Page History
...
- Encryption and decryption can be performed directly by related jobs.
- Encryption and decryption can be performed outside of JS7 products.
- This includes that JS7 products have no knowledge of secret keys involved that potentially could be compromised by logging, database persistence etc.
For creation of Encryption Keys see JS7 - How to create X.509 Encryption Keys.
| Display feature availability | ||
|---|---|---|
|
| Display feature availability | ||
|---|---|---|
|
...
- Users can create a Certificate Signing Request (CSR) and ask their Certificate Authority (CA) to sign the CSR and to receive an X.509 Certificate. The Private Key or X.509 Certificate allow to derive the Public Key.
- User can create a selfCA-signed X.509 Certificate, see JS7 - How to create X.509 SSL TLS Certificates.
- Users can create a Private Key and Certificate as explained in the next chapter.
...
The following step is performed on the server hosting the Agent that should decrypt secrets using the openssl utility from the command line:. Find more examples and explanations from JS7 - How to create X.509 Encryption Keys.
| Code Block | ||||||||
|---|---|---|---|---|---|---|---|---|
| ||||||||
# navigate to the Agent's <agent-data>/\config/\private directory cd /var/Set-Location $env:Programdata\sos-berlin.com/\js7/\agent/\config/\private # create thePrivate privateKey # key infor pkcs#1use format #with passphrase add: without passphrase-passout pass:"secret" openssl ecparam -name secp256k1secp384r1 -genkey -noout -out agent.key # create Certificate withSigning passphraseRequest # openssl ecparamreq -genkeynew -name secp256k1 | openssl ec -aes256 -passout pass:"jobscheduler"sha512 -nodes -key agent.key -out agent.keycsr -subj "/C=DE/ST=Berlin/L=Berlin/O=SOS/OU=IT/CN=Agent" # create certificate openssl req -new -x509 -key agent.key -out agent.crt -days 1825 # openssl req -new -x509 -keyCertificate $user_crt_tmp_file = New-TemporaryFile "keyUsage=critical,keyAgreement,keyEncipherment" | Out-File $user_crt_tmp_file # for passphrase add: -passin pass:"secret" openssl x509 -req -sha512 -days 1825 -signkey agent.key -passin pass:"jobscheduler"in agent.csr -out agent.crt -extfile $user_crt -days 1825_tmp_file Remove-Item -Path $user_crt_tmp_file -Force |
| Code Block | ||||||||
|---|---|---|---|---|---|---|---|---|
| ||||||||
# navigate to the Agent's <agent-data>/\config/\private directory cd /var/Set-Locataion $env:Programdata\sos-berlin.com/\js7/\agent/\config/\private # create thePrivate privateKey keyand inCertificate pkcs#1Signing formatRequest # for passphrase add: without passphrase-passout pass:"secret" openssl req -x509new -sha256 -newkey rsa:20484096 -sha256 -nodes -keyout agent.key -out agent.crtcsr -subj "/C=DE/ST=Berlin/L=Berlin/O=SOS/OU=IT/CN=Agent" # create with passphrase # openssl req -x509 -sha256 -newkey rsa:2048 -passout pass:"jobscheduler" -keyout agent.keyCertificate $user_crt_tmp_file = New-TemporaryFile "keyUsage=critical,keyAgreement,keyEncipherment" | Out-File $user_crt_tmp_file # for passphrase add: -passin pass:"secret" openssl x509 -req -sha512 -days 1825 -signkey agent.key -in agent.csr -out agent.crt -extfile $user_crt_tmp_file Remove-Item -Path $user_crt_tmp_file -Force |
Step 2: Making the Certificate available
...
Overview
Content Tools