Introduction

Jobs might require variables for parameterization that hold secrets. We find a number of requirements for management of such variables, see JS7 - How to encrypt and decrypt

The preferred solution with JS7 is to use asymmetric keys, for details see JS7 - Encryption and Decryption.

• Encryption and decryption can be performed directly by related jobs.
• Encryption and decryption can be performed outside of JS7 products.
• This includes that JS7 products have no knowledge of secret keys involved that potentially could be compromised by logging, database persistence etc.

For creation of Encryption Keys see JS7 - How to create X.509 Encryption Keys.

FEATURE AVAILABILITY STARTING FROM RELEASE 2.5.9
FEATURE AVAILABILITY STARTING FROM RELEASE 2.6.6

Scope

The solution ships with JS7 Agents that can use encryption/decryption with Java jobs out-of-the-box.

• The solution is available
  • for Java as explained with the article,
  • for Linux, MacOS®, AIX®, see JS7 - How to encrypt and decrypt using Unix Shell,
  • for Windows® Shell, see JS7 - How to encrypt and decrypt using Windows Shell,
  • for Linux, MacOS®, Windows® from JS7 - How to encrypt and decrypt using PowerShell.
• Encryption and decryption with Unix and Windows can be used interchangeably.

Managing the Private Key and Certificate

Asymmetric encryption makes use of a Private Key and Certificate/Public Key that can be created in a number of ways:

• Users can create a Certificate Signing Request (CSR) and ask their Certificate Authority (CA) to sign the CSR and to receive an X.509 Certificate. The Private Key and the X.509 Certificate allow to derive the Public Key.
• User can create a self-issued X.509 Certificate, see JS7 - How to create X.509 Encryption Keys.
• Users can create a Private Key and Certificate as explained in the next chapter.

Note: Private Keys can be protected using a passphrase that acts as a second factor when a human user will access the key: while the Private Key is in the file system, the passphrase is in the user's brains. However, this does not improve security for unattended processing: it's pointless to store a passphrase side-by-side with the Private Key in scripts or configuration files on the same media.

Step 1: Creating the Private Key and Certificate

The following step is performed on the server hosting the Agent that should decrypt secrets using the openssl utility from the command line.
Find more examples and explanations from JS7 - How to create X.509 Encryption Keys.

#!/bin/bash

# navigate to the Agent's <agent-data>/config/private directory
cd /var/sos-berlin.com/js7/agent/config/private

# create Private Key
#   for use with passphrase add: -passout pass:"secret"
openssl ecparam -name secp384r1 -genkey -noout -out agent.key

# create Certificate Signing Request
openssl req -new -sha512 -nodes -key agent.key -out agent.csr -subj "/C=DE/ST=Berlin/L=Berlin/O=SOS/OU=IT/CN=Agent"

# create Certificate
#   for passphrase add: -passin pass:"secret"
openssl x509 -req -sha512 -days 1825 -signkey agent.key -in agent.csr -out agent.crt -extfile <(printf "keyUsage=critical,keyEncipherment,keyAgreement\n")

#!/bin/bash

# navigate to the Agent's <agent-data>/config/private directory
cd /var/sos-berlin.com/js7/agent/config/private

# create Private Key and Certificate Signing Request
#   for passphrase add: -passout pass:"secret"
openssl req -new -newkey rsa:4096 -sha256 -nodes -keyout agent.key -out agent.csr -subj "/C=DE/ST=Berlin/L=Berlin/O=SOS/OU=IT/CN=Agent"

# create Certificate
#   for passphrase add: -passin pass:"secret"
openssl x509 -req -sha512 -days 1825 -signkey agent.key -in agent.csr -out agent.crt -extfile <(printf "keyUsage=critical,keyEncipherment,keyAgreement\n")

Step 2: Making the Certificate available

Copy the certificate file to the server(s) hosting the Agent(s) or 3rd-party components that should encrypt secrets.

Encryption

Usage

Decryption

Usage