Versions Compared

Version Old Version 6 New Version 7
Changes made by

Ylva Andersson

Ylva Andersson

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

...

...

...

...

Info

This article is valid for Smart ID Identity Manager 24.R1.

In a production environment, the certificates used must be created by a real certificate authority (CA). By doing so, the trust is clear.

...

The procedure consists of these steps:

  • Set up a local CA
    The CA can be used for several installations on the same machine.

  • Establish trust for the CA
    The CA certificate is installed in the cacerts truststore of the active Java installations. This step has to be repeated after every Java upgrade. Thus having a single CA keeps maintenance low. In order to access a Java installation on Windows, the script needs to run in Windows command line, not in WSL2.

  • Create the actual P12s
    By default, the names and pass phrases are used as the dummy certificates, so you just need to copy them toWEB-INF/classes in the web applications of the Identity Manager installation.

    Note

In this example we only create four P12 files: one for encryption and one for signing, one for email-signing and one for the device-enc CA . It is recommended to use multiple different ones for various signing- and encryption-related use-cases, but the default config in supplied Tomcat packages uses a common signing P12 as well as an encryption P12 for both config zip and database secrets.

  • Double-check PINs
    You need to make sure

    that 

    that WEB-INF\classes\engineSignEncryptConfig.xml

     has

     has the correct PINs that were used during bootstrapping.

Requirements

  • These scripts use OpenSSL 1.x. This can be installed on Windows and added to

    the PATH 

    the PATH environment variable, or you can use a WSL2 Linux distribution with OpenSSL 1.x instead (e.g. Ubuntu 20.04).

    note

The latest 1.x version of OpenSSL is recommended. Version 3 by default uses incompatible PKCS#12 algorithms.

If you insist on using version 3, then you need to change any "openssl pkcs12" calls in the .bat and .sh files

...

from certsetup.zip to include the following extra parameter(s):

Mandatory parameter to enable the legacy provider:

-legacy
Also potentially needed, in case the legacy provider library is in the wrong path (as is the case with some OpenSSL builds for Windows) is this (make sure you locate the correct path first, instead of the examples below):

-provider-path "C:\folder\containing\legacy.dll"

...

or

-provider-path "/folder/containing/legacy.so"

...

  • Active Java installation is selected via JAVA_HOME environment variable.

Steps with installed OpenSSL for Windows

This was successfully tested with https://slproweb.com/download/Win64OpenSSL_Light-1_1_1m.msi .

  1. Ensure that JAVA_HOME points to the folder of the Windows Java installation that will be used by Tomcat.

  2. Download certsetup.zip.

  3. Unpack it. (For example to C:\primestuff\certsetup)

  4. Start a command line as administrator to execute the following:

    1. Navigate to the batch files (cd c:\primestuff\certsetup)

    2. createca.bat

    3. trustlocalCA.bat

    4. createP12s.bat

  5. Copy sign.p12, signConfig.p12, signJWS.p12, signJWT.p12, encryptConfig.p12, emailSigning.p12, deviceEncCA.p12 and hybridEncKeypair.p12 to WEB-INF\classes of your web applications.

  6. Edit WEB-INF\classes\engineSignEncryptConfig.xml in your web applications and make sure it uses the pins that were set during bootstrapping for the respective files.

Steps using WSL2

  1. Ensure that JAVA_HOME points to the folder of the Windows Java installation that will be used by Tomcat.

  2. Download certsetup.zip.

  3. Unpack it. (For example toC:\primestuff\certsetup)

  4. Open WSL distribution using OpenSSL 1.x (e.g. Ubuntu 20.04)to execute the following:

    1. Navigate to the batch files (cd /mnt/c/primestuff/certsetup → depends on distribution, example is Ubuntu) 

    2. ./createca.sh

    3. ./createP12s.sh

  5. Start a command line as administrator (Establishing the trust has to be done to the Java of Windows)

    1. Navigate to the batch files (cd c:\primestuff\certsetup)

    2. trustlocalCA.bat

  6. Copy sign.p12, signConfig.p12, signJWS.p12, signJWT.p12, encryptConfig.p12, emailSigning.p12, deviceEncCA.p12 and hybridEncKeypair.p12 to WEB-INF\classes of your web applications.

  7. Edit WEB-INF\classes\engineSignEncryptConfig.xml in your web applications and make sure it uses the pins that were set during bootstrapping for the respective files.

Additional information

Expand
titleUseful links