You are viewing a plain text version of this content. The canonical link for it is here.
Posted to dev@syncope.apache.org by Bob Lannoy <bo...@gmail.com> on 2012/03/29 09:25:49 UTC
SSL
Hi,
with the remark about the use of MD5, I thought of something else.
If I'm not mistaken the connection between console and core is over plain HTTP.
Do you plan supporting SSL connections between both? I put core behind
SSL but then the console didn't connect.
I saw in the trunk that in the configuration properties for the
console the protocol (scheme) option has been split out so maybe
you're already planning this?
regards
Bob
Re: SSL
Posted by Francesco Chicchiriccò <il...@apache.org>.
On 29/03/2012 15:40, Colm O hEigeartaigh wrote:
> Hi Francesco,
>
> Is it also possible to authenticate using 2-way TLS instead of HTTP/BA
> for the REST API?
This would require additional setup by at least tweaking Spring Security
configuration in [1]: this would be matter for a nice HOWTO wiki page as
well ;-)
Regards.
[1]
https://svn.apache.org/repos/asf/incubator/syncope/trunk/core/src/main/resources/securityContext.xml
> 2012/3/29 Francesco Chicchiriccò <il...@apache.org>:
>> On 29/03/2012 09:25, Bob Lannoy wrote:
>>> Hi,
>>>
>>> with the remark about the use of MD5, I thought of something else.
>>> If I'm not mistaken the connection between console and core is over plain HTTP.
>>> Do you plan supporting SSL connections between both? I put core behind
>>> SSL but then the console didn't connect.
>>> I saw in the trunk that in the configuration properties for the
>>> console the protocol (scheme) option has been split out so maybe
>>> you're already planning this?
>> Hi Bob,
>> there is nothing, in principle, that will obstacle core webapp to be
>> available in HTTPS only (and hence the console to connect via HTTPS to
>> the core): only, be sure to overcome usual issues arising when using
>> self-signed certificates in Java: here is a brief checklist I would suggest:
>>
>> 1. put the servlet container with core webapp deployed inside in HTTPS
>> 2. add the certificate of the CA you have used to sign the certificate
>> for the step above in a trustore
>> 3. reference the trustore above when launching the servlet container
>> with console webapp deployed inside
>>
>> This should work: please, let us know whether you succeed.
>> It could also be the case to add a page on our wiki about this.
>>
>> Regards.
--
Francesco Chicchiriccò
Apache Cocoon PMC and Apache Syncope PPMC Member
http://people.apache.org/~ilgrosso/
Re: SSL
Posted by Colm O hEigeartaigh <co...@apache.org>.
Hi Francesco,
Is it also possible to authenticate using 2-way TLS instead of HTTP/BA
for the REST API?
Colm.
2012/3/29 Francesco Chicchiriccò <il...@apache.org>:
> On 29/03/2012 09:25, Bob Lannoy wrote:
>> Hi,
>>
>> with the remark about the use of MD5, I thought of something else.
>> If I'm not mistaken the connection between console and core is over plain HTTP.
>> Do you plan supporting SSL connections between both? I put core behind
>> SSL but then the console didn't connect.
>> I saw in the trunk that in the configuration properties for the
>> console the protocol (scheme) option has been split out so maybe
>> you're already planning this?
>
> Hi Bob,
> there is nothing, in principle, that will obstacle core webapp to be
> available in HTTPS only (and hence the console to connect via HTTPS to
> the core): only, be sure to overcome usual issues arising when using
> self-signed certificates in Java: here is a brief checklist I would suggest:
>
> 1. put the servlet container with core webapp deployed inside in HTTPS
> 2. add the certificate of the CA you have used to sign the certificate
> for the step above in a trustore
> 3. reference the trustore above when launching the servlet container
> with console webapp deployed inside
>
> This should work: please, let us know whether you succeed.
> It could also be the case to add a page on our wiki about this.
>
> Regards.
>
> --
> Francesco Chicchiriccò
>
> Apache Cocoon PMC and Apache Syncope PPMC Member
> http://people.apache.org/~ilgrosso/
>
--
Colm O hEigeartaigh
Talend Community Coder
http://coders.talend.com
Re: SSL
Posted by Bob Lannoy <bo...@gmail.com>.
Hi,
I found a way to specify the keystore to the app.
I didn't do this in console but in my own app based on how console
does the connection.
I case this might be handy in the future:
* spring ws security has a keystorefactory bean so I used that, but
it's also possible to write it yourself
I put two params in configuration.properties (ssltruststore and
ssltruststorepass)
this is used in the spring config:
<bean id="trustStore"
class="org.springframework.ws.soap.security.support.KeyStoreFactoryBean">
<property name="password" value="${ssltruststorepass}"/>
<property name="location" value="file:${ssltruststore}"/>
</bean>
(the advantage of a custom bean would be the possibility to encrypt
the password)
And then in the connection code (assuming I already have the
requestFactory object)
you need to set the truststore.
if (requestFactory.getHttpClient().getConnectionManager().getSchemeRegistry().getScheme("https")!=null){
trustStore=(KeyStore) applicationContext.getBean("trustStore");
try{
SSLSocketFactory sslSocketFactory=new SSLSocketFactory(trustStore);
requestFactory.getHttpClient().getConnectionManager().getSchemeRegistry().register(new
Scheme("https",443,sslSocketFactory));
}
catch (Exception e)
{
...
}
The port number in the scheme doesn't seem to matter.
I think this might also be a first step into two way ssl
regards
Bob
On 30 March 2012 14:59, Fabio Martelli <fa...@gmail.com> wrote:
>
> Il giorno 30/mar/2012, alle ore 14.55, Bob Lannoy ha scritto:
>
>> Hi,
>>
>> I think the connector element is to connect to the webapp, it's not to
>> specify the truststore that a webapp can use to connect to another
>> server
>
> Ops, you are right. The only chance you have is to use the default jvm truststore (probably $JAVA_HOME/jre/lib/security/cacerts).
> Sorry for the misunderstanding.
>
> Regards,
> F.
>
>>
>> Bob
>>
>> On 30 March 2012 14:53, Fabio Martelli <fa...@gmail.com> wrote:
>>>
>>> Il giorno 30/mar/2012, alle ore 14.49, Bob Lannoy ha scritto:
>>>
>>>> Hi Fabio,
>>>>
>>>> what do you mean by "configure your tomcat container with syncope
>>>> console deployed inside in order to use the new truststore."
>>>> I guess this is what I did by specifying de JAVA_OPTS on startup of tomcat?
>>>
>>> You can modify your server.xml in order to add truststore file and password inside the right "Connector" element.
>>>
>>> F.
>>>
>>>>
>>>> Bob
>>>>
>>>> On 30 March 2012 14:18, Fabio Martelli <fa...@gmail.com> wrote:
>>>>>
>>>>> Il giorno 30/mar/2012, alle ore 09.50, Bob Lannoy ha scritto:
>>>>>
>>>>>> Hi Francesco,
>>>>>>
>>>>>> indeed it works ;)
>>>>>> I did it on a Tomcat 6 instance.
>>>>>> * enabled SSL for core
>>>>>> * referenced the truststore for console through JVM params
>>>>>> -Djavax.net.ssl.trustStore="...mykeystore.jks"
>>>>>> -Djavax.net.ssl.trustStorePassword="mykeystore"
>>>>>> * put the right params in configuration.properties (https, hostname as
>>>>>> in certificate)
>>>>>> I'll be happy to put up a wiki page for that.
>>>>>> There's one thing I didn't like and that's I have to pass the
>>>>>> truststore params to the VM in command line.
>>>>>> Perhaps there's a way to specify the truststore in the configuration somewhere?
>>>>>
>>>>> Hi Bob,
>>>>> you can configure your tomcat container with syncope console deployed inside in order to use the new truststore.
>>>>> Alternatively you can add CA certificate in the default jvm truststore.
>>>>>
>>>>> Regards,
>>>>> F.
>>>>>
>>>>>>
>>>>>> regards
>>>>>>
>>>>>> Bob
>>>>>>
>>>>>> 2012/3/29 Francesco Chicchiriccò <il...@apache.org>:
>>>>>>> On 29/03/2012 09:25, Bob Lannoy wrote:
>>>>>>>> Hi,
>>>>>>>>
>>>>>>>> with the remark about the use of MD5, I thought of something else.
>>>>>>>> If I'm not mistaken the connection between console and core is over plain HTTP.
>>>>>>>> Do you plan supporting SSL connections between both? I put core behind
>>>>>>>> SSL but then the console didn't connect.
>>>>>>>> I saw in the trunk that in the configuration properties for the
>>>>>>>> console the protocol (scheme) option has been split out so maybe
>>>>>>>> you're already planning this?
>>>>>>>
>>>>>>> Hi Bob,
>>>>>>> there is nothing, in principle, that will obstacle core webapp to be
>>>>>>> available in HTTPS only (and hence the console to connect via HTTPS to
>>>>>>> the core): only, be sure to overcome usual issues arising when using
>>>>>>> self-signed certificates in Java: here is a brief checklist I would suggest:
>>>>>>>
>>>>>>> 1. put the servlet container with core webapp deployed inside in HTTPS
>>>>>>> 2. add the certificate of the CA you have used to sign the certificate
>>>>>>> for the step above in a trustore
>>>>>>> 3. reference the trustore above when launching the servlet container
>>>>>>> with console webapp deployed inside
>>>>>>>
>>>>>>> This should work: please, let us know whether you succeed.
>>>>>>> It could also be the case to add a page on our wiki about this.
>>>>>>>
>>>>>>> Regards.
>>>>>>>
>>>>>>> --
>>>>>>> Francesco Chicchiriccò
>>>>>>>
>>>>>>> Apache Cocoon PMC and Apache Syncope PPMC Member
>>>>>>> http://people.apache.org/~ilgrosso/
>>>>>>>
>>>>>
>>>
>
Re: SSL
Posted by Fabio Martelli <fa...@gmail.com>.
Il giorno 30/mar/2012, alle ore 14.55, Bob Lannoy ha scritto:
> Hi,
>
> I think the connector element is to connect to the webapp, it's not to
> specify the truststore that a webapp can use to connect to another
> server
Ops, you are right. The only chance you have is to use the default jvm truststore (probably $JAVA_HOME/jre/lib/security/cacerts).
Sorry for the misunderstanding.
Regards,
F.
>
> Bob
>
> On 30 March 2012 14:53, Fabio Martelli <fa...@gmail.com> wrote:
>>
>> Il giorno 30/mar/2012, alle ore 14.49, Bob Lannoy ha scritto:
>>
>>> Hi Fabio,
>>>
>>> what do you mean by "configure your tomcat container with syncope
>>> console deployed inside in order to use the new truststore."
>>> I guess this is what I did by specifying de JAVA_OPTS on startup of tomcat?
>>
>> You can modify your server.xml in order to add truststore file and password inside the right "Connector" element.
>>
>> F.
>>
>>>
>>> Bob
>>>
>>> On 30 March 2012 14:18, Fabio Martelli <fa...@gmail.com> wrote:
>>>>
>>>> Il giorno 30/mar/2012, alle ore 09.50, Bob Lannoy ha scritto:
>>>>
>>>>> Hi Francesco,
>>>>>
>>>>> indeed it works ;)
>>>>> I did it on a Tomcat 6 instance.
>>>>> * enabled SSL for core
>>>>> * referenced the truststore for console through JVM params
>>>>> -Djavax.net.ssl.trustStore="...mykeystore.jks"
>>>>> -Djavax.net.ssl.trustStorePassword="mykeystore"
>>>>> * put the right params in configuration.properties (https, hostname as
>>>>> in certificate)
>>>>> I'll be happy to put up a wiki page for that.
>>>>> There's one thing I didn't like and that's I have to pass the
>>>>> truststore params to the VM in command line.
>>>>> Perhaps there's a way to specify the truststore in the configuration somewhere?
>>>>
>>>> Hi Bob,
>>>> you can configure your tomcat container with syncope console deployed inside in order to use the new truststore.
>>>> Alternatively you can add CA certificate in the default jvm truststore.
>>>>
>>>> Regards,
>>>> F.
>>>>
>>>>>
>>>>> regards
>>>>>
>>>>> Bob
>>>>>
>>>>> 2012/3/29 Francesco Chicchiriccò <il...@apache.org>:
>>>>>> On 29/03/2012 09:25, Bob Lannoy wrote:
>>>>>>> Hi,
>>>>>>>
>>>>>>> with the remark about the use of MD5, I thought of something else.
>>>>>>> If I'm not mistaken the connection between console and core is over plain HTTP.
>>>>>>> Do you plan supporting SSL connections between both? I put core behind
>>>>>>> SSL but then the console didn't connect.
>>>>>>> I saw in the trunk that in the configuration properties for the
>>>>>>> console the protocol (scheme) option has been split out so maybe
>>>>>>> you're already planning this?
>>>>>>
>>>>>> Hi Bob,
>>>>>> there is nothing, in principle, that will obstacle core webapp to be
>>>>>> available in HTTPS only (and hence the console to connect via HTTPS to
>>>>>> the core): only, be sure to overcome usual issues arising when using
>>>>>> self-signed certificates in Java: here is a brief checklist I would suggest:
>>>>>>
>>>>>> 1. put the servlet container with core webapp deployed inside in HTTPS
>>>>>> 2. add the certificate of the CA you have used to sign the certificate
>>>>>> for the step above in a trustore
>>>>>> 3. reference the trustore above when launching the servlet container
>>>>>> with console webapp deployed inside
>>>>>>
>>>>>> This should work: please, let us know whether you succeed.
>>>>>> It could also be the case to add a page on our wiki about this.
>>>>>>
>>>>>> Regards.
>>>>>>
>>>>>> --
>>>>>> Francesco Chicchiriccò
>>>>>>
>>>>>> Apache Cocoon PMC and Apache Syncope PPMC Member
>>>>>> http://people.apache.org/~ilgrosso/
>>>>>>
>>>>
>>
Re: SSL
Posted by Bob Lannoy <bo...@gmail.com>.
Hi,
I think the connector element is to connect to the webapp, it's not to
specify the truststore that a webapp can use to connect to another
server
Bob
On 30 March 2012 14:53, Fabio Martelli <fa...@gmail.com> wrote:
>
> Il giorno 30/mar/2012, alle ore 14.49, Bob Lannoy ha scritto:
>
>> Hi Fabio,
>>
>> what do you mean by "configure your tomcat container with syncope
>> console deployed inside in order to use the new truststore."
>> I guess this is what I did by specifying de JAVA_OPTS on startup of tomcat?
>
> You can modify your server.xml in order to add truststore file and password inside the right "Connector" element.
>
> F.
>
>>
>> Bob
>>
>> On 30 March 2012 14:18, Fabio Martelli <fa...@gmail.com> wrote:
>>>
>>> Il giorno 30/mar/2012, alle ore 09.50, Bob Lannoy ha scritto:
>>>
>>>> Hi Francesco,
>>>>
>>>> indeed it works ;)
>>>> I did it on a Tomcat 6 instance.
>>>> * enabled SSL for core
>>>> * referenced the truststore for console through JVM params
>>>> -Djavax.net.ssl.trustStore="...mykeystore.jks"
>>>> -Djavax.net.ssl.trustStorePassword="mykeystore"
>>>> * put the right params in configuration.properties (https, hostname as
>>>> in certificate)
>>>> I'll be happy to put up a wiki page for that.
>>>> There's one thing I didn't like and that's I have to pass the
>>>> truststore params to the VM in command line.
>>>> Perhaps there's a way to specify the truststore in the configuration somewhere?
>>>
>>> Hi Bob,
>>> you can configure your tomcat container with syncope console deployed inside in order to use the new truststore.
>>> Alternatively you can add CA certificate in the default jvm truststore.
>>>
>>> Regards,
>>> F.
>>>
>>>>
>>>> regards
>>>>
>>>> Bob
>>>>
>>>> 2012/3/29 Francesco Chicchiriccò <il...@apache.org>:
>>>>> On 29/03/2012 09:25, Bob Lannoy wrote:
>>>>>> Hi,
>>>>>>
>>>>>> with the remark about the use of MD5, I thought of something else.
>>>>>> If I'm not mistaken the connection between console and core is over plain HTTP.
>>>>>> Do you plan supporting SSL connections between both? I put core behind
>>>>>> SSL but then the console didn't connect.
>>>>>> I saw in the trunk that in the configuration properties for the
>>>>>> console the protocol (scheme) option has been split out so maybe
>>>>>> you're already planning this?
>>>>>
>>>>> Hi Bob,
>>>>> there is nothing, in principle, that will obstacle core webapp to be
>>>>> available in HTTPS only (and hence the console to connect via HTTPS to
>>>>> the core): only, be sure to overcome usual issues arising when using
>>>>> self-signed certificates in Java: here is a brief checklist I would suggest:
>>>>>
>>>>> 1. put the servlet container with core webapp deployed inside in HTTPS
>>>>> 2. add the certificate of the CA you have used to sign the certificate
>>>>> for the step above in a trustore
>>>>> 3. reference the trustore above when launching the servlet container
>>>>> with console webapp deployed inside
>>>>>
>>>>> This should work: please, let us know whether you succeed.
>>>>> It could also be the case to add a page on our wiki about this.
>>>>>
>>>>> Regards.
>>>>>
>>>>> --
>>>>> Francesco Chicchiriccò
>>>>>
>>>>> Apache Cocoon PMC and Apache Syncope PPMC Member
>>>>> http://people.apache.org/~ilgrosso/
>>>>>
>>>
>
Re: SSL
Posted by Fabio Martelli <fa...@gmail.com>.
Il giorno 30/mar/2012, alle ore 14.49, Bob Lannoy ha scritto:
> Hi Fabio,
>
> what do you mean by "configure your tomcat container with syncope
> console deployed inside in order to use the new truststore."
> I guess this is what I did by specifying de JAVA_OPTS on startup of tomcat?
You can modify your server.xml in order to add truststore file and password inside the right "Connector" element.
F.
>
> Bob
>
> On 30 March 2012 14:18, Fabio Martelli <fa...@gmail.com> wrote:
>>
>> Il giorno 30/mar/2012, alle ore 09.50, Bob Lannoy ha scritto:
>>
>>> Hi Francesco,
>>>
>>> indeed it works ;)
>>> I did it on a Tomcat 6 instance.
>>> * enabled SSL for core
>>> * referenced the truststore for console through JVM params
>>> -Djavax.net.ssl.trustStore="...mykeystore.jks"
>>> -Djavax.net.ssl.trustStorePassword="mykeystore"
>>> * put the right params in configuration.properties (https, hostname as
>>> in certificate)
>>> I'll be happy to put up a wiki page for that.
>>> There's one thing I didn't like and that's I have to pass the
>>> truststore params to the VM in command line.
>>> Perhaps there's a way to specify the truststore in the configuration somewhere?
>>
>> Hi Bob,
>> you can configure your tomcat container with syncope console deployed inside in order to use the new truststore.
>> Alternatively you can add CA certificate in the default jvm truststore.
>>
>> Regards,
>> F.
>>
>>>
>>> regards
>>>
>>> Bob
>>>
>>> 2012/3/29 Francesco Chicchiriccò <il...@apache.org>:
>>>> On 29/03/2012 09:25, Bob Lannoy wrote:
>>>>> Hi,
>>>>>
>>>>> with the remark about the use of MD5, I thought of something else.
>>>>> If I'm not mistaken the connection between console and core is over plain HTTP.
>>>>> Do you plan supporting SSL connections between both? I put core behind
>>>>> SSL but then the console didn't connect.
>>>>> I saw in the trunk that in the configuration properties for the
>>>>> console the protocol (scheme) option has been split out so maybe
>>>>> you're already planning this?
>>>>
>>>> Hi Bob,
>>>> there is nothing, in principle, that will obstacle core webapp to be
>>>> available in HTTPS only (and hence the console to connect via HTTPS to
>>>> the core): only, be sure to overcome usual issues arising when using
>>>> self-signed certificates in Java: here is a brief checklist I would suggest:
>>>>
>>>> 1. put the servlet container with core webapp deployed inside in HTTPS
>>>> 2. add the certificate of the CA you have used to sign the certificate
>>>> for the step above in a trustore
>>>> 3. reference the trustore above when launching the servlet container
>>>> with console webapp deployed inside
>>>>
>>>> This should work: please, let us know whether you succeed.
>>>> It could also be the case to add a page on our wiki about this.
>>>>
>>>> Regards.
>>>>
>>>> --
>>>> Francesco Chicchiriccò
>>>>
>>>> Apache Cocoon PMC and Apache Syncope PPMC Member
>>>> http://people.apache.org/~ilgrosso/
>>>>
>>
Re: SSL
Posted by Bob Lannoy <bo...@gmail.com>.
Hi Fabio,
what do you mean by "configure your tomcat container with syncope
console deployed inside in order to use the new truststore."
I guess this is what I did by specifying de JAVA_OPTS on startup of tomcat?
Bob
On 30 March 2012 14:18, Fabio Martelli <fa...@gmail.com> wrote:
>
> Il giorno 30/mar/2012, alle ore 09.50, Bob Lannoy ha scritto:
>
>> Hi Francesco,
>>
>> indeed it works ;)
>> I did it on a Tomcat 6 instance.
>> * enabled SSL for core
>> * referenced the truststore for console through JVM params
>> -Djavax.net.ssl.trustStore="...mykeystore.jks"
>> -Djavax.net.ssl.trustStorePassword="mykeystore"
>> * put the right params in configuration.properties (https, hostname as
>> in certificate)
>> I'll be happy to put up a wiki page for that.
>> There's one thing I didn't like and that's I have to pass the
>> truststore params to the VM in command line.
>> Perhaps there's a way to specify the truststore in the configuration somewhere?
>
> Hi Bob,
> you can configure your tomcat container with syncope console deployed inside in order to use the new truststore.
> Alternatively you can add CA certificate in the default jvm truststore.
>
> Regards,
> F.
>
>>
>> regards
>>
>> Bob
>>
>> 2012/3/29 Francesco Chicchiriccò <il...@apache.org>:
>>> On 29/03/2012 09:25, Bob Lannoy wrote:
>>>> Hi,
>>>>
>>>> with the remark about the use of MD5, I thought of something else.
>>>> If I'm not mistaken the connection between console and core is over plain HTTP.
>>>> Do you plan supporting SSL connections between both? I put core behind
>>>> SSL but then the console didn't connect.
>>>> I saw in the trunk that in the configuration properties for the
>>>> console the protocol (scheme) option has been split out so maybe
>>>> you're already planning this?
>>>
>>> Hi Bob,
>>> there is nothing, in principle, that will obstacle core webapp to be
>>> available in HTTPS only (and hence the console to connect via HTTPS to
>>> the core): only, be sure to overcome usual issues arising when using
>>> self-signed certificates in Java: here is a brief checklist I would suggest:
>>>
>>> 1. put the servlet container with core webapp deployed inside in HTTPS
>>> 2. add the certificate of the CA you have used to sign the certificate
>>> for the step above in a trustore
>>> 3. reference the trustore above when launching the servlet container
>>> with console webapp deployed inside
>>>
>>> This should work: please, let us know whether you succeed.
>>> It could also be the case to add a page on our wiki about this.
>>>
>>> Regards.
>>>
>>> --
>>> Francesco Chicchiriccò
>>>
>>> Apache Cocoon PMC and Apache Syncope PPMC Member
>>> http://people.apache.org/~ilgrosso/
>>>
>
Re: SSL
Posted by Fabio Martelli <fa...@gmail.com>.
Il giorno 30/mar/2012, alle ore 09.50, Bob Lannoy ha scritto:
> Hi Francesco,
>
> indeed it works ;)
> I did it on a Tomcat 6 instance.
> * enabled SSL for core
> * referenced the truststore for console through JVM params
> -Djavax.net.ssl.trustStore="...mykeystore.jks"
> -Djavax.net.ssl.trustStorePassword="mykeystore"
> * put the right params in configuration.properties (https, hostname as
> in certificate)
> I'll be happy to put up a wiki page for that.
> There's one thing I didn't like and that's I have to pass the
> truststore params to the VM in command line.
> Perhaps there's a way to specify the truststore in the configuration somewhere?
Hi Bob,
you can configure your tomcat container with syncope console deployed inside in order to use the new truststore.
Alternatively you can add CA certificate in the default jvm truststore.
Regards,
F.
>
> regards
>
> Bob
>
> 2012/3/29 Francesco Chicchiriccò <il...@apache.org>:
>> On 29/03/2012 09:25, Bob Lannoy wrote:
>>> Hi,
>>>
>>> with the remark about the use of MD5, I thought of something else.
>>> If I'm not mistaken the connection between console and core is over plain HTTP.
>>> Do you plan supporting SSL connections between both? I put core behind
>>> SSL but then the console didn't connect.
>>> I saw in the trunk that in the configuration properties for the
>>> console the protocol (scheme) option has been split out so maybe
>>> you're already planning this?
>>
>> Hi Bob,
>> there is nothing, in principle, that will obstacle core webapp to be
>> available in HTTPS only (and hence the console to connect via HTTPS to
>> the core): only, be sure to overcome usual issues arising when using
>> self-signed certificates in Java: here is a brief checklist I would suggest:
>>
>> 1. put the servlet container with core webapp deployed inside in HTTPS
>> 2. add the certificate of the CA you have used to sign the certificate
>> for the step above in a trustore
>> 3. reference the trustore above when launching the servlet container
>> with console webapp deployed inside
>>
>> This should work: please, let us know whether you succeed.
>> It could also be the case to add a page on our wiki about this.
>>
>> Regards.
>>
>> --
>> Francesco Chicchiriccò
>>
>> Apache Cocoon PMC and Apache Syncope PPMC Member
>> http://people.apache.org/~ilgrosso/
>>
Re: SSL
Posted by Bob Lannoy <bo...@gmail.com>.
Hi Francesco,
indeed it works ;)
I did it on a Tomcat 6 instance.
* enabled SSL for core
* referenced the truststore for console through JVM params
-Djavax.net.ssl.trustStore="...mykeystore.jks"
-Djavax.net.ssl.trustStorePassword="mykeystore"
* put the right params in configuration.properties (https, hostname as
in certificate)
I'll be happy to put up a wiki page for that.
There's one thing I didn't like and that's I have to pass the
truststore params to the VM in command line.
Perhaps there's a way to specify the truststore in the configuration somewhere?
regards
Bob
2012/3/29 Francesco Chicchiriccò <il...@apache.org>:
> On 29/03/2012 09:25, Bob Lannoy wrote:
>> Hi,
>>
>> with the remark about the use of MD5, I thought of something else.
>> If I'm not mistaken the connection between console and core is over plain HTTP.
>> Do you plan supporting SSL connections between both? I put core behind
>> SSL but then the console didn't connect.
>> I saw in the trunk that in the configuration properties for the
>> console the protocol (scheme) option has been split out so maybe
>> you're already planning this?
>
> Hi Bob,
> there is nothing, in principle, that will obstacle core webapp to be
> available in HTTPS only (and hence the console to connect via HTTPS to
> the core): only, be sure to overcome usual issues arising when using
> self-signed certificates in Java: here is a brief checklist I would suggest:
>
> 1. put the servlet container with core webapp deployed inside in HTTPS
> 2. add the certificate of the CA you have used to sign the certificate
> for the step above in a trustore
> 3. reference the trustore above when launching the servlet container
> with console webapp deployed inside
>
> This should work: please, let us know whether you succeed.
> It could also be the case to add a page on our wiki about this.
>
> Regards.
>
> --
> Francesco Chicchiriccò
>
> Apache Cocoon PMC and Apache Syncope PPMC Member
> http://people.apache.org/~ilgrosso/
>
Re: SSL
Posted by Francesco Chicchiriccò <il...@apache.org>.
On 29/03/2012 09:25, Bob Lannoy wrote:
> Hi,
>
> with the remark about the use of MD5, I thought of something else.
> If I'm not mistaken the connection between console and core is over plain HTTP.
> Do you plan supporting SSL connections between both? I put core behind
> SSL but then the console didn't connect.
> I saw in the trunk that in the configuration properties for the
> console the protocol (scheme) option has been split out so maybe
> you're already planning this?
Hi Bob,
there is nothing, in principle, that will obstacle core webapp to be
available in HTTPS only (and hence the console to connect via HTTPS to
the core): only, be sure to overcome usual issues arising when using
self-signed certificates in Java: here is a brief checklist I would suggest:
1. put the servlet container with core webapp deployed inside in HTTPS
2. add the certificate of the CA you have used to sign the certificate
for the step above in a trustore
3. reference the trustore above when launching the servlet container
with console webapp deployed inside
This should work: please, let us know whether you succeed.
It could also be the case to add a page on our wiki about this.
Regards.
--
Francesco Chicchiriccò
Apache Cocoon PMC and Apache Syncope PPMC Member
http://people.apache.org/~ilgrosso/