dxaCryptoGenerateKeystoreSecCommServer.json

Source

dxaCryptoGenerateKeystoreSecCommServer.json

Description

A file containing a GenerateKeystoreSysAction system action that generates the secure communication server keystore system.trust.sec-comm.server. The keystore protects the DirX Access Container via TLS and serves as both keystore and truststore of the internal secure communication.

The generated keystore contains:

  • the KEY_PAIR entry sec-comm.server.dirxaccess with the subject cn=Secure Communication Server,o=${dxaInstanceName},

  • the CERTIFICATE entry sec-comm.server.dirxaccess.trusted paired with the key pair,

  • the CERTIFICATE entry cert-sign.dirxaccess.trusted of the issuing certification authority.

The key pair is signed by the system trust certification authority. The template expects the system trust under the keystore identifier system.trust and protected by the default password:

"issuer": {
  "keystoreId": {
    "key": "system.trust",
    "type": "net.atos.dirx.access.apprepo.api.config.keymanagement.Keystore"
  },
  "keystorePassword": "{default_password}",
  "keyPairAlias": "cert-sign.dirxaccess",
  "pairedAlias": "cert-sign.dirxaccess.trusted"
}

If an explicit system trust is imported instead of the generated one, the issuer key and keystorePassword have to be exchanged accordingly. The same applies to the key and password of the generated keystore itself.

The certificate profile is controlled by the following properties of the KEY_PAIR entry:

Property Description

keyUsage

The X.509 key usage extension as a bit string of nine characters in the RFC 5280 order (digitalSignature, nonRepudiation, keyEncipherment, dataEncipherment, keyAgreement, keyCertSign, cRLSign, encipherOnly, decipherOnly). The default 101000000 sets digitalSignature and keyEncipherment.

extendedKeyUsage

1.3.6.1.5.5.7.3.1 - TLS server authentication.

dnsNames

The subject alternative names of the certificate. A client accepts the certificate only if the host name it uses to reach the server is among them.

subjectDn

The subject distinguished name of the generated certificate.

The keystore generated by this system action is referenced through the crypto container created by dxaConfigPortAssignmentSsl.json.

This template is applied implicitly by the DirX Access Installer for every deployment approach - see Startup Folder Prepared by the Installer. For the production-grade customization of the whole chain, see How to Set up the Production Environment.

Variables

${loadBalancerHostName}

Host name at which the DirX Access Server can be reached publicly (from the extranet). Filled by the installer with the “Server hostname” (services.native.hostname) value and to be changed manually if the public name differs.

${dxaServerHostName}

Host name of the actual instance of the DirX Access Server (services.native.hostname).

${dxaInstanceName}

Name of the DirX Access Server instance (services.instance.name), used in the subject distinguished name.