== SSL Channels

SocketFactories (like +ISOServer+), as well as most channels that inherit
from +BaseChannel+ can delegate socket creation to an optional socket factory.

We have two kinds of socket factories:

* +ISOClientSocketFactory+
* +ISOServerSocketFactory+

[source,java]
----
public interface ISOClientSocketFactory {
    public Socket createSocket(String host, int port)
        throws IOException, ISOException;
}

public interface ISOServerSocketFactory {
    public ServerSocket createServerSocket(int port)
        throws IOException, ISOException;
}
----

as well as a provider that implements both of them: +org.jpos.iso.GenericSSLSocketFactory+

The ChannelAdaptor accepts an optional 'socketFactory' property in the
channel configuration, and the QServer accepts a 'server-socket-factory'
child element.

.SocketFactory configuration in a ChannelAdaptor
====
[source,xml]
----
<channel-adaptor name='sslclient'
    class="org.jpos.q2.iso.ChannelAdaptor" logger="Q2">
 <channel class="org.jpos.iso.channel.NACChannel" logger="Q2"
       packager="org.jpos.iso.packager.ISO87BPackager">

  <property name="host" value="127.0.0.1" />
  <property name="port" value="10000" />
  <property name="timeout" value="360000" />
  <property name="socketFactory" value="org.jpos.iso.GenericSSLSocketFactory" />
 </channel>
 <in>sslsend</in>
 <out>sslreceive</out>
 <reconnect-delay>10000</reconnect-delay>
</channel-adaptor>
----
====

.SocketFactory configuration in a QServer
====
[source,xml]
----
<server name="server"
    class="org.jpos.q2.iso.QServer" logger="Q2">
   <attr name="port" type="java.lang.Integer">5000</attr>
   <server-socket-factory class="org.jpos.iso.GenericSSLSocketFactory" />
   <channel class="org.jpos.iso.channel.NACChannel" logger="Q2"
      packager="org.jpos.iso.packager.ISO87BPackager">
   </channel>
</server>
----
====

[NOTE]
====
For backward compatibility, we also have a `SunJSSESocketFactory` implementation
that uses `com.sun.net.ssl.internal.ssl.Provider`.
====

[TIP]
====
`GenericSSLSocketFactory` honors two very important properties:

* `addEnabledCipherSuite` and
* `addEnabledProtocol`

For PCI compliance, you want to make sure which protocols and ciphersuites you
want to enable. If these properties are not configured, all protocols and ciphersuites
available to the JVM will be enabled, something you probably don't want.
====

