I am using Playframework for an API solution I have built. There are no HTML Pages served by my server, only API query responses in JSON. I know that playframework can support https with a self signed keys using Dhttps.port=9443.
It is written in the documentation that this is to be used only in Dev mode.
Since, I dont have webpages being served (and hence no browser warnings for self signed keys) and I am bothered only about encryption for API calls, can I use this for production too? or am I missing something ?
The documentation says that if you do not provide any certificate when you run the app in prod mode, Play will generate one and run it. This is discouraged because, the certificate is just a random stuff which you do not have any control on.
Coming to the question of using a private certificate, if you open the url in a browser, it warns the user of a "non-trusted-certificate". Since this is not the case with you and if your web server consumers are restricted to a confined set, I think you can use it in prod mode. Please consider other pros and cons of it too before proceeding.
In case you wish to go ahead, you can always generate a private certificate of your own and use it to run the app. Commands according to Play documentation for this are:
keytool -genkeypair -v \
-alias cert \
-dname "CN=<CHANGE ME>, OU=<CHANGE ME>, O=<CHANGE ME>, L=<CHANGE ME>, ST=<CHANGE ME>, C=IN" \
-keystore cert.jks \
-keypass a1AhzIabP1 \
-storepass a1AhzIabP1 \
-keyalg RSA \
-keysize 4096 \
-ext KeyUsage:critical="keyCertSign" \
-ext BasicConstraints:critical="ca:true" \
-validity 9999
Check the certificate using this command
keytool -list -v \
-keystore conf/cert.jks \
-storepass a1AhzIabP1
Then configure it in your application.conf like this
https.port=9443
play.server.https.keyStore.path="conf/cert.jks" # relative path to your certificate
play.server.https.keyStore.password="a1AhzIabP1"
Hope it helps!
Related
I am trying to make apk file of my flutter app but facing problem i searched for this in Stackoverflow but not found any suitable answer which worked for me
i am using windows
C:\"Program Files"\Android\"Android Studio"\jre\bin\keytool -genkey -v -keystore c:\Users\SuD\upload-keystore -storetype JKS -keyalg RSA -keysize 2048 -validity 10000 -alias upload
get following result
C:\\"Program Files"\\"Android"\\"Android Studio"\\jre\\bin\\keytool -genkey -v -keystore c:\Users\pprak\upload-keystore.jks -storetype JKS -keyalg RSA -keysize 2048 -validity 10000 -alias upload
Please give path command in the above format. Use double \ in all the places where it mentions the Android SDK bin path.
See below images for the solution happened:-
1.) Did not applied double \ at all places. So it gave error.
2.) Added Double \ at all the places in path. So it did not give error.
By default setting up Solr on Https requires storing the certificate password as plain text in "bin\solr.in.cmd" (using windows to host solr)
And the certificate password is exposed in the portal.
How can I configure Solr with a Https certificate keeping the certificate password safe?
I want to use a private certifcate so the client trusts the certificate by default, rather than a self signed one.
I'm connecting via SolrNet from C#, currently without authentiation, but in the future can look at Basic Authentication which is supported in the provider which wraps SolrNet.
Seems like a basic thing which I would have thought should be supported? Can't find any article/documention on this.
Anyone solved this already?
Nearest I've found is:
Setting SOLR SSL properties
http://lucene.472066.n3.nabble.com/Prevent-the-SSL-Keystore-and-Truststore-password-from-showing-up-in-the-Solr-Admin-and-Linux-process-td4257422.html
Some suggestion of using jetty-https.xml and encrypt the configuration there.
Looking for a more complete answer.
update
I've come across the following Solr tickets:
https://issues.apache.org/jira/browse/SOLR-10307
https://issues.apache.org/jira/browse/SOLR-8897
Where support for loading the certificate passwords from environment variables has been added in Solr 7.0 and 6.7 (which hasn't been released yet).
I don't think using environment variables is much better, but some progress.
There is also a link to using Hadoop credential provider, but I'm not using Hadoop, so not applicable for me.
In the comments of the tickets, it mentions that someone tried the Jetty Password Utility, and Solr UI loaded over HTTPS. However the Collection API was erroring not being able to understand the password format.
So I'm still left without a way of configuring a certificate password for Solr, in a way I feel is secure.
For me the certificate password is not stored on the SOLR portal
see my setup
SSL
cd /path/to/solr/server/etc/
The following command will create a keystore file named solr-ssl.keystore.jks in the current directory
keytool -genkeypair -alias solr-ssl -keyalg RSA -keysize 2048 -keypass secret -storepass secret -validity 9999 -keystore solr-ssl.keystore.jks -ext SAN=DNS:localhost,IP:#ipsolr,IP:127.0.0.1 -dname "CN=localhost, OU=xxx, O=xxx, L=xxx, ST=xxx, C=xxx"
Convert the certificate and key to PEM format for use with Curl
keytool -importkeystore -srckeystore solr-ssl.keystore.jks -destkeystore solr-ssl.keystore.p12 -srcstoretype jks -deststoretype pkcs12
Next convert the PKCS12 format keystore into PEM format using the openssl
openssl pkcs12 -in solr-ssl.keystore.p12 -out solr-ssl.pem
After go to your $JAVA_HOME (into jre/lib/security)
curl --cacert /pah/to/solr/server/etc/solr-ssl.pem https://localhost:8983/solr/
Set Common SSL-Related System Properties
vi /etc/default/solr.in.sh
SOLR_SSL_KEY_STORE=etc/solr-ssl.keystore.jks
SOLR_SSL_KEY_STORE_PASSWORD=secret
SOLR_SSL_TRUST_STORE=etc/solr-ssl.keystore.jks
SOLR_SSL_TRUST_STORE_PASSWORD=secret
SOLR_SSL_NEED_CLIENT_AUTH=false
SOLR_SSL_WANT_CLIENT_AUTH=false
SOLR_SSL_KEY_STORE_TYPE=JKS
SOLR_SSL_TRUST_STORE_TYPE=JKS
Restart solr
service solr restart
For authentication
create security.json on SOLR_HOME (/var/solr/data/ for me)
Owner : root
See example of security.json to configure has you hope
After securing, add into solr.in.sh
SOLR_AUTH_TYPE="basic"
SOLR_AUTHENTICATION_OPTS="-Dbasicauth=solr:xxx"
it allows to have an answer on solr status service because with authentication it is not accessible
For me it's work and i don't see the certificate password on solr UI
I have an app which I want to sign and publish. I did not develop the app using eclipse. I have very little idea about programming. I have searched a lot of forums but could not find a way to do it. Can anyone explain the procedure to do it without using eclipse?
1 - You haven't done so, you'll need to create a new key, open the command line and type:
keytool -genkey -noprompt \
-alias eclipse \
-dname "CN=first and last name" \
-keystore "c:\path\keyname.key" \
-storepass password \
-keypass password \
-keyalg RSA \
-keysize 2048 \
-validity 10000
2 - Now you must sign the APK:
JAVA_HOME/bin/jarsigner
-verbose
-keystore c:\path\keyname.key
-storepass password
-keypass password
-signedjar DEV_HOME/bin/AndroidTest.signed.apk DEV_HOME/bin/AndroidTest.unsigned.apk AndroidTestKey
3 - Last step is to zipalign:
ANDROID_HOME/tools/zipalign
-v
-f 4 DEV_HOME/bin/AndroidTest.signed.apk DEV_HOME/bin/AndroidTest.apk
NOTES:
DEV_HOME is the location of you project
ANDROID_HOME is the Android SDK location
JAVA_HOME is the Java location
Signing process is documented here: https://developer.android.com/tools/publishing/app-signing.html
I have uploaded an app on Google Play, unfortunately I have lost certificate of the uploaded app but I have password of the app. Now I want to upload new version of the app but I have no certificate, is there any way to recover the certificate of the app and upload the newer version of the app. Please help me in this respect, your help would be cordially appreciated. Thanks in advance.
1)Generate new certificate:
keytool -genkey -v -keystore my-release-key.jks -keyalg RSA -keysize 2048 -validity 10000 -alias my-alias
2) Convert to .pem:
keytool -export -rfc -alias my-alias -file upload_certificate.pem -keystore my-release-key.jks
3) Send .pem to Contact Form:
General issues - Play Console Help
it takes 2 busines days to answer but this is the way if you dont want to re publish your app ;)
then you can sign your apk as you do before
(for me)
zipalign -v 4 android-release-unsigned.apk HelloWorld.apk
ReadMore
Manage your app signing keys
Now it is possible with Google Play App Signing
A short description
Users are installing apk with own google signing when you have uploaded previously with custom sign to google play
And if you didn't enable this feature there is an opportunity to take it now but with the help of google support team
You cannot recover the certificate if you lost it.
That's the point of the certificate, it behaves like a (private) key in real life. If you lose the key and its copies, then you have to change the lock.
We've recently set up a Jenkins CI server on Windows. Now in order to use Active Directory authentication I'd like to require https (SSL/TLS) for access. Given this setup, what is the recommended way to do this?
Go to your %JENKINS_HOME% and modify the jenkins.xml. Where you see --httpPort=8080 change it to --httpPort=-1 --httpsPort=8080 you can make the ports anything you want of course, but in my testing (a while ago, it may have changed) if you don't keep --httpPort=<something> then Jenkins will always use 8080. So if you simply change --httpPort=8080 to --httpsPort=8080, port 8080 will still use http.
Also, if you want to use your own certificate, there are some instructions at the bottom of this page.
http://wiki.jenkins-ci.org/display/JENKINS/Starting+and+Accessing+Jenkins
Run:
keytool -genkey -keyalg RSA -keystore Jenkins.jks -alias [Name of website] -keysize 2048
Answer the questions remembering that First and last name is the website URL and should be lowercase. Example:
build.jenkins-ci.org
State or province cannot be abbreviated.
Run:
keytool -certreq -Keystore jenkins.jks -alias [Name of website] -file jenkins.csr -keysize 2048
Send Jenkins.csr to your cert provider and request a PKCS#7 cert which has a .p7b extension and starts with:
-----BEGIN PKCS #7 SIGNED DATA-----
Note: Trial certs are not normally available in .p7b format but you may be able to combine the .cer files using this tool which reported success but didn't work for me. (https://www.sslshopper.com/ssl-converter.html)
Run:
keytool -import -trustcacerts -file jenkins.p7b -keystore jenkins.jks -alias [Name of website]
Change the arguments node in Jenkins.xml to the following prespectivly.
<arguments>-Xrs -Xmx256m -Dhudson.lifecycle=hudson.lifecycle.WindowsServiceLifecycle -jar "%BASE%\jenkins.war" --httpPort=-1 --httpsPort=443 --httpsKeyStore="%BASE%\Cert\Jenkins.jks" --httpsKeyStorePassword=[Cert password from step 1]</arguments>
Troubleshooting:
If Jenkins doesn't start read the last lines from Jenkins.err.log.
If Jenkins didn't start because of an issue with Jenkins.xml, replace the – (weird Windows hyphen) characters with an actual - (ASCII hyphen).
If Jenkins starts but the cert still reads as bad, make sure the [Name of website] is the actual URL without the https: example: https://build.jenkins-ci.org would be build.jenkins-ci.org.
If that isn't the issue inspect the .jks file using KeyStore Explorer. The "Certificate Hierarchy" should show that each cert is nested in another; This is to illustrate the cert chain. If it shows the certs next to each other then it's not correct.
If it won't start on a specific port, 443 for example, then verify IIS or another app isn't currently using the port.
If you can see the site on the PC it's hosted on, but not another PC, then verify you aren't getting blocked by a firewall.
Step1: Create both public and private Certificate on your jenkin name (convert them into keysore file if its not)
Step2: Import the public certificate into your browser certificate mananger (import into all tabs)
Step3: Host your jenkin using JKS file which contain both public and private key.
For steps refer "Enable HTTPS in jenkins?"