Internet Security, Certificates, SSL

_

_

Introduction to Preparing Your Operational Environment

Before you configure your opentaps system with any of your business data, or your company's confidential information, or your company employee's data, it will be prudent to consider the security of your opentaps system servers and the related internet network security. Best practices with respect to this topic suggest the following partial list of salient points:

• Your server should be protected by a properly configured firewall to allow only the required forms of network access, as defined by your management and their technical system administrative staff.
• Any internet access to the opentaps server should probably be limited to SSL (secure socket layer) internet transmission layer security, as determined by your management and their technical system administrative staff. Consider both the public internet and any in-house local internets in this topic.
• You should secure all of the opentaps IDs that are active on the system, using a strong and unique password having properly limited distribution to users with a business need for them, and you should disable all other IDs on opentaps.
• You should make sure that your technical system administrator has secured all of the opentaps host server software components and related ports of every kind, so that no unintended routes of access are possible on your system.
• You should make sure that your opentaps server has physical security that is practiced 100% of the time, and that is robust enough to meet your management's requirements.
• Before you put any of your opentaps system functions into a production mode of operation, you should develop, test, and deploy your methods for system data backup and for system data restoration. You should actually practice the system data restoration periodically to make sure that it actually does work.
• Consider whether you will need a server for testing data restoration, migration, or new software component releases that is separate from the production servers that you use. (Usually, production servers are off limits for testing purposes.)
• Included in this preparation, you should include a determination of when backup will be collected, by whom, and where it will be stored so that if your operational facility is breached or destroyed there will still be a copy of your system backup data available, somewhere else.
• Make your own list adding all items to this topic which your company deems essential to your own best practices, and complete working your list. When making your own complete list, you may wish to consider what you would do if the internet access suffers an outage, either on the public internet or on your own local internets, or if the physical opentaps server computer suffers an outage.

If you do not need to attach your server to the internets while you are doing preliminary configuration, and preparing your environment then you may be able to phase some of the steps to make progress while other steps are still being completed.

Using SSL for opentaps Internet Security

opentaps can be configured to permit access only by the secure internet protocols, thus reducing the opportunity for unauthorized access to your system. This means having your users log-in and use your opentaps system via the secure internet https protocol (rather than non-encrypted http), and using the SSL-enabled ports (default on opentaps is port 8443) rather than the non-encrypted ports such as 80 or 8080.

Then there is the question of what to do about the SSL Certificate. The certificate is simply your internet identification "papers", including an encryption key that is uniquely yours, and these items are kept in a unique secure, encrypted file which acts as a lock box. This certificate (identity document) can be one that you have created and signed yourself, or it can be one that you initiate and submit to a public "certificate authority" recognized by the industry at large. Such a certificate authority will validate your identity first, then sign your certificate and return it to you for installation on your server(s). Thus, a chain of trust is created that your end-users or the customers of your eCommerce operations can rely upon.

Caution and Warning about Security and Access

When opentaps is downloaded in the release package and installed it contains a certificate for one of the organizations which produce the opentaps system releases. So that certificate is not yours, and it is not unique since many people will download the release code and install it with that common certificate. While you could operate with this default certificate for non-critical testing (using no private information of any kind) you must install your own unique certificate for secure use of the opentaps system. Also, the opentaps system, when it is initially installed, has several user identities enabled with trivial passwords that everyone knows about. You should disable or change passwords on all the existing IDs.

Introduction to Using SSL Certificates and Use Cases

The kind of Certificate you need depends upon how your opentaps system will be used, and by whom. Web browser software on the end user's computer will react differently to a self signed certificate which carries your unverified identity and your encryption key, as compared to a Certificate Authority signed certificate which has verified your identity, and also carries your encryption key. This verification of your identity is the significant item of difference.

You have the choice of using either a do-it-yourself, self-signed certificate or of purchasing a Certificate Authority verified and signed SSL certificate. The end user's web browser (such as Firefox or Internet Explorer) comes equiped with its on list of Certificate Authorities and will usually accept your certificate signed by one of them, without raising any warning messages to the user.

• Typically, a self-signed certificate will be used when your users of opentaps are internal to your organization and operate mostly on the same internal network. They will have been trained in how to manage the web browser warning and permission messages that are produced when self-signed certificates are being used. (Refer to your web browser documentation for guidance on handling such messages.)
• A certificate purchased from a Certificate Authority, such as GeoTrust, GoDaddy, VeriSign and others would be required for communications with users who are unable or unwilling to work with an unverified company identity that is using a self-signed certificate. Their issue with self-signed certificates is that the user cannot tell whether or not your internet site is legitimate unless they have personal knowledge of your company.
• Thus, if opentaps will be used for eCommerce with a secure checkout procedure, a Certificate Authority issued certificate is likely the best option. This will give the user the required confidence in your legitimacy and also an error-free/warning-free user experience.

In opentaps configuration, whether using a self-signed or Certificate Authority signed and issued certificate, the same certificate is used for securely connecting to all parts of the opentaps system. Whether you are working in the various modules of the system, or your customers are shopping on your opentaps eCommerce site, the single certificate is controlling access and security for your user networks.

Configuring Your opentaps Server with an SSL Certificate

There are several possible operational configurations for the opentaps server software, and the one you choose to implement will determine how the secure socket layer (SSL) Certificate will need to be installed.

We will begin by describing how to install your unique Certificate for opentaps simplest installation, which involves using the imbedded web server supplied in opentaps' pre-compiled, downloadable form for Linux.

Then, we will discuss some tips about how to handle the Certificates obtained in various formats from the authorities who sell "signed" and verified certificates. Finally, we will consider other possible opentaps installations and related Certificate issues.

Installing A Self Signed Certificate for the Default Linux Installation

To Use a Self-Signed Certificate You can create your own self signed SSL Certificate and install it for use with opentaps. To do so, you will use the keytool command provided in Linux which will produce a DER certificate, a DER Key, and store them into a Java Key Store (JKS) file suitable for the default web server delivered with opentaps (Tomcat). Thus, in this example, no file format conversions are required.

The following five steps are described in detail below:

• Create a Self-Signed Certificate

• Modify opentaps

• Restart opentaps

• Testing Your Certificate

Create a Self-Signed Certificate

Note: In the following list of questions from the keytool command, the requested "first and last name"
should be the name of your server, not your own name.  
*  For example, if you access your server as  
      http://localhost, or as
      http://localhost:8080
   then the answer is localhost.
*  If you use http://opentaps.mycompany.com:port#, then put opentaps.mycompany.com as the
   answer to "first and last name"

Run the following command and answer the questions presented as appropriate for your own company. You are asked for two passwords, the first one is for the keystore (lockbox) that contains your finished certificate, the second one is for the encryption key. You can use the same password for both of these (recommended for simplicity). This keytool command produces a new "opentaps.jks" file which is the keystore with encryption key required for your installation.

Change directory to the opentaps installation directory, so that your opentaps.jks 
will be stored in the correct place on the file system,
$ CD /. . ./opentaps_home
$ keytool -genkey -alias opentaps -keyalg RSA -keystore framework/base/config/opentaps.jks
Enter keystore password:  opentaps
What is your first and last name?
 [Unknown]:  localhost
What is the name of your organizational unit?
 [Unknown]:  Si Chen
What is the name of your organization?
 [Unknown]:  Open Source Strategies, Inc.
What is the name of your City or Locality?
 [Unknown]:  Los Angeles
What is the name of your State or Province?
 [Unknown]:  CA
What is the two-letter country code for this unit?
 [Unknown]:  US
Is CN=localhost, OU=Si Chen, O="Open Source Strategies, Inc.", L=Los Angeles, ST=CA, C=US correct?
 [no]:  yes

Enter key password for <opentaps>

       (Press only RETURN key if same as keystore password):  opentaps

Modify Opentaps File Names as follows

Now you must point opentaps to your new keystore file, opentaps.jks.

Modify the file framework/base/config/ofbiz-containers.xml under <property name="https-connector" value="connector">

From the original installation values which follow:

<property name="keystoreFile" value="framework/base/config/ofbizssl.jks"/>

<property name="keystorePass" value="changeit"/>

Enter these new values instead:

<property name="keystoreFile" value="framework/base/config/opentaps.jks"/>

<property name="keystorePass" value="opentaps"/>

Restart Opentaps Server

Stop the opentaps server and then restart it using the commands described in your installation instructions. On the Linux command line and in the opentaps installation directory:

./stopofbiz.sh      then, wait until the stopping process is completed
./startofbiz.sh     to restart the opentaps server.

Testing your Certificate Installation

Open a connection to your opentaps server using your own URL similar to https://URL:8443. (Do not connect using http://URL:8080 as this is the non-secured connection to the server). You will likely receive a certificate warning message. This is because your browser does not have a client certificate that recognizes your self-signed server certificate. If required by your browser, approve the exception and connect to your server. Regardless of the warning, your connection should be a secure SSL connection and your web browser should display its small "lock" symbol indicating this fact.

To install a client certificate that will recognize your server certificate, visit the documentation provided by your web browser for instructions on this operation.

Note: To facilitate future configuration for your company server, you can put the keystore or 
JKS file (opentaps.jks in this exercise) in the hot-deploy/ component for your own company, 
instead of framework/base/config/ folder.

Installing A Purchased CA-Signed Certificate for the Default Linux Installation

This discussion assumes that you need to purchase your verified and signed certificate from a Certificate Authority (CA) that is well known to the industry web browser software providers. Therefore, when properly installed in opentaps it will produce a user experience free of any warning messages regarding your web site or your identity.

To obtain such a certificate, you will choose a Certificate Authority to provide it, and follow their directions for submitting your unique company information and a private key that you will need to generate using tools available on Linux or supplied by your CA.

Submitting Your Request File

As an example only, the command for generating your own private encryption key using the openssl command for linux, might look like this:

openssl genrsa -out ssl.key 

This produces a pair of keys in the file ssl.key which is stored in your current directory. You will also need to produce the certificate request file that goes to the Certificate Authority:

openssl req -new-x509 -key ssl.key -out ssl.crt

This produces a certificate request (.crt file) using your newly created ssl.key file as one input, plus other information you must provide. In the case of a specific Certificate Authority you have chosen, you will follow their directions carefully for these last two steps.

Warning: If you need to open and view the files produced here for any reason, use
only basic text editors, never us an advanced work processor -- which may insert
invisible characters or changes to your files rendering them corrupted, and unusable. 

When your certificate comes back from the CA it may be in PEM format, or possibly another format. A PEM certificate file looks something like this and it includes the Begin line and the End line as part of the content:

---

BEGIN CERTIFICATE-----

MIIDVzCCAsCgAwIBAgIDD96eMA0GCSqGSIb3DQEBBQUAME4xCzAJBgNVBAYTAlVT WjCB4zEpMCcGA1UEBRMgbTc1VVk4QzNPMXhabnYtNkhNLTMwTDZWTXg2QnVuRVkx CzAJBgNVBAYTAlVTMRMwEQYDVQQKEwpjdnJ1cHMuY29tMRMwEQYDVQQLEwpHVDYy ODAxNzcwMTEwLwYDVQQLEyhTZWUgd3d3Lmdlb3RydXN0LmNvbS9yZXNvdXJjZXMv MRAwDgYDVQQKEwdFcXVpZmF4MS0wKwYDVQQLEyRFcXVpZmF4IFNlY3VyZSBDZXJ0 aWZpY2F0ZSBBdXRob3JpdHkwHhcNMTAwMzE1MDQwNDI0WhcNMTEwMzE3MTM1OTU1 MRAwDgYDVQQKEwdFcXVpZmF4MS0wKwYDVQQLEyRFcXVpZmF4IFNlY3VyZSBDZXJ0 aWZpY2F0ZSBBdXRob3JpdHkwHhcNMTAwMzE1MDQwNDI0WhcNMTEwMzE3MTM1OTU1 MRAwDgYDVQQKEwdFcXVpZmF4MS0wKwYDVQQLEyRFcXVpZmF4IFNlY3VyZSBDZXJ0 aWZpY2F0ZSBBdXRob3JpdHkwHhcNMTAwMzE1MDQwNDI0WhcNMTEwMzE3MTM1OTU1 MRAwDgYDVQQKEwdFcXVpZmF4MS0wKwYDVQQLEyRFcXVpZmF4IFNlY3VyZSBDZXJ0 aWZpY2F0ZSBBdXRob3JpdHkwHhcNMTAwMzE1MDQwNDI0WhcNMTEwMzE3MTM1OTU1

---

END CERTIFICATE-----

Installing Your Certificate *** THIS SECTION IS BEING TESTED AND EDITED ***

To actually use your certificate in opentaps you must load it into a Java Key Store (JKS) from which the opentaps web server will make use of it. The content of this JKS is required to be in DER format, which is the binary version of your certificate. Download your two files from the CA (a cert file and a key file) into your opentaps installation directory.

In case your certificate is in PEM format you will need to convert it to DER and then load it into your Java Key Store (lockbox) file. You may receive two files from the CA with names similar to these:

• key.pem which is the private key file in PEM format
• cert.pem which is the certificate file in PEM format

Run the following two commands to convert each of these two files into DER format:

$ openssl pkcs8 -topk8 -nocrypt -in key.pem -inform PEM -out key.der -outform DER

$ openssl x509 -in cert.pem -inform PEM -out cert.der -outform DER

This produces the two files in the format (DER) required for your opentaps Java Key Store.

The final step is to import these two files into the Java Key Store file using a Java program called ImportKey. (See the footnote about where you can get the ImportKey program.) Run the following command:

$ java ImportKey key.der cert.der
Using keystore-file : /home/user/keystore.ImportKey
One certificate, no chain.
Key and certificate stored.
Alias:importkey  Password:importkey

Change the password on the keystore to "opentaps" using this command:

$ keytool -keystore keystore.ImportKey -storepass Enter keystore password:importkey New keystore password:opentaps Re-enter new keystore password:opentaps

Modify opentaps

Restart opentaps

Test