You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@cxf.apache.org by co...@apache.org on 2015/06/10 18:24:33 UTC
cxf-fediz git commit: [FEDIZ-123] - First cut at updating certs.
Repository: cxf-fediz
Updated Branches:
refs/heads/master 5f1bc25ed -> c20e4856d
[FEDIZ-123] - First cut at updating certs.
Project: http://git-wip-us.apache.org/repos/asf/cxf-fediz/repo
Commit: http://git-wip-us.apache.org/repos/asf/cxf-fediz/commit/c20e4856
Tree: http://git-wip-us.apache.org/repos/asf/cxf-fediz/tree/c20e4856
Diff: http://git-wip-us.apache.org/repos/asf/cxf-fediz/diff/c20e4856
Branch: refs/heads/master
Commit: c20e4856d2d6788ce80caad25b88e7ff7d2be2de
Parents: 5f1bc25
Author: Colm O hEigeartaigh <co...@apache.org>
Authored: Wed Jun 10 17:23:56 2015 +0100
Committer: Colm O hEigeartaigh <co...@apache.org>
Committed: Wed Jun 10 17:23:56 2015 +0100
----------------------------------------------------------------------
.../samplekeys/HowToGenerateKeysREADME.html | 19 ++++++++++---------
examples/samplekeys/idp-ssl-key.jks | Bin 0 -> 2074 bytes
examples/samplekeys/idp-ssl-server.jks | Bin 1123 -> 0 bytes
examples/samplekeys/idp-ssl-trust.jks | Bin 0 -> 783 bytes
examples/samplekeys/rp-ssl-key.jks | Bin 0 -> 2070 bytes
examples/samplekeys/rp-ssl-server.jks | Bin 1124 -> 0 bytes
examples/samplekeys/wsp-ssl-key.jks | Bin 0 -> 2073 bytes
examples/samplekeys/wsp-ssl-server.jks | Bin 1123 -> 0 bytes
.../webapp/src/main/resources/rp-ssl-key.jks | Bin 1124 -> 2070 bytes
.../src/main/resources/webappKeystore.jks | Bin 1400 -> 1534 bytes
services/idp/pom.xml | 2 +-
services/idp/src/main/resources/idp-ssl-key.jks | Bin 1123 -> 2074 bytes
.../idp/src/main/resources/idp-ssl-trust.jks | Bin 716 -> 783 bytes
services/idp/src/main/resources/stsrealm_a.jks | Bin 2060 -> 2061 bytes
services/idp/src/main/resources/stsrealm_b.jks | Bin 2061 -> 2062 bytes
services/idp/src/test/resources/rest-client.xml | 2 +-
services/idp/src/test/resources/stsrealm_a.jks | Bin 2060 -> 2061 bytes
services/pom.xml | 2 +-
services/sts/src/main/resources/realma.cert | Bin 709 -> 1015 bytes
services/sts/src/main/resources/realmb.cert | Bin 709 -> 1015 bytes
services/sts/src/main/resources/stsrealm_a.jks | Bin 2060 -> 2061 bytes
services/sts/src/main/resources/stsrealm_b.jks | Bin 2061 -> 2062 bytes
services/sts/src/main/resources/ststrust.jks | Bin 4079 -> 3161 bytes
systests/tomcat7/src/test/resources/alice.cer | Bin 808 -> 873 bytes
.../tomcat7/src/test/resources/alice_client.jks | Bin 1277 -> 2225 bytes
systests/tomcat7/src/test/resources/client.jks | Bin 2060 -> 2061 bytes
.../tomcat7/src/test/resources/clienttrust.jks | Bin 1526 -> 1512 bytes
systests/tomcat7/src/test/resources/server.jks | Bin 2701 -> 3717 bytes
28 files changed, 13 insertions(+), 12 deletions(-)
----------------------------------------------------------------------
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/c20e4856/examples/samplekeys/HowToGenerateKeysREADME.html
----------------------------------------------------------------------
diff --git a/examples/samplekeys/HowToGenerateKeysREADME.html b/examples/samplekeys/HowToGenerateKeysREADME.html
index 5b020c9..1f8e695 100644
--- a/examples/samplekeys/HowToGenerateKeysREADME.html
+++ b/examples/samplekeys/HowToGenerateKeysREADME.html
@@ -11,29 +11,30 @@ is recommended.</p>
<tr bgcolor="#FFCCCC">
<th>Keystore (Password)</th><th>Key Alias (Password)</th><th>Location</th><th>Creation Script Used</th><th>Needs to trust</th><th>Is trusted by</th></tr>
<tr><td colspan="6"><strong><em>Servlet Container Keystores: The keys can be simply placed in the root folder of each Servlet Container installation. They are used to configure SSL for the Servlet Container instances as described here for Tomcat: <a href="http://cxf.apache.org/fediz-tomcat.html">http://cxf.apache.org/fediz-tomcat.html</a>. For Tomcat keys only, the keystore password and the private key password needs to be the same.</em></strong></tr>
-<tr><td>idp-ssl-server.jks (tompass)</td><td>mytomidpkey (tompass)</td><td>base folder of Tomcat instance holding the IDP and IDP STS</td>
- <td><code>keytool -genkeypair -validity 730 -alias mytomidpkey -keystore idp-ssl-server.jks -dname "cn=localhost" -keypass tompass -storepass tompass</code><br/><br/><code>keytool -keystore idp-ssl-server.jks -storepass tompass -export -alias mytomidpkey -file MyTCIDP.cer</code></td>
+<tr><td>idp-ssl-key.jks (tompass)</td><td>mytomidpkey (tompass)</td><td>base folder of Tomcat instance holding the IDP and IDP STS</td>
+ <td><code>keytool -genkeypair -validity 730 -alias mytomidpkey -keystore idp-ssl-server.jks -dname "cn=localhost" -keypass tompass -storepass tompass -keysize 2048 -keyalg RSA</code><br/><br/><code>keytool -keystore idp-ssl-server.jks -storepass tompass -export -alias mytomidpkey -file MyTCIDP.cer</code></td>
<td>Nobody</td><td>Fediz IDP module<br/><br/>wsclientWebapp's webapp module<br/><br/>Browser</td></tr>
-<tr><td>rp-ssl-server.jks (tompass)</td><td>mytomrpkey (tompass)</td><td>base folder of Tomcat instance holding the relying party applications for both samples (simpleWebapp and wsclientWebapp); STS public cert NOT imported anymore - instead use ststrust.jks</td>
- <td><code>keytool -genkeypair -validity 730 -alias mytomrpkey -keystore rp-ssl-server.jks -dname "cn=localhost" -keypass tompass -storepass tompass</code><br/><br/><code>keytool -keystore rp-ssl-server.jks -storepass tompass -export -alias mytomrpkey -file MyTCRP.cer</code></td>
+<tr><td>rp-ssl-key.jks (tompass)</td><td>mytomrpkey (tompass)</td><td>base folder of Tomcat instance holding the relying party applications for both samples (simpleWebapp and wsclientWebapp); STS public cert NOT imported anymore - instead use ststrust.jks</td>
+ <td><code>keytool -genkeypair -validity 730 -alias mytomrpkey -keystore rp-ssl-key.jks -dname "cn=localhost" -keypass tompass -storepass tompass -keysize 2048 -keyalg RSA
+</code><br/><br/><code>keytool -keystore rp-ssl-key.jks -storepass tompass -export -alias mytomrpkey -file MyTCRP.cer</code></td>
<td>Nobody</td><td>Browser<br/><br/>IDP STS</td></tr>
-<tr><td>wsp-ssl-server.jks (tompass)</td><td>mytomwspkey (tompass)</td><td>base folder of Tomcat instance holding the web service provider in the second (wsClientWebapp) sample</td>
- <td><code>keytool -genkeypair -validity 730 -alias mytomwspkey -keystore wsp-ssl-server.jks -dname "cn=localhost" -keypass tompass -storepass tompass</code><br/><br/><code>keytool -keystore wsp-ssl-server.jks -storepass tompass -export -alias mytomwspkey -file MyTCWSP.cer</code></td>
+<tr><td>wsp-ssl-key.jks (tompass)</td><td>mytomwspkey (tompass)</td><td>base folder of Tomcat instance holding the web service provider in the second (wsClientWebapp) sample</td>
+ <td><code>keytool -genkeypair -validity 730 -alias mytomwspkey -keystore wsp-ssl-key.jks -dname "cn=localhost" -keypass tompass -storepass tompass -keysize 2048 -keyalg RSA</code><br/><br/><code>keytool -keystore wsp-ssl-key.jks -storepass tompass -export -alias mytomwspkey -file MyTCWSP.cer</code></td>
<td>Nobody</td><td>wsclientWebapp's webapp module</td></tr>
<tr><td colspan="6"><strong><em>Service Keystores: These Fediz services form the core of the product and can be used with both the sample webapps provided and of course your own web applications.</em></strong></tr>
-<tr><td>idp-ssl-trust.jks (ispass)</td><td>myidpkey (ikpass)</td><td>services/idp/src/main/resources/idp-ssl-trust.jks</td>
+<tr><td>idp-ssl-trust.jks (ispass)</td><td>N/A (no key, just a truststore)</td><td>services/idp/src/main/resources/idp-ssl-trust.jks and base folder of Tomcat instance holding the IDP and IDP STS</td>
<td><code>keytool -import -trustcacerts -keystore idp-ssl-trust.jks -storepass ispass -alias mytomidpkey -file MyTCIDP.cer -noprompt</code></td>
<td>mytomidpkey (because of SSL call to IDP STS)</td><td>IDP STS</td></tr>
<tr><td>stsrealm_a.jks (storepass)</td><td>realma (realma)</td><td>services/sts/src/main/resources/stsrealm_a.jks</td>
<td><code>
-keytool -genkeypair -keyalg RSA -validity 3600 -alias realma -keystore stsrealm_a.jks -dname "cn=REALMA" -keypass realma -storepass storepass<br/><br/>
+keytool -genkeypair -keyalg RSA -validity 3600 -alias realma -keystore stsrealm_a.jks -dname "cn=REALMA" -keypass realma -storepass storepass -keysize 2048<br/><br/>
keytool -export -rfc -keystore stsrealm_a.jks -storepass storepass -alias realma -file realma.cert
</code>
</td>√
<td>Nobody</td><td>By Relying Party (ststrust.jks)</td></tr>
<tr><td>stsrealm_b.jks (storepass)</td><td>realmb (realmb)</td><td>services/sts/src/main/resources/stsrealm_b.jks</td>
<td><code>
-keytool -genkeypair -keyalg RSA -validity 3600 -alias realma -keystore stsrealm_b.jks -dname "cn=REALMB" -keypass realmb -storepass storepass<br/><br/>
+keytool -genkeypair -keyalg RSA -validity 3600 -alias realmb -keystore stsrealm_b.jks -dname "cn=REALMB" -keypass realmb -storepass storepass -keysize 2048<br/><br/>
keytool -export -rfc -keystore stsrealm_b.jks -storepass storepass -alias realmb -file realmb.cert
</code>
</td>
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/c20e4856/examples/samplekeys/idp-ssl-key.jks
----------------------------------------------------------------------
diff --git a/examples/samplekeys/idp-ssl-key.jks b/examples/samplekeys/idp-ssl-key.jks
new file mode 100644
index 0000000..ae3d010
Binary files /dev/null and b/examples/samplekeys/idp-ssl-key.jks differ
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/c20e4856/examples/samplekeys/idp-ssl-server.jks
----------------------------------------------------------------------
diff --git a/examples/samplekeys/idp-ssl-server.jks b/examples/samplekeys/idp-ssl-server.jks
deleted file mode 100644
index ae16a55..0000000
Binary files a/examples/samplekeys/idp-ssl-server.jks and /dev/null differ
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/c20e4856/examples/samplekeys/idp-ssl-trust.jks
----------------------------------------------------------------------
diff --git a/examples/samplekeys/idp-ssl-trust.jks b/examples/samplekeys/idp-ssl-trust.jks
new file mode 100644
index 0000000..21ea181
Binary files /dev/null and b/examples/samplekeys/idp-ssl-trust.jks differ
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/c20e4856/examples/samplekeys/rp-ssl-key.jks
----------------------------------------------------------------------
diff --git a/examples/samplekeys/rp-ssl-key.jks b/examples/samplekeys/rp-ssl-key.jks
new file mode 100644
index 0000000..f046fd2
Binary files /dev/null and b/examples/samplekeys/rp-ssl-key.jks differ
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/c20e4856/examples/samplekeys/rp-ssl-server.jks
----------------------------------------------------------------------
diff --git a/examples/samplekeys/rp-ssl-server.jks b/examples/samplekeys/rp-ssl-server.jks
deleted file mode 100644
index c37cbbf..0000000
Binary files a/examples/samplekeys/rp-ssl-server.jks and /dev/null differ
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/c20e4856/examples/samplekeys/wsp-ssl-key.jks
----------------------------------------------------------------------
diff --git a/examples/samplekeys/wsp-ssl-key.jks b/examples/samplekeys/wsp-ssl-key.jks
new file mode 100644
index 0000000..7bf442e
Binary files /dev/null and b/examples/samplekeys/wsp-ssl-key.jks differ
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/c20e4856/examples/samplekeys/wsp-ssl-server.jks
----------------------------------------------------------------------
diff --git a/examples/samplekeys/wsp-ssl-server.jks b/examples/samplekeys/wsp-ssl-server.jks
deleted file mode 100644
index b55527a..0000000
Binary files a/examples/samplekeys/wsp-ssl-server.jks and /dev/null differ
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/c20e4856/examples/wsclientWebapp/webapp/src/main/resources/rp-ssl-key.jks
----------------------------------------------------------------------
diff --git a/examples/wsclientWebapp/webapp/src/main/resources/rp-ssl-key.jks b/examples/wsclientWebapp/webapp/src/main/resources/rp-ssl-key.jks
index c37cbbf..f046fd2 100644
Binary files a/examples/wsclientWebapp/webapp/src/main/resources/rp-ssl-key.jks and b/examples/wsclientWebapp/webapp/src/main/resources/rp-ssl-key.jks differ
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/c20e4856/examples/wsclientWebapp/webapp/src/main/resources/webappKeystore.jks
----------------------------------------------------------------------
diff --git a/examples/wsclientWebapp/webapp/src/main/resources/webappKeystore.jks b/examples/wsclientWebapp/webapp/src/main/resources/webappKeystore.jks
index 7fd4daf..dc396f6 100644
Binary files a/examples/wsclientWebapp/webapp/src/main/resources/webappKeystore.jks and b/examples/wsclientWebapp/webapp/src/main/resources/webappKeystore.jks differ
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/c20e4856/services/idp/pom.xml
----------------------------------------------------------------------
diff --git a/services/idp/pom.xml b/services/idp/pom.xml
index 9d38e31..867ca9d 100644
--- a/services/idp/pom.xml
+++ b/services/idp/pom.xml
@@ -376,7 +376,7 @@
<connector implementation="org.eclipse.jetty.server.ssl.SslSelectChannelConnector">
<port>${idp.https.port}</port>
<maxIdleTime>30000</maxIdleTime>
- <keystore>${basedir}/../../examples/samplekeys/idp-ssl-server.jks</keystore>
+ <keystore>${basedir}/../../examples/samplekeys/idp-ssl-key.jks</keystore>
<keyPassword>tompass</keyPassword>
<password>tompass</password>
</connector>
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/c20e4856/services/idp/src/main/resources/idp-ssl-key.jks
----------------------------------------------------------------------
diff --git a/services/idp/src/main/resources/idp-ssl-key.jks b/services/idp/src/main/resources/idp-ssl-key.jks
index ae16a55..ae3d010 100644
Binary files a/services/idp/src/main/resources/idp-ssl-key.jks and b/services/idp/src/main/resources/idp-ssl-key.jks differ
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/c20e4856/services/idp/src/main/resources/idp-ssl-trust.jks
----------------------------------------------------------------------
diff --git a/services/idp/src/main/resources/idp-ssl-trust.jks b/services/idp/src/main/resources/idp-ssl-trust.jks
index c8b7d25..21ea181 100644
Binary files a/services/idp/src/main/resources/idp-ssl-trust.jks and b/services/idp/src/main/resources/idp-ssl-trust.jks differ
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/c20e4856/services/idp/src/main/resources/stsrealm_a.jks
----------------------------------------------------------------------
diff --git a/services/idp/src/main/resources/stsrealm_a.jks b/services/idp/src/main/resources/stsrealm_a.jks
index 5c3989a..fde2928 100644
Binary files a/services/idp/src/main/resources/stsrealm_a.jks and b/services/idp/src/main/resources/stsrealm_a.jks differ
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/c20e4856/services/idp/src/main/resources/stsrealm_b.jks
----------------------------------------------------------------------
diff --git a/services/idp/src/main/resources/stsrealm_b.jks b/services/idp/src/main/resources/stsrealm_b.jks
index 02075e6..83fd045 100644
Binary files a/services/idp/src/main/resources/stsrealm_b.jks and b/services/idp/src/main/resources/stsrealm_b.jks differ
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/c20e4856/services/idp/src/test/resources/rest-client.xml
----------------------------------------------------------------------
diff --git a/services/idp/src/test/resources/rest-client.xml b/services/idp/src/test/resources/rest-client.xml
index 1c4e011..fdd9702 100644
--- a/services/idp/src/test/resources/rest-client.xml
+++ b/services/idp/src/test/resources/rest-client.xml
@@ -25,7 +25,7 @@
<http:client ConnectionTimeout="3000000" ReceiveTimeout="3000000"/>
<http:tlsClientParameters disableCNCheck="true">
<sec:trustManagers>
- <sec:keyStore type="JKS" password="tompass" file="../../examples/samplekeys/idp-ssl-server.jks"/>
+ <sec:keyStore type="JKS" password="tompass" file="../../examples/samplekeys/idp-ssl-key.jks"/>
</sec:trustManagers>
</http:tlsClientParameters>
</http:conduit>
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/c20e4856/services/idp/src/test/resources/stsrealm_a.jks
----------------------------------------------------------------------
diff --git a/services/idp/src/test/resources/stsrealm_a.jks b/services/idp/src/test/resources/stsrealm_a.jks
index 5c3989a..fde2928 100644
Binary files a/services/idp/src/test/resources/stsrealm_a.jks and b/services/idp/src/test/resources/stsrealm_a.jks differ
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/c20e4856/services/pom.xml
----------------------------------------------------------------------
diff --git a/services/pom.xml b/services/pom.xml
index 863d905..4240f03 100644
--- a/services/pom.xml
+++ b/services/pom.xml
@@ -31,7 +31,7 @@
<packaging>pom</packaging>
<modules>
- <module>idp</module>
<module>sts</module>
+ <module>idp</module>
</modules>
</project>
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/c20e4856/services/sts/src/main/resources/realma.cert
----------------------------------------------------------------------
diff --git a/services/sts/src/main/resources/realma.cert b/services/sts/src/main/resources/realma.cert
index 335e880..ff97f79 100644
Binary files a/services/sts/src/main/resources/realma.cert and b/services/sts/src/main/resources/realma.cert differ
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/c20e4856/services/sts/src/main/resources/realmb.cert
----------------------------------------------------------------------
diff --git a/services/sts/src/main/resources/realmb.cert b/services/sts/src/main/resources/realmb.cert
index 2d81938..2932c16 100644
Binary files a/services/sts/src/main/resources/realmb.cert and b/services/sts/src/main/resources/realmb.cert differ
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/c20e4856/services/sts/src/main/resources/stsrealm_a.jks
----------------------------------------------------------------------
diff --git a/services/sts/src/main/resources/stsrealm_a.jks b/services/sts/src/main/resources/stsrealm_a.jks
index 5c3989a..fde2928 100644
Binary files a/services/sts/src/main/resources/stsrealm_a.jks and b/services/sts/src/main/resources/stsrealm_a.jks differ
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/c20e4856/services/sts/src/main/resources/stsrealm_b.jks
----------------------------------------------------------------------
diff --git a/services/sts/src/main/resources/stsrealm_b.jks b/services/sts/src/main/resources/stsrealm_b.jks
index 02075e6..83fd045 100644
Binary files a/services/sts/src/main/resources/stsrealm_b.jks and b/services/sts/src/main/resources/stsrealm_b.jks differ
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/c20e4856/services/sts/src/main/resources/ststrust.jks
----------------------------------------------------------------------
diff --git a/services/sts/src/main/resources/ststrust.jks b/services/sts/src/main/resources/ststrust.jks
index c4d1c1e..e051509 100644
Binary files a/services/sts/src/main/resources/ststrust.jks and b/services/sts/src/main/resources/ststrust.jks differ
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/c20e4856/systests/tomcat7/src/test/resources/alice.cer
----------------------------------------------------------------------
diff --git a/systests/tomcat7/src/test/resources/alice.cer b/systests/tomcat7/src/test/resources/alice.cer
index 82ab5db..9644a0e 100644
Binary files a/systests/tomcat7/src/test/resources/alice.cer and b/systests/tomcat7/src/test/resources/alice.cer differ
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/c20e4856/systests/tomcat7/src/test/resources/alice_client.jks
----------------------------------------------------------------------
diff --git a/systests/tomcat7/src/test/resources/alice_client.jks b/systests/tomcat7/src/test/resources/alice_client.jks
index 5e1bdd2..879df98 100644
Binary files a/systests/tomcat7/src/test/resources/alice_client.jks and b/systests/tomcat7/src/test/resources/alice_client.jks differ
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/c20e4856/systests/tomcat7/src/test/resources/client.jks
----------------------------------------------------------------------
diff --git a/systests/tomcat7/src/test/resources/client.jks b/systests/tomcat7/src/test/resources/client.jks
index 720dbda..fde2928 100644
Binary files a/systests/tomcat7/src/test/resources/client.jks and b/systests/tomcat7/src/test/resources/client.jks differ
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/c20e4856/systests/tomcat7/src/test/resources/clienttrust.jks
----------------------------------------------------------------------
diff --git a/systests/tomcat7/src/test/resources/clienttrust.jks b/systests/tomcat7/src/test/resources/clienttrust.jks
index 3631d08..c3ad459 100644
Binary files a/systests/tomcat7/src/test/resources/clienttrust.jks and b/systests/tomcat7/src/test/resources/clienttrust.jks differ
http://git-wip-us.apache.org/repos/asf/cxf-fediz/blob/c20e4856/systests/tomcat7/src/test/resources/server.jks
----------------------------------------------------------------------
diff --git a/systests/tomcat7/src/test/resources/server.jks b/systests/tomcat7/src/test/resources/server.jks
index a292ec9..c1efac3 100644
Binary files a/systests/tomcat7/src/test/resources/server.jks and b/systests/tomcat7/src/test/resources/server.jks differ