StakeSquid/dshackle
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

solution: support client TLS

Browse Source
This commit is contained in:
Igor Artamonov
2019-06-15 15:02:34 -04:00
parent b8a7d4e3db
commit 42c98b5e4c
2 changed files with 70 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

53
docs/tls.adoc Normal file
View File

@@ -0,0 +1,53 @@
== Setting Up TLS/SSL Security
=== Server Authentication
.Example generating of server certificate
----
SERVER_CA="ca.myhost.dev"
SERVER_IP="127.0.0.1"
ORG="My Company"
ORG_UNIT="Blockchain"
certstrap init --common-name "$SERVER_CA" --passphrase "" -o "$ORG" -ou "$ORG_UNIT CA"
certstrap request-cert -ip $SERVER_IP --passphrase "" -o "$ORG" -ou "$ORG_UNIT Server"
certstrap sign $SERVER_IP --CA $SERVER_CA
openssl pkcs8 -topk8 -inform PEM -outform PEM -in out/$SERVER_IP.key -out out/$SERVER_IP.p8.key -nocrypt
----
.Setup application.properties
----
ssl=true
ssl.cert=out/127.0.0.1.crt
ssl.key=out/127.0.0.1.p8.key
----
.Verify server certificate
----
openssl s_client -alpn h2 -connect 127.0.0.1:8090 -CAfile out/ca.myhost.dev.crt
----
=== Client Authentication (optional)
.Example generating of client certifiacte
----
CLIENT_CA="client-ca.myhost.dev"
CLIENT_ID="client_1"
ORG="My Company"
ORG_UNIT="Client"
certstrap init --common-name "$CLIENT_CA" --passphrase "" -o "$ORG" -ou "$ORG_UNIT CA"
certstrap request-cert --common-name "$CLIENT_ID" --passphrase ""
certstrap sign "$CLIENT_ID" --CA $CLIENT_CA
----
.Setup application.properties
----
ssl.client.cert=out/client-ca.myhost.dev.crt
----
.Vetify connection with client certificate
----
openssl s_client -alpn h2 -connect 127.0.0.1:8090 -CAfile out/ca.myhost.dev.crt -cert out/client_1.crt -key out/client_1.key
----