| Table of Contents |
|---|
Scope
- The connection of from the user's browser and or any REST client to the JOC Cockpit can be secured by HTTPS. This includes that a client validates the JOC Cockpit SSL certificate for server authentication.
- In addition the JOC Cockpit can be configured for mutual authentication, requiring in addition the client to present a certificate that is validated by the JOC Cockpit.
- This article describes the steps required to set up secure JOC Cockpit for two-factor authentication including SSL mutual authentication and password authentication. For login to JOC Cockpit a client, i.e. a user browser or REST client,
- is required to hold a certificate stored with the client's device that is validated by JOC Cockpit and
- is required to specify a password.
...
JOC Cockpit hold a certificate that allows validation of the clients' certificate in its truststore. The location of the Jetty truststore is specified with the JETTY_BASE/start.ini configuration file.
- Self-signed Certificates
- JOC Cockpit holds the client's certificate in its truststore.
- Each client's individual certificate is required to be in place.
- CA signed Certificates
- JOC Cockpit holds the CA certificate, i.e. the root certificate/intermediate certificate(s), in its truststore.
- Connections from any clients that use a certificate signed by the CA will be accepted.
- This approach is more flexible as it does not require to modify the Jetty truststore when adding/removing clients.
...