ssl Posts

Securing Connection Between Pods in Openshift with SSL

On this post, im trying to create a simple microservices application on top of Openshift 3.11 and each services will do a simple secure connection between it by using a self-sign SSL which are managed by Openshift.

The goal of why Openshift are managing SSL certificate thru Openshift Secret is to have a rolling or rotating certificate feature on each services but can be triggered by Openshift without have to replace SSL on each services manually.

First is generate a p12 certificate by using keytool

cert>keytool -genkey -alias edw 
	-keystore edw.p12 -storetype PKCS12 
	-keyalg RSA -storepass password 
	-validity 730 -keysize 4096
What is your first and last name?
  [Unknown]:  Edwin
What is the name of your organizational unit?
  [Unknown]:  Company 01
What is the name of your organization?
  [Unknown]:  IT
What is the name of your City or Locality?
  [Unknown]:  Jakarta
What is the name of your State or Province?
  [Unknown]:  Jakarta
What is the two-letter country code for this unit?
  [Unknown]:  ID
Is CN=Edwin, OU=Company 01, O=IT, L=Jakarta, ST=Jakarta, C=ID correct?
  [no]:  yes

Next is creating two java projects which are connected one and another,

There are several part of the code that need mentioning,

First is making sure https option is active on, include our p12 certificate and make certificate password as parameterized. This parameter later on will be injected as environment variables on Openshift.



And the next is because we are using a custom certificate, dont forget to include it on RestTemplate.

public class MyRestTemplate {

    private String sslKeyStore;

    private String sslPassword;

    public RestTemplate restTemplate() throws Exception {
        KeyStore clientStore = KeyStore.getInstance("PKCS12");
        clientStore.load(new FileInputStream(sslKeyStore), sslPassword.toCharArray());

        SSLContext sslContext = SSLContextBuilder
                .loadTrustMaterial(clientStore, new TrustSelfSignedStrategy())
        SSLConnectionSocketFactory socketFactory = new SSLConnectionSocketFactory(sslContext, NoopHostnameVerifier.INSTANCE);
        HttpClient httpClient = HttpClients.custom()
        HttpComponentsClientHttpRequestFactory factory = new HttpComponentsClientHttpRequestFactory(httpClient);

        return new RestTemplate(factory);

Deploy those two application to Openshift,

oc new-app

oc new-app

Deploy certificate as OCP Secret and mount it as a volume on our application,

oc create secret generic cert --from-file=cert\edw.p12

oc set volume dc ssl-pods-example --add -t secret -m /deployments/cert --name cert --secret-name cert
oc set volume dc ssl-pods-example-2 --add -t secret -m /deployments/cert --name cert --secret-name cert

And our certificate password as OCP Secret and inject it as environment variable to our application

oc create secret generic sslpassword --from-literal=SSLPASSWORD=password

oc set env dc ssl-pods-example --from=secret/sslpassword 
oc set env dc ssl-pods-example-2 --from=secret/sslpassword 

After all deployed on OCP, next is give a route for our application. Im using re-encrypt method for ensuring an end to end encryption within the app. In order to do so, we need to include our application CA certificate as our route’s destination certificate. We can do so by exporting our certificate from p12 file using this command,

keytool -exportcert -keystore edw.p12 -storetype PKCS12 -storepass password -alias edw -file edw.crt -rfc

And paste the certificate on our route,

The end result would be like below image,

And as you can see, we are using certificate from end to end for securing our connection.


Error “Expecting: TRUSTED CERTIFICATE” when Deploying .cer Certificate on Nginx

Got this very weird error when adding .key and .cer on my nginx SSL, “140387178489504:error:0906D06C:PEM routines:PEM_read_bio:no start line:pem_lib.c:703:Expecting: TRUSTED CERTIFICATE”. It’s very weird because it works well previously.

At first i tought it was because i need to convert .cer to .crt, but even i cannot convert my .cer file using openssl. So i come to a conclusion that somehow there was an issue on my .cer file. First my .cer file looks fine when im opening it using vi


But when im open it using vi -b (vi -b /home/certificate/my.cer), it shows some weird symbols.

<ff><fe>-^@-^@-^@-^@-^@B^@E^@G^@I^@N^@ ^@C^@E^@R^@T^@I^@F^@I^@C^@A^@T^@E^@-^@-^@-^@-^@-^@^M^@

Somehow it happens because im transferring my .cer file between my windows desktop to my linux server environment. Using dos2unix command from my windows environment solve this issue,

C:\Users\edw>dos2unix C:\my.cer
dos2unix: converting UTF-16LE file C:\Users\edw\Downloads\selfcare.cer to ANSI_X
3.4-1968 Unix format...

i have dos2unix on my windows environment from cygwin installment.