cloudfoundry / cloudfoundry/uaa-release
Decouple UAA Start from pkcs12
- Dominant language
- Ruby
- Stars
- 28
- Forks
- 77
- Avg merge
- 1d 3h
- Merged PRs (30d)
- 14
Description
During Bosh Start the SSL key files are packed into pkcs12 with openssl
This fails on FIPS compliant images - again.
With new Spring Boot 3.x and also in new Tomcat the plain key files can be used, thus we should remove the workaround to create a keystore in pkcs12 format.
Boot
server.ssl.bundle.pem.webserver.key.alias=my-alias
server.ssl.bundle.pem.webserver.key.store=file:/path/to/private.key
server.ssl.bundle.pem.webserver.trust.store=file:/path/to/certificate.crt
Tomcat
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the Bosh Start flow that packs the SSL key files into pkcs12, then compare it with the Spring Boot 3.x and Tomcat plain-key configuration shown in the issue. Done means the pkcs12 workaround is removed, plain key and certificate files are used, and the flow works on FIPS-compliant images.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- spring-boot
- Domain
- backend
- Issue type
- Refactor
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100