[ https://issues.apache.org/jira/browse/DISPATCH-1440?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=16946874#comment-16946874 ]
ASF GitHub Bot commented on DISPATCH-1440: ------------------------------------------ kgiusti commented on pull request #582: DISPATCH-1440 - Deprecated passwordFile attribute in sslProfile and m… URL: https://github.com/apache/qpid-dispatch/pull/582#discussion_r332511326 ########## File path: docs/books/user-guide/modules/enabling-ssl-tls-encryption.adoc ########## @@ -46,18 +46,21 @@ This `sslProfile` contains the locations of the private key and certificates tha sslProfile { name: service-tls certFile: /etc/qpid-dispatch-certs/normal/tls.crt - privateKeyFile: /etc/qpid-dispatch-certs/normal/tls.key caCertFile: /etc/qpid-dispatch-certs/client-ca/ca.crt + privateKeyFile: /etc/qpid-dispatch-certs/normal/tls.key + password: file:/etc/qpid-dispatch-certs/inter-router/password.txt ... } ---- `name`:: A unique name that you can use to refer to this `sslProfile`. `certFile`:: The absolute path to the file containing the public certificate for this router. +`caCertFile`:: The absolute path to the CA certificate that was used to sign the router's certificate. + `privateKeyFile`:: The absolute path to the file containing the private key for this router's public certificate. -`caCertFile`:: The absolute path to the CA certificate that was used to sign the router's certificate. +`password`:: The absolute path to the file that contains the password to unlock the certificate key. Not specified if certificate key has no password. Review comment: Also needs "file:" prefix ---------------------------------------------------------------- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. For queries about this service, please contact Infrastructure at: us...@infra.apache.org > Deprecate the passwordFile field in sslProfile and consolidate all password > scenarios to use the password field > ---------------------------------------------------------------------------------------------------------------- > > Key: DISPATCH-1440 > URL: https://issues.apache.org/jira/browse/DISPATCH-1440 > Project: Qpid Dispatch > Issue Type: Improvement > Components: Container > Affects Versions: 1.9.0 > Reporter: Ganesh Murthy > Assignee: Ganesh Murthy > Priority: Major > > Deprecate the passwordFile field and consolidate all password scenarios to > use the password field. We will use the password options that > [openssl|https://www.openssl.org/docs/man1.1.1/man1/openssl.html] uses (see > Pass Phrase Options sections). Going forward, here are three ways to specify > a password in an sslProfile > > {noformat} > sslProfile { > caCertFile: ..... > certFile: ..... > # Get the password from the environment variable TLS_SERVER_PASSWORD. > Note the env: prefix > password: env:TLS_SERVER_PASSWORD > OR > # Get the password from the absolute file path. Note the file: prefix > password: file:/home/tls/password-file.txt > OR > # Specify the actual password. Note the pass: prefix > password: pass:actual_password > } {noformat} > (We will not be supporting the openssl options fd: and stdin > > > While you can still specify the actual password in the password field using > the pass: prefix, which casual users might want to do, you are also able to > specify the file path or environment variable for more robust security. > This change will be backward compatible which means, you will still be able > to specify the actual password in the password field without the pass: > prefix. The "literal" prefix will continue to work as well. The passwordFile > field will be deprecated and eventually removed when we to a major version. > -- This message was sent by Atlassian Jira (v8.3.4#803005) --------------------------------------------------------------------- To unsubscribe, e-mail: dev-unsubscr...@qpid.apache.org For additional commands, e-mail: dev-h...@qpid.apache.org