Network security is a concern in any distributed environment deployment, and in commerce systems sensitive information such as client credit cards, logins, and other database info are vulnerable to packet sniffing if they are not encrypted.

The Commerce Manager client assumes that network traffic is secured through firewalled VPN connections, and is thus safe from traffic sniffing by external sources. On the local network, traffic can be secured through the use of SSL between the Desktop Commerce Manager client and the Commerce Manager Server.

To enable SSL on your deployment:

1. Enable HTTPS on your Commerce Manager server.
2. If your SSL certificate was not issued from a recognized certificate-issuing authority (i.e. Thawte, Verisign, etc), for instance if you are using a self-signed certificate, then the certificate must be installed on the Commerce Manager Client machines as a trusted certificate. For more information see the instructions from Oracle .
   Note:

   Tomcat example:

   cd <TOMCAT_HOME>
   <JDK_HOME>/bin/keytool -genkey -alias tomcat -keyalg RSA -keypass changeit -storepass changeit -keystore keystore.jks
   First and Last Name: localhost
   

   The command creates file: keystore.jks

   <JDK_HOME>/bin/keytool -export -alias tomcat -storepass changeit -file server.cer -keystore keystore.jks

   The command creates file: server.cer

   <JDK_HOME>/bin/keytool -import -v -trustcacerts -alias tomcat -file server.cer -keystore cacerts.jks -keypass changeit -storepass changeit

   The command creates file: cacerts.jks

   cd <JDK_HOME>/jre/lib/security
   chmod 777 cacerts
   cp cacerts cacerts.backup
   cp <TOMCAT_HOME>/cacerts.jks cacerts
   chmod 444 cacerts
   

   Edit <TOMCAT_HOME>/conf/server.xml:

     <Connector port="8443"
                maxHttpHeaderSize="8192"
                maxThreads="150"
                minSpareThreads="25"
                maxSpareThreads="75"
                enableLookups="false"
                disableUploadTimeout="true"
                acceptCount="100"
                scheme="https"
                secure="true"
                clientAuth="false"
                sslProtocol="TLS"
                keystoreFile="keystore.jks"/commerce-legacy/>
   

3. Configure Spring Security's security.xml so that all requests to *.remote services used by the Commerce Manager Client are required to go through secure HTTPS

   <intercept-url pattern="*.remote" requires-channel="HTTPS" />
   

4. All communications between the desktop Commerce Manager Client and the Commerce Manager Server will now be secured through SSL.
   Note:

   It is critical that the deployment directory of your application is secure on the OS, to ensure that configuration files (e.g. commerce-config.xml, server.xml) are not accessible to unauthorized users. These files contain the credit card encryption key and database connection info.

Database login credentials are stored within your specific application server's configuration file, which will need to be secure from unauthorized access on the file system.

Supported database drivers (Oracle, MySQL, SQL Server) secure their initial handshake to the database servers so that database login credentials are not intercepted over the network.