Skip to content

Commit 0f9dbf1

Browse files
Copilothwupathum
Copilot
authored and
hwupathum
committed
Generate separate signing key pair for digital signatures
1 parent 07228bf commit 0f9dbf1

File tree

7 files changed

+82
-36
lines changed

7 files changed

+82
-36
lines changed

‎backend/cmd/server/repository/conf/deployment.yaml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,13 @@ database:
3535
crypto:
3636
encryption:
3737
key: "file://repository/resources/security/crypto.key"
38+
keys:
39+
- id: "default-key"
40+
cert_file: "repository/resources/security/signing.cert"
41+
key_file: "repository/resources/security/signing.key"
42+
43+
jwt:
44+
preferred_key_id: "default-key"
3845

3946
cors:
4047
allowed_origins:

‎backend/cmd/server/repository/resources/conf/default.json‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -124,8 +124,8 @@
124124
"keys": [
125125
{
126126
"id": "default-key",
127-
"cert_file": "repository/resources/security/server.cert",
128-
"key_file": "repository/resources/security/server.key"
127+
"cert_file": "repository/resources/security/signing.cert",
128+
"key_file": "repository/resources/security/signing.key"
129129
}
130130
]
131131
}

‎build.ps1‎

Lines changed: 19 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -515,7 +515,8 @@ function Prepare-Backend-For-Packaging {
515515
Copy-Item -Path (Join-Path $BACKEND_DIR "bootstrap") -Destination $package_folder -Recurse -Force
516516

517517
Write-Host "=== Ensuring server certificates exist in the distribution ==="
518-
Ensure-Certificates -cert_dir $security_dir
518+
Ensure-Certificates -cert_dir $security_dir -cert_name_prefix "server"
519+
Ensure-Certificates -cert_dir $security_dir -cert_name_prefix "signing"
519520
Write-Host "================================================================"
520521

521522
Write-Host "=== Ensuring crypto file exists in the distribution ==="
@@ -601,7 +602,7 @@ function Build-Sample-App {
601602
# Build React Vanilla sample
602603
Write-Host "=== Building React Vanilla sample app ==="
603604
Write-Host "=== Ensuring React Vanilla sample app certificates exist ==="
604-
Ensure-Certificates -cert_dir $VANILLA_SAMPLE_APP_DIR
605+
Ensure-Certificates -cert_dir $VANILLA_SAMPLE_APP_DIR -cert_name_prefix "server"
605606

606607
Push-Location $VANILLA_SAMPLE_APP_DIR
607608
try {
@@ -668,7 +669,7 @@ function Build-Sample-App {
668669

669670
# Ensure certificates exist for React SDK sample
670671
Write-Host "=== Ensuring React SDK sample app certificates exist ==="
671-
Ensure-Certificates -cert_dir $REACT_SDK_SAMPLE_APP_DIR
672+
Ensure-Certificates -cert_dir $REACT_SDK_SAMPLE_APP_DIR -cert_name_prefix "server"
672673

673674
Push-Location $REACT_SDK_SAMPLE_APP_DIR
674675
try {
@@ -794,7 +795,7 @@ function Package-Vanilla-Sample {
794795

795796
# Ensure the certificates exist in the sample app directory
796797
Write-Host "=== Ensuring certificates exist in the React Vanilla sample distribution ==="
797-
Ensure-Certificates -cert_dir $vanilla_sample_app_folder
798+
Ensure-Certificates -cert_dir $vanilla_sample_app_folder -cert_name_prefix "server"
798799

799800
# Copy the appropriate startup script based on the target OS
800801
if ($SAMPLE_DIST_OS -eq "win") {
@@ -1215,10 +1216,10 @@ function Export-CertificateAndKeyToPem {
12151216

12161217
function Ensure-Certificates {
12171218
param(
1218-
[string]$cert_dir
1219+
[string]$cert_dir,
1220+
[string]$cert_name_prefix = "server" # Default to "server" if not specified
12191221
)
12201222

1221-
$cert_name_prefix = "server"
12221223
$cert_file_name = "${cert_name_prefix}.cert"
12231224
$key_file_name = "${cert_name_prefix}.key"
12241225

@@ -1229,7 +1230,8 @@ function Ensure-Certificates {
12291230
if (-not (Test-Path $local_cert_file) -or -not (Test-Path $local_key_file)) {
12301231
New-Item -Path $LOCAL_CERT_DIR -ItemType Directory -Force | Out-Null
12311232

1232-
Write-Host "Generating SSL certificates in $LOCAL_CERT_DIR..."
1233+
Write-Host "Generating certificates ($cert_name_prefix) in $LOCAL_CERT_DIR..."
1234+
12331235
try {
12341236
$openssl = Get-Command openssl -ErrorAction SilentlyContinue
12351237
if ($openssl) {
@@ -1238,12 +1240,12 @@ function Ensure-Certificates {
12381240
-out $local_cert_file `
12391241
-subj "/O=WSO2/OU=Thunder/CN=localhost" 2>$null
12401242
if ($LASTEXITCODE -ne 0) {
1241-
throw "Error generating SSL certificates: OpenSSL failed with exit code $LASTEXITCODE"
1243+
throw "Error generating certificates: OpenSSL failed with exit code $LASTEXITCODE"
12421244
}
12431245
Write-Host "Certificates generated successfully in $LOCAL_CERT_DIR using OpenSSL."
12441246
}
12451247
else {
1246-
Write-Host "OpenSSL not found - generating self-signed cert using .NET CertificateRequest (no UI)."
1248+
Write-Host "OpenSSL not found - generating certificates using .NET CertificateRequest (no UI)."
12471249
# Use .NET CertificateRequest to avoid CertEnroll / smartcard enrollment UI issues.
12481250
try {
12491251
$rsa = [System.Security.Cryptography.RSA]::Create(2048)
@@ -1302,17 +1304,17 @@ function Ensure-Certificates {
13021304
Write-Host "Certificates generated successfully in $LOCAL_CERT_DIR using .NET CertificateRequest."
13031305
}
13041306
catch {
1305-
throw "Error creating self-signed certificate using .NET APIs: $_"
1307+
throw "Error creating certificates using .NET APIs: $_"
13061308
}
13071309
}
13081310
}
13091311
catch {
1310-
Write-Error "Error generating SSL certificates: $_"
1312+
Write-Error "Error generating certificates: $_"
13111313
exit 1
13121314
}
13131315
}
13141316
else {
1315-
Write-Host "Certificates already exist in $LOCAL_CERT_DIR."
1317+
Write-Host "Certificates ($cert_name_prefix) already exist in $LOCAL_CERT_DIR."
13161318
}
13171319

13181320
# Copy the generated certificates to the specified directory
@@ -1322,13 +1324,13 @@ function Ensure-Certificates {
13221324
if (-not (Test-Path $cert_file) -or -not (Test-Path $key_file)) {
13231325
New-Item -Path $cert_dir -ItemType Directory -Force | Out-Null
13241326

1325-
Write-Host "Copying certificates to $cert_dir..."
1327+
Write-Host "Copying certificates ($cert_name_prefix) to $cert_dir..."
13261328
Copy-Item -Path $local_cert_file -Destination $cert_file -Force
13271329
Copy-Item -Path $local_key_file -Destination $key_file -Force
13281330
Write-Host "Certificates copied successfully to $cert_dir."
13291331
}
13301332
else {
1331-
Write-Host "Certificates already exist in $cert_dir."
1333+
Write-Host "Certificates ($cert_name_prefix) already exist in $cert_dir."
13321334
}
13331335
}
13341336

@@ -1523,10 +1525,11 @@ function Run-Backend {
15231525
)
15241526

15251527
Write-Host "=== Ensuring server certificates exist ==="
1526-
Ensure-Certificates -cert_dir (Join-Path $BACKEND_DIR $SECURITY_DIR)
1528+
Ensure-Certificates -cert_dir (Join-Path $BACKEND_DIR $SECURITY_DIR) -cert_name_prefix "server"
1529+
Ensure-Certificates -cert_dir (Join-Path $BACKEND_DIR $SECURITY_DIR) -cert_name_prefix "signing"
15271530

15281531
Write-Host "=== Ensuring React Vanilla sample app certificates exist ==="
1529-
Ensure-Certificates -cert_dir $VANILLA_SAMPLE_APP_DIR
1532+
Ensure-Certificates -cert_dir $VANILLA_SAMPLE_APP_DIR -cert_name_prefix "server"
15301533

15311534
Write-Host "=== Ensuring crypto file exists for run ==="
15321535
Ensure-Crypto-File -conf_dir (Join-Path $BACKEND_DIR "repository/conf")

‎build.sh‎

Lines changed: 18 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -375,7 +375,8 @@ function prepare_backend_for_packaging() {
375375
chmod +x "$DIST_DIR/$PRODUCT_FOLDER/bootstrap/"*.sh 2>/dev/null || true
376376

377377
echo "=== Ensuring server certificates exist in the distribution ==="
378-
ensure_certificates "$DIST_DIR/$PRODUCT_FOLDER/$SECURITY_DIR"
378+
ensure_certificates "$DIST_DIR/$PRODUCT_FOLDER/$SECURITY_DIR" "server"
379+
ensure_certificates "$DIST_DIR/$PRODUCT_FOLDER/$SECURITY_DIR" "signing"
379380
echo "================================================================"
380381

381382
echo "=== Ensuring crypto file exists in the distribution ==="
@@ -449,7 +450,7 @@ function build_sample_app() {
449450
# Build React Vanilla sample
450451
echo "=== Building React Vanilla sample app ==="
451452
echo "=== Ensuring React Vanilla sample app certificates exist ==="
452-
ensure_certificates "$VANILLA_SAMPLE_APP_DIR"
453+
ensure_certificates "$VANILLA_SAMPLE_APP_DIR" "server"
453454

454455
cd "$VANILLA_SAMPLE_APP_DIR" || exit 1
455456
echo "Installing React Vanilla sample dependencies..."
@@ -466,7 +467,7 @@ function build_sample_app() {
466467

467468
# Ensure certificates exist for React SDK sample
468469
echo "=== Ensuring React SDK sample app certificates exist ==="
469-
ensure_certificates "$REACT_SDK_SAMPLE_APP_DIR"
470+
ensure_certificates "$REACT_SDK_SAMPLE_APP_DIR" "server"
470471

471472
cd "$REACT_SDK_SAMPLE_APP_DIR" || exit 1
472473
echo "Installing React SDK sample dependencies..."
@@ -483,7 +484,7 @@ function build_sample_app() {
483484

484485
# Ensure certificates exist for React API-based sample
485486
echo "=== Ensuring React API-based sample app certificates exist ==="
486-
ensure_certificates "$REACT_API_SAMPLE_APP_DIR"
487+
ensure_certificates "$REACT_API_SAMPLE_APP_DIR" "server"
487488

488489
cd "$REACT_API_SAMPLE_APP_DIR" || exit 1
489490
echo "Installing React API-based sample dependencies..."
@@ -553,7 +554,7 @@ function package_vanilla_sample() {
553554

554555
# Ensure the certificates exist in the sample app directory
555556
echo "=== Ensuring certificates exist in the React Vanilla sample distribution ==="
556-
ensure_certificates "$DIST_DIR/$VANILLA_SAMPLE_APP_FOLDER"
557+
ensure_certificates "$DIST_DIR/$VANILLA_SAMPLE_APP_FOLDER" "server"
557558

558559
# Copy the appropriate startup script based on the target OS
559560
if [ "$SAMPLE_DIST_OS" = "win" ]; then
@@ -627,7 +628,7 @@ function package_react_api_based_sample() {
627628

628629
# Ensure the certificates exist in the sample app dist directory
629630
echo "=== Ensuring certificates exist in the React API-based sample distribution ==="
630-
ensure_certificates "$DIST_DIR/$REACT_API_SAMPLE_APP_FOLDER/dist"
631+
ensure_certificates "$DIST_DIR/$REACT_API_SAMPLE_APP_FOLDER/dist" "server"
631632

632633
# Copy the appropriate startup script based on the target OS
633634
if [ "$SAMPLE_DIST_OS" = "win" ]; then
@@ -826,16 +827,16 @@ function merge_coverage() {
826827

827828
function ensure_certificates() {
828829
local cert_dir=$1
829-
local cert_name_prefix="server"
830+
local cert_name_prefix=${2:-"server"} # Default to "server" if not specified
830831
local cert_file_name="${cert_name_prefix}.cert"
831832
local key_file_name="${cert_name_prefix}.key"
832833

833-
# Generate certificate and key file if don't exists in the cert directory
834+
# Generate certificate and key file if they don't exist in the cert directory
834835
local local_cert_file="${LOCAL_CERT_DIR}/${cert_file_name}"
835836
local local_key_file="${LOCAL_CERT_DIR}/${key_file_name}"
836837
if [[ ! -f "$local_cert_file" || ! -f "$local_key_file" ]]; then
837838
mkdir -p "$LOCAL_CERT_DIR"
838-
echo "Generating SSL certificates in $LOCAL_CERT_DIR..."
839+
echo "Generating certificates (${cert_name_prefix}) in $LOCAL_CERT_DIR..."
839840
OPENSSL_ERR=$(
840841
openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
841842
-keyout "$local_key_file" \
@@ -844,12 +845,12 @@ function ensure_certificates() {
844845
> /dev/null 2>&1
845846
)
846847
if [[ $? -ne 0 ]]; then
847-
echo "Error generating SSL certificates: $OPENSSL_ERR"
848+
echo "Error generating certificates: $OPENSSL_ERR"
848849
exit 1
849850
fi
850851
echo "Certificates generated successfully in $LOCAL_CERT_DIR."
851852
else
852-
echo "Certificates already exist in $LOCAL_CERT_DIR."
853+
echo "Certificates (${cert_name_prefix}) already exist in $LOCAL_CERT_DIR."
853854
fi
854855

855856
# Copy the generated certificates to the specified directory
@@ -858,12 +859,12 @@ function ensure_certificates() {
858859

859860
if [[ ! -f "$cert_file" || ! -f "$key_file" ]]; then
860861
mkdir -p "$cert_dir"
861-
echo "Copying certificates to $cert_dir..."
862+
echo "Copying certificates (${cert_name_prefix}) to $cert_dir..."
862863
cp "$local_cert_file" "$cert_file"
863864
cp "$local_key_file" "$key_file"
864865
echo "Certificates copied successfully to $cert_dir."
865866
else
866-
echo "Certificates already exist in $cert_dir."
867+
echo "Certificates (${cert_name_prefix}) already exist in $cert_dir."
867868
fi
868869
}
869870

@@ -1005,11 +1006,12 @@ function run_backend() {
10051006
local show_final_output=${1:-true}
10061007

10071008
echo "=== Ensuring server certificates exist ==="
1008-
ensure_certificates "$BACKEND_DIR/$SECURITY_DIR"
1009+
ensure_certificates "$BACKEND_DIR/$SECURITY_DIR" "server"
1010+
ensure_certificates "$BACKEND_DIR/$SECURITY_DIR" "signing"
10091011

10101012
echo "=== Ensuring sample app certificates exist ==="
1011-
ensure_certificates "$VANILLA_SAMPLE_APP_DIR"
1012-
ensure_certificates "$REACT_API_SAMPLE_APP_DIR"
1013+
ensure_certificates "$VANILLA_SAMPLE_APP_DIR" "server"
1014+
ensure_certificates "$REACT_API_SAMPLE_APP_DIR" "server"
10131015

10141016
ensure_crypto_file "$BACKEND_DIR/$SECURITY_DIR"
10151017

‎install/helm/README.md‎

Lines changed: 11 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -216,9 +216,17 @@ The following table lists the configurable parameters of the Thunder chart and t
216216
| `configuration.developerClient.path` | Developer client base path | `/develop` |
217217
| `configuration.developerClient.clientId` | Developer client ID | `DEVELOP` |
218218
| `configuration.developerClient.scopes` | Developer client scopes | `['openid', 'profile', 'email', 'system']` |
219-
| `configuration.security.certFile` | Server certificate file path | `repository/resources/security/server.cert` |
220-
| `configuration.security.keyFile` | Server key file path | `repository/resources/security/server.key` |
219+
| `configuration.tls.minVersion` | Minimum TLS version | `1.3` |
220+
| `configuration.tls.certFile` | Server TLS certificate file path | `repository/resources/security/server.cert` |
221+
| `configuration.tls.keyFile` | Server TLS key file path | `repository/resources/security/server.key` |
221222
| `configuration.crypto.encryption.key` | Crypto encryption key (change the default key with a 32-byte (64 character) hex string in production) | `file://repository/resources/security/crypto.key` |
223+
| `configuration.crypto.passwordHashing.algorithm` | Password hashing algorithm | `PBKDF2` |
224+
| `configuration.crypto.passwordHashing.parameters.iterations` | Password hashing iterations | `600000` |
225+
| `configuration.crypto.passwordHashing.parameters.keySize` | Password hashing key size | `32` |
226+
| `configuration.crypto.passwordHashing.parameters.saltSize` | Password hashing salt size | `16` |
227+
| `configuration.crypto.keys[].id` | Signing key identifier | `default-key` |
228+
| `configuration.crypto.keys[].certFile` | Signing certificate file path | `repository/resources/security/signing.cert` |
229+
| `configuration.crypto.keys[].keyFile` | Signing key file path | `repository/resources/security/signing.key` |
222230
| `configuration.database.identity.type` | Identity database type (postgres or sqlite) | `postgres` |
223231
| `configuration.database.identity.sqlitePath` | SQLite database path (for sqlite only) | `repository/database/thunderdb.db` |
224232
| `configuration.database.identity.sqliteOptions` | SQLite options (for sqlite only) | `_journal_mode=WAL&_busy_timeout=5000` |
@@ -255,6 +263,7 @@ The following table lists the configurable parameters of the Thunder chart and t
255263
| `configuration.jwt.issuer` | JWT issuer (derived from server.publicUrl if not set) | derived |
256264
| `configuration.jwt.validityPeriod` | JWT validity period in seconds | `3600` |
257265
| `configuration.jwt.audience` | Default audience for auth assertions | `application` |
266+
| `configuration.jwt.preferredKeyId` | Preferred key ID for signing JWTs (must match a key in configuration.crypto.keys) | `default-key` |
258267
| `configuration.oauth.refreshToken.renewOnGrant` | Renew refresh token on grant | `false` |
259268
| `configuration.oauth.refreshToken.validityPeriod` | Refresh token validity period in seconds | `86400` |
260269
| `configuration.flow.defaultAuthFlowHandle` | Default authentication flow handle | `default-basic-flow` |

‎install/helm/conf/deployment.yaml‎

Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,18 @@ tls:
3535
crypto:
3636
encryption:
3737
key: {{ .Values.configuration.crypto.encryption.key | quote }}
38+
password_hashing:
39+
algorithm: {{ .Values.configuration.crypto.passwordHashing.algorithm | quote }}
40+
parameters:
41+
iterations: {{ .Values.configuration.crypto.passwordHashing.parameters.iterations }}
42+
key_size: {{ .Values.configuration.crypto.passwordHashing.parameters.keySize }}
43+
salt_size: {{ .Values.configuration.crypto.passwordHashing.parameters.saltSize }}
44+
keys:
45+
{{- range .Values.configuration.crypto.keys }}
46+
- id: {{ .id | quote }}
47+
cert_file: {{ .certFile | quote }}
48+
key_file: {{ .keyFile | quote }}
49+
{{- end }}
3850

3951
database:
4052
identity:
@@ -89,6 +101,7 @@ jwt:
89101
issuer: {{ .Values.configuration.jwt.issuer | quote }}
90102
validity_period: {{ .Values.configuration.jwt.validityPeriod }}
91103
audience: {{ .Values.configuration.jwt.audience | quote }}
104+
preferred_key_id: {{ .Values.configuration.jwt.preferredKeyId | quote }}
92105

93106
oauth:
94107
refresh_token:

‎install/helm/values.yaml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -142,6 +142,16 @@ configuration:
142142
encryption:
143143
# WARNING: Replace the default key with a 32-byte (64 character) hex string in production deployments
144144
key: "file://repository/resources/security/crypto.key"
145+
passwordHashing:
146+
algorithm: "PBKDF2"
147+
parameters:
148+
iterations: 600000
149+
keySize: 32
150+
saltSize: 16
151+
keys:
152+
- id: "default-key"
153+
certFile: "repository/resources/security/signing.cert"
154+
keyFile: "repository/resources/security/signing.key"
145155

146156
# Database configuration
147157
database:
@@ -208,6 +218,8 @@ configuration:
208218
jwt:
209219
validityPeriod: 3600
210220
audience: "application"
221+
# This must match the key ID defined in the crypto.keys section
222+
preferredKeyId: "default-key"
211223

212224
# OAuth configuration
213225
oauth:

0 commit comments

Comments
 (0)