Certificate Authority

[eudyptula]

Been having some trouble getting the certificate authority working:

• If I start it in secure mode, the client lacks the SSLContext to connect to it.
• If I start it in insecure mode, it cannot communicate with the other core systems (which is still in secure mode), so it cannot get the public key from the authorisation system.

Kinda got it all to work in secure mode, but had to bypass a few security measurements to do so:

1. Had to call setNeedClientAuth(false) in the CA, so it doesn't require a certificate from the client, which it cannot provide at this stage.
2. Changed CertAuthorityACF to not filter anything - again as the client cannot provide any certificates to filter on.
3. I manually transferred the cloud trust store to the client and loaded it in the CertificateBootstrapper class, so that the client would accept the certificate from the CA system. Was playing around with getting it through an insecure version of the CA, started simultaneously with the secure version - didn't get that to work though.

Anyhow, know that this is probably not the correct/secure solution to take, just thought I'd report on my progress playing with the CA. Haven't pushed any of this in, so it won't get mixed up in the release code (if I do I will keep it on a separate branch in my own fork).

[uzoltan]

Yeah I am aware of this design issue and I told about it to Csaba too.

My hack to test the CA functions were much simpler:

• Start the other secure core systems
• Start an insecure SR, pointing to the same database as the secure SR.
• Start the CA in insecure mode, so clients can connect to it.

[eudyptula]

Well, my changes would make it run with just the secure versions...

Coming to think about it, the CA should probably just accept any self-signed certificate from the client, and use the client's public key to encrypt the response - that way only the client is able to read it.

[uzoltan]

I think that's a good idea.

[uzoltan]

Csaba said that when the full bootstrapping process is figured out, application systems most likely wont be directly calling the CA system, so I'm closing this for now.