== Setting Up TLS/SSL Security

=== Server Authentication

.Example generating of server certificate
----
SERVER_CA="ca.myhost.dev"
SERVER_IP="127.0.0.1"
ORG="My Company"
ORG_UNIT="Blockchain"

certstrap init --common-name "$SERVER_CA" --passphrase "" -o "$ORG" -ou "$ORG_UNIT CA"
certstrap request-cert -ip $SERVER_IP --passphrase ""  -o "$ORG" -ou "$ORG_UNIT Server"
certstrap sign $SERVER_IP --CA $SERVER_CA

openssl pkcs8 -topk8 -inform PEM -outform PEM -in out/$SERVER_IP.key -out out/$SERVER_IP.p8.key -nocrypt
----

.Setup application.properties
----
ssl=true
ssl.cert=out/127.0.0.1.crt
ssl.key=out/127.0.0.1.p8.key
----

.Verify server certificate
----
openssl s_client -alpn h2 -connect 127.0.0.1:8090 -CAfile out/ca.myhost.dev.crt
----

=== Client Authentication (optional)

.Example generating of client certifiacte
----
CLIENT_CA="client-ca.myhost.dev"
CLIENT_ID="client_1"
ORG="My Company"
ORG_UNIT="Client"

certstrap init --common-name "$CLIENT_CA" --passphrase "" -o "$ORG" -ou "$ORG_UNIT CA"
certstrap request-cert --common-name "$CLIENT_ID" --passphrase ""
certstrap sign "$CLIENT_ID" --CA $CLIENT_CA
----

.Setup application.properties
----
ssl.client.cert=out/client-ca.myhost.dev.crt
----

.Vetify connection with client certificate
----
openssl s_client -alpn h2 -connect 127.0.0.1:8090 -CAfile out/ca.myhost.dev.crt -cert out/client_1.crt -key out/client_1.key
----