3.3. Specifying an Application's Own Certificate
3.3.1. Deploying Own Certificate for HTTPS
Overview
When working with the HTTPS transport the application's certificate is deployed using the XML configuration file.
Procedure
To deploy an application's own certificate for the HTTPS transport, perform the following steps:
- Obtain an application certificate in Java keystore format, CertName
.jks. For instructions on how to create a certificate in Java keystore format, see Section 2.5.3, “Use the CA to Create Signed Certificates in a Java Keystore”.NoteSome HTTPS clients (for example, Web browsers) perform a URL integrity check, which requires a certificate's identity to match the hostname on which the server is deployed. See Section 2.4, “Special Requirements on HTTPS Certificates” for details. - Copy the certificate's keystore, CertName
.jks, to the certificates directory on the deployment host; for example, X509Deploy/certs.The certificates directory should be a secure directory that is writable only by administrators and other privileged users. - Edit the relevant XML configuration file to specify the location of the certificate keystore, CertName
.jks. You must include thesec:keyManagerselement in the configuration of the relevant HTTPS ports.For example, you can configure a client port as follows:<http:conduit id="{Namespace}PortName.http-conduit"> <http:tlsClientParameters> ... <sec:keyManagers keyPassword="CertPassword"> <sec:keyStore type="JKS" password="KeystorePassword" file="certs/CertName.jks"/> </sec:keyManagers> ... </http:tlsClientParameters> </http:conduit>Where thekeyPasswordattribute specifies the password needed to decrypt the certificate's private key (that is, CertPassword), thetypeattribute specifes that the truststore uses the JKS keystore implementation, and thepasswordattribute specifies the password required to access the CertName.jkskeystore (that is, KeystorePassword).Configure a server port as follows:<http:destination id="{Namespace}PortName.http-destination"> <http:tlsServerParameters secureSocketProtocol="TLSv1"> ... <sec:keyManagers keyPassword="CertPassword"> <sec:keyStore type="JKS" password="KeystorePassword" file="certs/CertName.jks"/> </sec:keyManagers> ... </http:tlsServerParameters> </http:destination>ImportantYou must setsecureSocketProtocoltoTLSv1on the server side, in order to protect against the Poodle vulnerability (CVE-2014-3566)WarningThe directory containing the application certificates (for example, X509Deploy/certs/) should be a secure directory (that is, readable and writable only by the administrator).WarningThe directory containing the XML configuration file should be a secure directory (that is, readable and writable only by the administrator), because the configuration file contains passwords in plain text.
