Search code examples
apache-flexapachesslcross-domain-policy

Flex: Does SecureSockets' <policy-file-request/> is encrypted with the target servers public key?


I have an Apache SSL connection available with a C# server that listens to port 843 (i wrote a basic c# server since i don't know how to make Apache respond properly upon a specific request).

When using the Socket object, all seems to be find and the connection gets approved, thus allowing the crossdomain communication, however, when using a SecureSocket object, instead of getting , i get lots of gibberish.

I've been trying to figure out what's going on and assumed it's either:

A. using the connection target private key to encrypt the request. B. trying to authenticate itself via SSL prior to sending the request.

I've spent the entire week trying to figure out whats going on with no luck so if someone can shed some light regarding the way that the SecureSocket obj deals with crossdomain requests it'll be greatly appreciated.

Also, is there a way to use a normal Socket and somehow get the information?

with regards,

Mike


Solution

  • You need to set up a SSL enabled policy server. Using Apache to get rid of the SSL communication and proxy the the policy server didn't work for me as it complains on a bad method.

    I wrote a simple java program SSL enabled using the same certificates that the target server (I haven't tested with a different one, so don't know if it's mandatory) to listen on port 843 and replay with the policy. Now I can communicate with SecureSockets.