54 lines
1.4 KiB
Plaintext
54 lines
1.4 KiB
Plaintext
== Setting Up TLS/SSL Security
|
|
|
|
=== Server Authentication
|
|
|
|
.Example generating of server certificate
|
|
----
|
|
SERVER_CA="ca.myhost.dev"
|
|
SERVER_IP="127.0.0.1"
|
|
ORG="My Company"
|
|
ORG_UNIT="Blockchain"
|
|
|
|
certstrap init --common-name "$SERVER_CA" --passphrase "" -o "$ORG" -ou "$ORG_UNIT CA"
|
|
certstrap request-cert -ip $SERVER_IP --passphrase "" -o "$ORG" -ou "$ORG_UNIT Server"
|
|
certstrap sign $SERVER_IP --CA $SERVER_CA
|
|
|
|
openssl pkcs8 -topk8 -inform PEM -outform PEM -in out/$SERVER_IP.key -out out/$SERVER_IP.p8.key -nocrypt
|
|
----
|
|
|
|
.Setup application.properties
|
|
----
|
|
ssl=true
|
|
ssl.cert=out/127.0.0.1.crt
|
|
ssl.key=out/127.0.0.1.p8.key
|
|
----
|
|
|
|
.Verify server certificate
|
|
----
|
|
openssl s_client -alpn h2 -connect 127.0.0.1:8090 -CAfile out/ca.myhost.dev.crt
|
|
----
|
|
|
|
=== Client Authentication (optional)
|
|
|
|
.Example generating of client certifiacte
|
|
----
|
|
CLIENT_CA="client-ca.myhost.dev"
|
|
CLIENT_ID="client_1"
|
|
ORG="My Company"
|
|
ORG_UNIT="Client"
|
|
|
|
certstrap init --common-name "$CLIENT_CA" --passphrase "" -o "$ORG" -ou "$ORG_UNIT CA"
|
|
certstrap request-cert --common-name "$CLIENT_ID" --passphrase ""
|
|
certstrap sign "$CLIENT_ID" --CA $CLIENT_CA
|
|
----
|
|
|
|
.Setup application.properties
|
|
----
|
|
ssl.client.cert=out/client-ca.myhost.dev.crt
|
|
----
|
|
|
|
.Vetify connection with client certificate
|
|
----
|
|
openssl s_client -alpn h2 -connect 127.0.0.1:8090 -CAfile out/ca.myhost.dev.crt -cert out/client_1.crt -key out/client_1.key
|
|
----
|