<html>
<head>
<base href="https://docs.jboss.org/author">
<link rel="stylesheet" href="/author/s/en/2172/19/5/_/styles/combined.css?spaceKey=TEIID&forWysiwyg=true" type="text/css">
</head>
<body style="background: white;" bgcolor="white" class="email-body">
<div id="pageContent">
<div id="notificationFormat">
<div class="wiki-content">
<div class="email">
<h2><a href="https://docs.jboss.org/author/display/TEIID/Configuring+SSL">Configuring SSL</a></h2>
<h4>Page <b>edited</b> by <a href="https://docs.jboss.org/author/display/~shawkins">Steven Hawkins</a>
</h4>
<br/>
<h4>Changes (28)</h4>
<div id="page-diffs">
<table class="diff" cellpadding="0" cellspacing="0">
<tr><td class="diff-deleted-lines" style="color:#999;background-color:#fdd;text-decoration:line-through;">The Teiid's configuration file\(s) <br></td></tr>
<tr><td class="diff-added-lines" style="background-color: #dfd;">Teiid can have multiple transports defined for access into Teiid.&nbsp; A transport contains properties to configure SSL. <br></td></tr>
<tr><td class="diff-unchanged" > <br></td></tr>
<tr><td class="diff-deleted-lines" style="color:#999;background-color:#fdd;text-decoration:line-through;">* standalone\-teiid.xml/domain\-teiid.xml <br>* domain-teiid.xml <br> <br>contain transports defined for access into Teiid, and transport contains the properties to configure SSL for socket. <br> <br></td></tr>
<tr><td class="diff-changed-lines" >There are two types of <span class="diff-added-words"style="background-color: #dfd;">remote</span> transports, each with it's own SSL configuration: <br></td></tr>
<tr><td class="diff-deleted-lines" style="color:#999;background-color:#fdd;text-decoration:line-through;"> <br></td></tr>
<tr><td class="diff-unchanged" >* "teiid" - Default configuration to only encrypt login traffic, none of the other properties are used. <br></td></tr>
<tr><td class="diff-changed-lines" >* "pg" <span class="diff-deleted-words"style="color:#999;background-color:#fdd;text-decoration:line-through;">type</span> - Defaults to no SSL. <br></td></tr>
<tr><td class="diff-unchanged" > <br></td></tr>
<tr><td class="diff-deleted-lines" style="color:#999;background-color:#fdd;text-decoration:line-through;">{code:title=Example Configuration} <br></td></tr>
<tr><td class="diff-added-lines" style="background-color: #dfd;">{code:lang=xml|title=Example XML Configuration} <br></td></tr>
<tr><td class="diff-changed-lines" ><ssl <span class="diff-deleted-words"style="color:#999;background-color:#fdd;text-decoration:line-through;">mode="login"</span> <span class="diff-added-words"style="background-color: #dfd;">mode="enabled"</span> authentication-mode="1-way" ssl-protocol="SSLv3" keymanagement-algorithm="algo" <br></td></tr>
<tr><td class="diff-unchanged" > enabled-cipher-suites="SSL_RSA_WITH_RC4_128_MD5,SSL_RSA_WITH_RC4_128_SHA"> <br> <keystore name="cert.keystore" password="passwd" type="JKS" key-alias="alias"/> <br></td></tr>
<tr><td class="diff-snipped" >...<br></td></tr>
<tr><td class="diff-unchanged" > <br>Properties <br></td></tr>
<tr><td class="diff-added-lines" style="background-color: #dfd;">* mode - diabled\|login\|enabled <br> _disabled_ = no transport or message level security will be used. <br> _login_ = only the login traffic will be encrypted at a message level using 128 bit AES with an ephemeral DH key exchange. Only applies to the 'teiid' transport and no other config values are needed in this mode. <br> _enabled_ = traffic will be secured with SSL using the other configuration properties. <br></td></tr>
<tr><td class="diff-unchanged" > <br></td></tr>
<tr><td class="diff-deleted-lines" style="color:#999;background-color:#fdd;text-decoration:line-through;">* mode - diabled|login|enabled <br> _disabled_ = no transport or message level security will be used. <br> _login_ = only the login traffic will be encrypted at a message level using 128 bit AES with an ephemerial DH key exchange. No other config values are needed in this mode. <br> _enabled_ = traffic will be secured using the other configuration properties. <br></td></tr>
<tr><td class="diff-added-lines" style="background-color: #dfd;">* ssl-protocol\- Type of SSL protocol to be used. Default is TLSv1 <br></td></tr>
<tr><td class="diff-unchanged" > <br></td></tr>
<tr><td class="diff-deleted-lines" style="color:#999;background-color:#fdd;text-decoration:line-through;">* ssl\-protocol- Type of SSL protocol to be used. Default is TLSv1 <br> <br></td></tr>
<tr><td class="diff-unchanged" >* keystore/type - Keystore type created by the keytool. Default "JKS" is used. <br> <br></td></tr>
<tr><td class="diff-deleted-lines" style="color:#999;background-color:#fdd;text-decoration:line-through;">* authentication\-mode - anonymous|1\-way|2\-way, Type of SSL Authentication Mode. <br></td></tr>
<tr><td class="diff-added-lines" style="background-color: #dfd;">* authentication-mode - anonymous\|1-way\|2-way, Type of SSL Authentication Mode. <br></td></tr>
<tr><td class="diff-unchanged" > <br></td></tr>
<tr><td class="diff-changed-lines" >* <span class="diff-changed-words">keymanagement<span class="diff-deleted-chars"style="color:#999;background-color:#fdd;text-decoration:line-through;">\</span>-algorithm</span> - Type of key algorithm used. Default is based upon the VM, <span class="diff-deleted-words"style="color:#999;background-color:#fdd;text-decoration:line-through;">e.g.</span> <span class="diff-added-words"style="background-color: #dfd;">i.e.</span> "SunX509" <br></td></tr>
<tr><td class="diff-unchanged" > <br></td></tr>
<tr><td class="diff-changed-lines" >* keystore/name - The file name of the keystore, which contains the <span class="diff-added-words"style="background-color: #dfd;"> </span> private key of the Server. The file name can be relative resource path <span class="diff-added-words"style="background-color: #dfd;"> </span> available to the Teiid deployer classloader or an absolute file system <span class="diff-added-words"style="background-color: #dfd;"> </span> path. A typical installation would place the keystore file in the conf <span class="diff-added-words"style="background-color: #dfd;"> </span> directory of the profile where Teiid is deployed with a file name <span class="diff-added-words"style="background-color: #dfd;"> </span> relative to the conf path. <br></td></tr>
<tr><td class="diff-unchanged" > <br>* keystorePassword - password for the keystore. <br></td></tr>
<tr><td class="diff-snipped" >...<br></td></tr>
<tr><td class="diff-unchanged" >* keystore/key-alias - Alias name for the certificate that is in the key store. <br> <br></td></tr>
<tr><td class="diff-changed-lines" >* truststore/name - if "authenticationMode" is chosen as <span class="diff-deleted-words"style="color:#999;background-color:#fdd;text-decoration:line-through;">"2\-way",</span> <span class="diff-added-words"style="background-color: #dfd;">"2-way", </span> then this property must be provided. This is the truststore that <span class="diff-added-words"style="background-color: #dfd;"> </span> contains the public key for the client. Depending upon how you created <span class="diff-added-words"style="background-color: #dfd;"> </span> the keystore and truststores, this may be same file as defined under <span class="diff-added-words"style="background-color: #dfd;"> </span> "keystoreFilename" property. <br></td></tr>
<tr><td class="diff-unchanged" > <br></td></tr>
<tr><td class="diff-unchanged" >* truststore/password - password for the truststore. <br></td></tr>
<tr><td class="diff-unchanged" > <br></td></tr>
<tr><td class="diff-changed-lines" >* <span class="diff-deleted-words"style="color:#999;background-color:#fdd;text-decoration:line-through;">enabled\-cipher\-suites</span> <span class="diff-added-words"style="background-color: #dfd;">enabled-cipher-suites</span> - A comma separated list of cipher suites <span class="diff-added-words"style="background-color: #dfd;"> </span> allowed for encryption between server and client. The values must be <span class="diff-added-words"style="background-color: #dfd;"> </span> valid supported cipher suites otherwise SSL connections will fail. <br></td></tr>
<tr><td class="diff-unchanged" > <br>{note} <br></td></tr>
<tr><td class="diff-changed-lines" >You <span class="diff-deleted-words"style="color:#999;background-color:#fdd;text-decoration:line-through;">can also</span> <span class="diff-added-words"style="background-color: #dfd;">will typically</span> use <span class="diff-added-words"style="background-color: #dfd;">the</span> CLI to modify the transport configuration. <br></td></tr>
<tr><td class="diff-unchanged" >{note} <br></td></tr>
<tr><td class="diff-unchanged" >{info:Using password Vault} <br></td></tr>
<tr><td class="diff-changed-lines" >If <span class="diff-added-words"style="background-color: #dfd;"> </span> you do not like to leave clear text passwords in the configuration <span class="diff-added-words"style="background-color: #dfd;"> </span> file, then you can use JBoss AS vault mechanism for storing the keystore <span class="diff-added-words"style="background-color: #dfd;"> </span> and truststore passwords. Use the directions defined here <span class="diff-changed-words">[https://community.jboss.org/docs/DOC-17248<span class="diff-added-chars"style="background-color: #dfd;">|https://community.jboss.org/docs/DOC-17248</span>]</span> <br></td></tr>
<tr><td class="diff-unchanged" >{info} <br> <br>h1. SSL Authentication Modes <br></td></tr>
<tr><td class="diff-deleted-lines" style="color:#999;background-color:#fdd;text-decoration:line-through;">SSL supports multiple authentication modes. In most secure intranet environments, anonymous is suitable to just bulk encrypt traffic without the need to setup SSL certificates. <br></td></tr>
<tr><td class="diff-unchanged" > <br></td></tr>
<tr><td class="diff-added-lines" style="background-color: #dfd;">SSL supports multiple authentication modes. In most secure intranet environments, anonymous is suitable to just bulk encrypt traffic without the need to setup SSL certificates. <br></td></tr>
<tr><td class="diff-changed-lines" >* _anonymous_\- no certificates are exchanged, settings are not needed for the keystore and truststore properties. Client must have {{org.teiid.ssl.allowAnon}} set to true <span class="diff-changed-words"><span class="diff-deleted-chars"style="color:#999;background-color:#fdd;text-decoration:line-through;">\</span>(the</span> default) to connect to an anonymous server. <br></td></tr>
<tr><td class="diff-unchanged" > <br></td></tr>
<tr><td class="diff-changed-lines" >* <span class="diff-changed-words">_1<span class="diff-deleted-chars"style="color:#999;background-color:#fdd;text-decoration:line-through;">\</span>-way_\-</span> the server will present a certificate, which is <span class="diff-added-words"style="background-color: #dfd;"> </span> obtained from the keystore related properties. The client should have a <span class="diff-added-words"style="background-color: #dfd;"> </span> truststore configured to accept the server certificate. <br></td></tr>
<tr><td class="diff-unchanged" > <br></td></tr>
<tr><td class="diff-changed-lines" >* <span class="diff-changed-words">_2<span class="diff-deleted-chars"style="color:#999;background-color:#fdd;text-decoration:line-through;">\</span>-way_\-</span> the server will present a certificate, which is <span class="diff-added-words"style="background-color: #dfd;"> </span> obtained from the keystore related properties. The client should have a <span class="diff-added-words"style="background-color: #dfd;"> </span> truststore configured to accept the server certificate. The client is <span class="diff-added-words"style="background-color: #dfd;"> </span> also expected to present a certificate, which is obtained from its <span class="diff-added-words"style="background-color: #dfd;"> </span> keystore. The client certificate should be accepted by the trust store <span class="diff-added-words"style="background-color: #dfd;"> </span> configured by the truststore related properties. <br></td></tr>
<tr><td class="diff-unchanged" > <br>h1. Encryption Strength <br></td></tr>
<tr><td class="diff-added-lines" style="background-color: #dfd;"> <br></td></tr>
<tr><td class="diff-changed-lines" >Both anonymous SSL and login only encryption are configured to use <span class="diff-added-words"style="background-color: #dfd;"> </span> 128 bit AES encryption by default. By default, <span class="diff-changed-words">1<span class="diff-deleted-chars"style="color:#999;background-color:#fdd;text-decoration:line-through;">\</span>-way</span> and <span class="diff-changed-words">2<span class="diff-deleted-chars"style="color:#999;background-color:#fdd;text-decoration:line-through;">\</span>-way</span> SSL <span class="diff-added-words"style="background-color: #dfd;"> </span> allow for cipher suite negotiation based upon the default cipher suites <span class="diff-added-words"style="background-color: #dfd;"> </span> supported by the respective Java platforms of the client and server. <span class="diff-added-words"style="background-color: #dfd;"> </span> User can restrict the cipher suites used for encryption by specifying <span class="diff-added-words"style="background-color: #dfd;"> </span> the _enabledCipherSuites_ property above in ssl configuration. <br></td></tr>
</table>
</div> <h4>Full Content</h4>
<div class="notificationGreySide">
<p>Teiid can have multiple transports defined for access into Teiid. A transport contains properties to configure SSL.</p>
<p>There are two types of remote transports, each with it's own SSL configuration:</p>
<ul>
<li>"teiid" - Default configuration to only encrypt login traffic, none of the other properties are used.</li>
<li>"pg" - Defaults to no SSL.</li>
</ul>
<div class="code panel" style="border-width: 1px;"><div class="codeHeader panelHeader" style="border-bottom-width: 1px;"><b>Example XML Configuration</b></div><div class="codeContent panelContent">
<pre class="theme: Confluence; brush: xml; gutter: false" style="font-size:12px; font-family: ConfluenceInstalledFont,monospace;">
<ssl mode="enabled" authentication-mode="1-way" ssl-protocol="SSLv3" keymanagement-algorithm="algo"
enabled-cipher-suites="SSL_RSA_WITH_RC4_128_MD5,SSL_RSA_WITH_RC4_128_SHA">
<keystore name="cert.keystore" password="passwd" type="JKS" key-alias="alias"/>
<truststore name="cert.truststore" password="passwd"/>
</ssl>
</pre>
</div></div>
<p>Properties</p>
<ul>
<li>mode - diabled|login|enabled<br/>
<em>disabled</em> = no transport or message level security will be used.<br/>
<em>login</em> = only the login traffic will be encrypted at a message level using 128 bit AES with an ephemeral DH key exchange. Only applies to the 'teiid' transport and no other config values are needed in this mode.<br/>
<em>enabled</em> = traffic will be secured with SSL using the other configuration properties.</li>
</ul>
<ul>
<li>ssl-protocol- Type of SSL protocol to be used. Default is TLSv1</li>
</ul>
<ul>
<li>keystore/type - Keystore type created by the keytool. Default "JKS" is used.</li>
</ul>
<ul>
<li>authentication-mode - anonymous|1-way|2-way, Type of SSL Authentication Mode.</li>
</ul>
<ul>
<li>keymanagement-algorithm - Type of key algorithm used. Default is based upon the VM, i.e. "SunX509"</li>
</ul>
<ul>
<li>keystore/name - The file name of the keystore, which contains the private key of the Server. The file name can be relative resource path available to the Teiid deployer classloader or an absolute file system path. A typical installation would place the keystore file in the conf directory of the profile where Teiid is deployed with a file name relative to the conf path.</li>
</ul>
<ul>
<li>keystorePassword - password for the keystore.</li>
</ul>
<ul>
<li>keystore/key-alias - Alias name for the certificate that is in the key store.</li>
</ul>
<ul>
<li>truststore/name - if "authenticationMode" is chosen as "2-way", then this property must be provided. This is the truststore that contains the public key for the client. Depending upon how you created the keystore and truststores, this may be same file as defined under "keystoreFilename" property.</li>
</ul>
<ul>
<li>truststore/password - password for the truststore.</li>
</ul>
<ul>
<li>enabled-cipher-suites - A comma separated list of cipher suites allowed for encryption between server and client. The values must be valid supported cipher suites otherwise SSL connections will fail.</li>
</ul>
<div class='panelMacro'><table class='noteMacro'><colgroup><col width='24'><col></colgroup><tr><td valign='top'><img src="/author/images/icons/emoticons/warning.gif" width="16" height="16" align="absmiddle" alt="" border="0"></td><td>You will typically use the CLI to modify the transport configuration.</td></tr></table></div>
<div class='panelMacro'><table class='infoMacro'><colgroup><col width='24'><col></colgroup><tr><td valign='top'><img src="/author/images/icons/emoticons/information.gif" width="16" height="16" align="absmiddle" alt="" border="0"></td><td>If you do not like to leave clear text passwords in the configuration file, then you can use JBoss AS vault mechanism for storing the keystore and truststore passwords. Use the directions defined here <a href="https://community.jboss.org/docs/DOC-17248" class="external-link" rel="nofollow">https://community.jboss.org/docs/DOC-17248</a></td></tr></table></div>
<h1><a name="ConfiguringSSL-SSLAuthenticationModes"></a>SSL Authentication Modes</h1>
<p>SSL supports multiple authentication modes. In most secure intranet environments, anonymous is suitable to just bulk encrypt traffic without the need to setup SSL certificates.</p>
<ul>
<li><em>anonymous</em>- no certificates are exchanged, settings are not needed for the keystore and truststore properties. Client must have <tt>org.teiid.ssl.allowAnon</tt> set to true (the default) to connect to an anonymous server.</li>
</ul>
<ul>
<li><em>1-way</em>- the server will present a certificate, which is obtained from the keystore related properties. The client should have a truststore configured to accept the server certificate.</li>
</ul>
<ul>
<li><em>2-way</em>- the server will present a certificate, which is obtained from the keystore related properties. The client should have a truststore configured to accept the server certificate. The client is also expected to present a certificate, which is obtained from its keystore. The client certificate should be accepted by the trust store configured by the truststore related properties.</li>
</ul>
<h1><a name="ConfiguringSSL-EncryptionStrength"></a>Encryption Strength</h1>
<p>Both anonymous SSL and login only encryption are configured to use 128 bit AES encryption by default. By default, 1-way and 2-way SSL allow for cipher suite negotiation based upon the default cipher suites supported by the respective Java platforms of the client and server. User can restrict the cipher suites used for encryption by specifying the <em>enabledCipherSuites</em> property above in ssl configuration.</p>
</div>
<div id="commentsSection" class="wiki-content pageSection">
<div style="float: right;" class="grey">
<a href="https://docs.jboss.org/author/users/removespacenotification.action?spaceKey=TEIID">Stop watching space</a>
<span style="padding: 0px 5px;">|</span>
<a href="https://docs.jboss.org/author/users/editmyemailsettings.action">Change email notification preferences</a>
</div>
<a href="https://docs.jboss.org/author/display/TEIID/Configuring+SSL">View Online</a>
|
<a href="https://docs.jboss.org/author/pages/diffpagesbyversion.action?pageId=18646063&revisedVersion=13&originalVersion=12">View Changes</a>
|
<a href="https://docs.jboss.org/author/display/TEIID/Configuring+SSL?showComments=true&showCommentArea=true#addcomment">Add Comment</a>
</div>
</div>
</div>
</div>
</div>
</body>
</html>