Bug 840403 - (PRODMGT-454) the plugin for JBoss EAP 6 / AS 7 needs to support SSL/TLS encryption and authentication [INPUT NEEDED]

Larry O'Leary loleary at redhat.com
Fri Jan 24 20:13:13 UTC 2014


Great work Thomas! See my response inline.

On Wed, 2014-01-22 at 18:47 +0100, Thomas Segismont wrote:
> Hi,
> 
> I've just pushed the initial implementation for Bug 840403 in a topic 
> branch:
> https://git.fedorahosted.org/cgit/rhq/rhq.git/commit/?h=bug/840403&id=3e7174e16ac754122b459f21de7d56a8c0c67f97
> ...
> * Only valid certificates or self-signed certificates (certificate chain 
> size is 1) are supported now

Why this limitation? Is this because the CA or public key is not yet
trusted by the agent's JVM?

> 
> AS7 plugin must be able to work with self-signed certificates and 
> unknown certificate authorities (internal or not common). It also needs 
> to be able to find a key store for client cert authentication.
> 
> I think Standalone and Domain server plugin configurations should let 
> users define a key and a trust store for maximum customization.

Yes. I agree. The connection settings should provide the ability to
specify the location of the key and trust store files and what level of
enforcement is required (host name validation, CRL, encryption only w/
no authentication/validation, etc).

Additionally, without any resource specific connection settings the JVMs
global/default settings should be used. Thus allowing all certificates
to be managed/provided via the JVM's settings and to be overridden by
resource specific connection settings.

> I believe that, by default, self-signed certificates and unknown 
> certificate authorities should not be trusted.

Assuming that the certificate trust has not been installed, I would
agree. However, if the public key for a self-signed certificate has been
installed in the certificate trust, it should be considered trusted. 

-- 
Larry O'Leary
https://plus.google.com/+LarryOLeary



More information about the rhq-devel mailing list