dxaCryptoGenerateKeystoreSecCommClient.json

Source

dxaCryptoGenerateKeystoreSecCommClient.json

Description

A file containing a GenerateKeystoreSysAction system action that generates the secure communication client keystore system.trust.sec-comm.client. The keystore is distributed to the DirX Access internal client components (PEPs) and secures the communication between them and the DirX Access Container via TLS. Any component able to present this keystore gets privileged access to the DirX Access Services API.

The generated keystore contains:

  • the KEY_PAIR entry sec-comm.client.dirxaccess with the subject cn=Secure Communication Client,o=${dxaInstanceName},

  • the CERTIFICATE entry sec-comm.client.dirxaccess.trusted paired with the key pair,

  • the CERTIFICATE entry cert-sign.dirxaccess.trusted of the issuing certification authority.

The key pair is signed by the system trust certification authority, which the template expects under the keystore identifier system.trust and protected by the default password. The certificate is generated with the digitalSignature key usage (100000000) and the extended key usage 1.3.6.1.5.5.7.3.2 - TLS client authentication.

If an explicit system trust is imported instead of the generated one, the issuer key and keystorePassword have to be exchanged accordingly, as well as the key and password of the generated keystore itself. The regenerated keystore has to be redistributed to all internal client components - see Keystore Management.

See also the server-side counterpart dxaCryptoGenerateKeystoreSecCommServer.json and How to Set up the Production Environment.

This template is not applied by the DirX Access Installer - it has to be applied explicitly. It also exports the generated keystore as an archive ("type": "ARCHIVE") into the folder given by the target property, which has to be adapted to the target system before the file is applied.

Variables

${dxaInstanceName}

Name of the DirX Access Server instance (services.instance.name), used in the subject distinguished name.