Download logFaces User Manual

Copyright ©2009-2015 Moonlit Software Ltd, All rights reserved
2.10.17 How do I enable SSL for clients and browsers.
By default the access to the server from clients and browsers is based on plain HTTP connection. To
use secure (SSL) based connection follow these steps:
1. Obtain public a private keys from trusted CA authority. Usually they come in a PEM format –
text files with bunch of encrypted numbers. Note that it's no possible to use self signed
certificates, so before you proceed you must have both these files handy.
2. The keys must be now imported into the trusted store which will then be used by logFaces
server to present its identity and encrypt the traffic for the outside clients. To do this we need
to do the following steps:
a) First we need to convert the keys into combined PKCS12 format, one of the tools which
can be used for this is OpenSSL , here is the command you should execute:
openssl pkcs12 -inkey private.key -in mycert.crt -export -out mykeys.pkcs12
This will combine the private (private.key) and public (mycert.crt) keys into a single file
named mykeys.pkcs12
b) Now import the mykeys.pkcs12 into the key store using conventional JDK keytool utility.
keytool -importkeystore -srckeystore mykeys.pkcs12 -srcstoretype PKCS12 -destkeystore
mykeystore
You will be prompted for passwords – remember them for the next steps.
c) Created mykeystore file should now be introduced to the logFaces server to be used.
Open the /conf/environment.properties file and fill in the following properties:
com.moonlit.logfaces.security.keyStore
com.moonlit.logfaces.security.trustStore
com.moonlit.logfaces.security.keyPass
com.moonlit.logfaces.security.trustPass
=
=
=
=
path_to_mykeystore
path_to_mykeystore
OBF:1x881v2h1t371shw1shm1t2z1v1x1x8m
OBF:1x881v2h1t371shw1shm1t2z1v1x1x8m
Note that passwords can be entered in clear text or obfuscated like in the example above.
To obfuscate your passwords you can use the existing Jetty utilities located in /lib/jetty
folder. The command line below will obfuscate a text string:
java -cp jetty.jar;jetty-util.jar org.mortbay.jetty.security.Password my-password
3. At this point you can start the server. If everything is specified correctly, the clients and
browsers will have to use SSL connection to communicate with the server. Please note that
once configured to use SSL, the server will enforce only SSL connection, there is no other port
for non-secure access – it's either SSL or not. If you can't get connected, try running the
server in console mode or look in its internal log.
Note that /conf/environment.properties file has default presets for file names and passwords, so you
might as well choose to use those names in the first place. The obfuscated passwords are 'logfaces'.
69