the second level, relying on an Oracle database completes the content.
Since DB connections can be set to be safe and since I am using https, it is very secure (at least for these two aspects).
Now, I have to monetize it in the application in a 3-level architecture and all channels must be safe. My first idea was to transfer Tommy to the central part and add some Apache httpd to the first level as a reverse proxy.
The problem is communication between first and second class. If I understand well, then https is designed by a protocol that does not ensure MITM attacks, so httpd can not just push https
OTOH, if both httpd Have your own SSL certificate, so I can encrypt the communication, but this certificate management will not be trivial.
I could only open an SSL tunnel from 1 and 2 level, so Tommy could just walk on plain HTTP and could deal with the HTPD with the HTPP, but I'm not sure whether this solution scales or
Or can I try some EJB for EJB communication, I can use other Tommy in 1 tier, but it does not seem right.
What would be the best way for this situation?
Comments
Post a Comment