[
https://issues.apache.org/jira/browse/DISPATCH-1440?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16946873#comment-16946873
]
ASF GitHub Bot commented on DISPATCH-1440:
------------------------------------------
kgiusti commented on pull request #582: DISPATCH-1440 - Deprecated passwordFile
attribute in sslProfile and m…
URL: https://github.com/apache/qpid-dispatch/pull/582#discussion_r332511087
##########
File path:
docs/books/user-guide/modules/connecting-using-mutual-ssl-tls-authentication.adoc
##########
@@ -55,9 +55,11 @@ sslProfile {
`certFile`:: The absolute path to the file containing the public certificate
for this router.
+`caCertFile`:: The absolute path to the CA certificate that was used to sign
the router's certificate.
+
`privateKeyFile`:: The absolute path to the file containing the private key
for this router's public certificate.
-`caCertFile`:: The absolute path to the CA certificate that was used to sign
the router's certificate.
+`password`:: The absolute path to the file that contains the password to
unlock the certificate key. Not specified if certificate key has no password.
Review comment:
It's only a file if the password text includes the "file:" prefix, correct?
----------------------------------------------------------------
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
For queries about this service, please contact Infrastructure at:
us...@infra.apache.org
> Deprecate the passwordFile field in sslProfile and consolidate all password
> scenarios to use the password field
> ----------------------------------------------------------------------------------------------------------------
>
> Key: DISPATCH-1440
> URL: https://issues.apache.org/jira/browse/DISPATCH-1440
> Project: Qpid Dispatch
> Issue Type: Improvement
> Components: Container
> Affects Versions: 1.9.0
> Reporter: Ganesh Murthy
> Assignee: Ganesh Murthy
> Priority: Major
>
> Deprecate the passwordFile field and consolidate all password scenarios to
> use the password field. We will use the password options that
> [openssl|https://www.openssl.org/docs/man1.1.1/man1/openssl.html] uses (see
> Pass Phrase Options sections). Going forward, here are three ways to specify
> a password in an sslProfile
>
> {noformat}
> sslProfile {
> caCertFile: .....
> certFile: .....
> # Get the password from the environment variable TLS_SERVER_PASSWORD.
> Note the env: prefix
> password: env:TLS_SERVER_PASSWORD
> OR
> # Get the password from the absolute file path. Note the file: prefix
> password: file:/home/tls/password-file.txt
> OR
> # Specify the actual password. Note the pass: prefix
> password: pass:actual_password
> } {noformat}
> (We will not be supporting the openssl options fd: and stdin
>
>
> While you can still specify the actual password in the password field using
> the pass: prefix, which casual users might want to do, you are also able to
> specify the file path or environment variable for more robust security.
> This change will be backward compatible which means, you will still be able
> to specify the actual password in the password field without the pass:
> prefix. The "literal" prefix will continue to work as well. The passwordFile
> field will be deprecated and eventually removed when we to a major version.
>
--
This message was sent by Atlassian Jira
(v8.3.4#803005)
---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscr...@qpid.apache.org
For additional commands, e-mail: dev-h...@qpid.apache.org
