Page History

...

js7 {
    web {
        # keystore and truststore location for https connections
        https {
             client-keystore {
                # Default: ${js7.config-directory}"/private/https-client-keystore.p12"
                file=${js7.config-directory}"/private/https-client-keystore.p12"
                key-password="jobscheduler"
                store-password="jobscheduler
        "
        # alias=
            }
            truststores=[
                {
    keystore {
                # Default: ${js7.config-directory}"/private/https-truststorekeystore.p12"
                    file=${js7.config-directory}"/private/https-truststorekeystore.p12"
                    storekey-password="jobscheduler"
                    # alias=
store-password="jobscheduler"
                # }alias=
            ]}
            truststores=[
                {
                    # Default: ${js7.config-directory}"/private/https-truststore.p12"
                    file=${js7.config-directory}"/private/https-truststore.p12"
                    store-password="jobscheduler"
                    # alias=
                }
            ]
        }
    }
}

Explanation:

Explanation:

• HTTPS keystore and truststore are used to hold private keys and certificates.
  • The keystore holds the Agent's private key and certificate. This information is used:
    • for Server Authentication with JOC Cockpit and
    • for Client Authentication with Agents.
  • The truststore holds the certificate(s) used to verify:
    • Client Authentication certificates presented by a Controller and
    • Server Authentication certificates challenged by pairing Controllers.
• Optionally a separate HTTPS client keystore can be used:
  • The client keystore is used for HTTPS mutual authentication and holds a private key and certificate created for Client Auth extended key usage. 
  • When using HTTPS mutual authentication then:
    • a single certificate can be used that is generated for both Server Auth and Client Auth extended key use. In this case do not use the HTTPS client keystore but use the HTTPS keystore to hold the certificate.
    • separate certificates can be used with the certificate for Server Auth key usage being stored with the HTTPS keystore and the certificate for Client Auth key use being stored with the HTTPS client keystore.
  • For details see 

    Jira
    server SOS JIRA columns key,summary,type,created,updated,due,assignee,reporter,priority,status,resolution serverId 6dc67751-9d67-34cd-985b-194a8cdc9602 key JS-1959

  HTTPS keystore and truststore are used to hold private keys and certificates.
  • The keystore holds the Agent's private key and certificate. This information is used:
    • for Server Authentication with JOC Cockpit and
    • for Client Authentication with Agents.
  • The truststore holds the certificate(s) used to verify:
  • Client Authentication certificates presented by a Controller and
  Server Authentication certificates challenged by pairing Controllers.
• Keystore and Truststore locations are specified. In addition:
  • a password for the private keys included in the keystore and a password for access to the keystore can be specified,
  • for the truststore a password for access to the truststore can be specified.
• Passwords for keystores and truststores do not tend to improve security of the configuration: the passwords have to be specified as plain text and have to be in reach of the Agent. This mechanism is not too different from hiding the key under your doormat. In fact, limiting ownership and access permissions for keystore and truststore files to the JS7 Agent's run-time account are more important than using a password.
  • The key-password is used for access to a private key in keystore.
  • The store-password setting is used for access to a keystore or to a truststore.
  • For PKCS12 (*.p12) keystores both settings have to use the same value. The settings can be omitted if no passwords are used.
• The alias setting can be used for example with a keystore that holds a number of private keys from which the relevant private key is selected by its alias name.

...

• This setting is used to specify the location of a keystore and any truststores used for HTTPS connections.
• Keystore and truststore files are expected in PKCS#12 format.
• keystore
  • The keystore includes the private key for the Agent's incoming HTTPS connections.
  • Private key types RSA and ECDSA are supported. 
  • file:  the full path to the location of the keystore file is expected.
    • Default: ${js7.config-directory}"/private/https-keystore.p12"
  • key-password: Any keys included with the keystore are protected with a password. The same password has to be used for all private keys in the given keystore.
  • store-password: The keystore file is protected by a password.
  • alias: can be used for example with a keystore that holds a number of private keys from which the relevant private key is selected by its alias name.
• client-keystore
  • Use of this setting is optional. It can be used if separate certificates for Server Authentication and Client Authentication are used.
  • The Client Authentication private key and certificate can be added to this keystore.
  • Included configuration items correspond to the keystore setting.
• truststores
  
  • A truststore contains the certificates or public keys for the Agent's incoming HTTPS connections.
    • Certificates are signed by a Certificate Authority (CA) - alternatively a self-signed certificate can be used.
    • It is recommended that certificates are used instead of public keys.
    • Certificates of type X.509 are supported.
  • file:  the full path to the location of the truststore file is expected.
    • Default: ${js7.config-directory}"/private/https-truststore.p12"
  • store-password: A truststore file is protected by a password.
  • alias: can be used for example with a truststore that holds a number of certificates from which the relevant certificate is selected by its alias name.
  • A number of truststores can be specified by repeating the file and store-password settings.

...