0

I'm planning to develop a web application that would run on-premise at the customer. I'm quite unsure about the whole process of setting up the site in a user-friendly way, but mostly disturbed by the SSL configuration. Which formats are a must to support? Should I require the admin to run my Java application with a lot of arguments (e.g.: database access and SSL can't be modified runtime I believe without restart), or try to push whatever I can towards the UI?

1

Some things will have to be set up on a machine by machine basis. The unfortunate truth is that TLS (the current version of SSL) is just tricky to get right.

If you have a number of servers to get set up, you can use Spring Cloud Configuration Server, which will help you centralize the configuration. It works well when you need to spin up another instance of your web site quickly, or want to manage installs per environment. One configuration server can manage the configurations for Integration, QA, Pre-Prod, and Production environments.

As to TLS support, you'll have to read up on what the current standards are. At the time of this answer you'll want:

Combining the two, you'll need to push the trust store and key store to your server and configure Spring to look at those files you've placed. That should let you pay the pain of setting up the TLS handshake once and easily replicate it out to other servers/services.

  • I appreciate the tip but most of the clients are not allowing Internet access for internal applications I believe. Staying at the TLS support topic: I don't even know what kind of certificate types are issued by the most popular authorities. Right now I can only support JKS and PKCS12 but I haven't found any sources what file type to expect... – Peter May 10 at 20:48
  • None of this requires internet access, it can all be set up in private servers. As to PKCS12, that is a very common certificate format. Check out sslshopper.com/article-most-common-openssl-commands.html to pretty much convert any public/private key pair to PKCS12. Also look into certificate signing as a topic. – Berin Loritsch May 10 at 21:34
1

When it comes down to SSL configuration (or to be more correct HTTPS configuration) i would recommend you test your setup at https://www.ssllabs.com/ssltest/index.html and adjust to get an A grade or A+. Then you apply this config at your customers. HTTPS isn't such a dynamic topic that it changes every month. If your grade drops with the time do B it's still quite good and no need to change something.

Then i would test your setup every 3 months and if the need arises update your setup at your customers. From my experience an adjustment will be needed every 2,3 years (remove unsecure cipher suites) or an popular attack will be discovered. As the setup for HTTPS isn't that big i would not invest my time into developing an UI for HTTPS configuration. Just update manually configuration files/certificates.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.