Replicating Using Mutual SSL - docs.day.com

Replicating Using Mutual SSL
Replicating Using Mutual SSL
Overview / CQ / Adobe Experience Manager 5.6.1 / Deploying / Replication /
Configure AEM so that a replication agent on the author instance uses mutual SSL (MSSL) to connect with
the publish instance. Using MSSL, the replication agent and the HTTP service on the publish instance use
certificates to authenticate each other.
To configure MSSL for replication, you must install the cq-5.6.1-featurepack-3465.zip package. Contact your
AEM representative about obtaining this feature pack. The package installs Granite KeyStore, a centralized
KeyStore for AEM. After installing the package, user properties, replication agents, and the CQSE HTTP
service can be configured to interact with Granite KeyStore.
Configuring MSSL for replication involves performing the following steps:
1. Install cq-5.6.1-featurepack-3465.zip on both the author and publish instances.
2. Create or obtain private keys and certificates for the author and publish instances.
3. Install the keys and certificates on the author and publish instances:
• Author: Author's private key and Publish's certificate.
• Pubish: Publish's private key and Author's certificate. The certificate is associated with the user
account that is authenticated with the replication agent.
4. Configure the CQSE HTTP Service on the Publish service.
5. Configure the transport and SSL properties of the replication agent.
You must determine which user account is performing the replication. When installing the trusted author
certificate on the publish instance, the certificate is associated with this user account.
OBTAINING OR CREATING CREDENTIALS FOR MSSL
You require a private key and public certificate for the author and publish instances:
• Private keys must be contained in pkcs#12 or JKS format.
• Certificates must be contained in pkcs#12 or JKS format. Additionally certificate contained in "CER"
format can also be added to Granite Truststore.
• Certificates can be self-signed or signed by a recognized CA.
JKS Format
Generate a private key and a certificate in JKS format. The private key is stored in a KeyStore file, and the
certificate is stored in a TrustStore file. Use Java keytool to create both.
Similar to the information in Enabling HTTP over SSL, perform the following steps using Java keytool to
create the private key and the credential:
1. Generate a private-public key pair in a KeyStore.
2. Create or obtain the certificate:
• Self-signed: Export the certificate from the KeyStore.
• CA-signed: Generate a certificate request and send it to the CA.
3. Import the certificate into a TrustStore.
Use the following procedure to create a private key and a self-signed certificate for both the author and
publish instances. Use different values for command options accordingly.
1.
Open a command-line window or terminal. To create the private-public key pair, enter the following
command, using option values from the table below:
keytool -genkeypair -keyalg RSA -validity 3650 -alias alias -keystore keystorename.keystore keypass key_password -storepass store_password -dname "CN=Host Name, OU=Group Name, O=Company
Name,L=City Name, S=State, C=Country_ Code"
Option
© 2012 Adobe Systems Incorporated.
All rights reserved.
Author
Page 1
Publish
Created on 2015-01-08
Replicating Using Mutual SSL
2.
-alias
author
publish
-keystore
author.keystore
publish.keystore
To export the certificate, enter the following command using option values from the table below:
keytool -exportcert -alias alias -file cert_file -storetype jks -keystore keystore -storepass
store_password
Option
Author
Publish
-alias
author
publish
-file
author.cer
publish.cer
-keystore
author.keystore
publish.keystore
pkcs#12 Format
Generate a private key and a certificate in pkcs#12 format. Use openSSL to generate them. Use the
following procedure to generate a private key and a certificate request. To obtain the certificate, either sign
the request with your private key (self-signed certificate) or send the request to a CA. Then, generate the
pkcs#12 archive that contains the private key and the certificate.
1.
Open a command-line window or terminal. To create the private key, enter the following command,
using option values from the table below:
openssl genrsa -out keyname.key 2048
2.
Option
Author
Publish
-out
author.key
publish.key
To generate a certificate request, enter the following command, using option values from the table
below:
openssl req -new -key keyname.key -out key_request.csr
3.
Option
Author
Publish
-key
author.key
publish.key
-out
author_request.csr
publish_request.csr
Either sign the certificate request or send the request to a CA.
To sign the certificate request, enter the following command, using option values from the table below:
openssl x509 -req -days 3650 -in key_request.csr -signkey keyname.key -out certificate.cer
4.
Option
Author
Publish
-signkey
author.key
publish.key
-in
author_request.csr
publish_request.csr
-out
author.cer
publish.cer
To add your private key and the signed certificate to a pkcs#12 file, enter the following command, using
option values from the table below:
© 2012 Adobe Systems Incorporated.
All rights reserved.
Page 2
Created on 2015-01-08
Replicating Using Mutual SSL
openssl pkcs12 -keypbe PBE-SHA1-3DES -certpbe PBE-SHA1-3DES -export -in certificate.cer -inkey
keyname.key -out pkcs12_archive.pfx -name "alias"
Option
Author
Publish
-inkey
author.key
publish.key
-out
author.pfx
publish.pfx
-in
author.cer
publish.cer
-name
author
publish
INSTALL THE PRIVATE KEY AND TRUSTSTORE ON AUTHOR
Install the following items on the author instance:
• The private key of the author instance.
• The certificate of the publish instance.
To perform the following procedure, you must be logged in as an adminstrator of the author instance.
Install the Author Private Key
1.
4.
Open the User Management page for the author instance. (http://localhost:4502/libs/granite/security/
content/useradmin.html)
To open the properties of your user account, click or tap your user name.
If the Create KeyStore link appears in the Account Settings area, click the link. Configure a password
and click OK.
In the Account Settings area, click Manage Keystore.
5.
Click Add Private Key From Key Store File.
6.
Click Select Key Store file, then browse for and select the author.keystore file or the author.pfx file if
using pkcs#12, then click Open.
Enter an alias and the password for the key store. Enter the alias and password for the private key,
then click Submit.
Close the KeyStore Management dialog box.
2.
3.
7.
8.
© 2012 Adobe Systems Incorporated.
All rights reserved.
Page 3
Created on 2015-01-08
Replicating Using Mutual SSL
Install the Publish Certificate
1.
2.
3.
4.
5.
6.
7.
Open the User Management page for the author instance. (http://localhost:4502/libs/granite/security/
content/useradmin.html)
To open the properties of your user account, click or tap your user name.
If the Create TrustStore link appears in the Account Settings area, click the link, create a password for
the TrustStore and click OK.
In the Account Settings area, click Manage TrustStore.
Click Add Certificate From CER File.
Clear the Map Certificate to User option. Click Select Certificate File, select publish.cer, and click
Open.
Close the TrustStore Management dialog box.
INSTALL PRIVATE KEY AND TRUSTSTORE ON PUBLISH
Install the following items on the publish instance:
• The private key of the publish instance.
• The certificate of the author instance. Associate the certificate with the user that is used to execute
replication requests.
To perform the following procedure, you must be logged in as an adminstrator of the publish instance.
© 2012 Adobe Systems Incorporated.
All rights reserved.
Page 4
Created on 2015-01-08
Replicating Using Mutual SSL
Install the Publish Private Key
1.
2.
3.
4.
5.
6.
7.
8.
Open the User Management page for the publish instance. (http://localhost:4503/libs/granite/security/
content/useradmin.html)
To open the properties of your user account, click or tap your user name.
If the Create KeyStore link appears in the Account Settings area, click the link. Configure a password
and click OK.
In the Account Settings area, click Manage Keystore.
Click Add Private Key From Key Store File.
Click Select Key Store file, then browse for and select the publish.keystore file or the publish.pfx file if
using pkcs#12, then click Open.
Enter an alias and the password for the key store. Enter the alias and password for the private key,
then click Submit.
Close the KeyStore Management dialog box.
Install the Author Certificate
1.
2.
3.
4.
5.
6.
7.
Open the User Management page for the publish instance. (http://localhost:4503/libs/granite/security/
content/useradmin.html)
Locate the user account that you use to execute replication requests, and click or tap the user name.
If the Create TrustStore link appears in the Account Settings area, click the link, create a password for
the TrustStore and click OK.
In the Account Settings area, click Manage TrustStore.
Click Add Certificate From CER File.
Make sure the Map Certificate to User option is selected. Click Select Certificate File, select author.cer,
and click Open.
Click Submit, then close the TrustStore Management dialog box.
CONFIGURE THE HTTP SERVICE ON PUBLISH
Configure the properties of the Day CQSE HTTP Service on the publish instance so that it uses HTTPS
while accessing Granite Keystore. The PID of the service is org.apache.felix.http.
The following table lists the OSGi properties that you need to configure whether you are using the Web
Console or a sling:OsgiConfig node:
Property Name on Web Console
OSGi Property Name
Value
Enable HTTPS
org.apache.felix.https.enable
true
Enable HTTPS To Use Granite
KeyStore
org.apache.felix.https.use.granite.keystore
true
HTTPS Port
org.osgi.service.http.port.secure
Client Certificate
org.apache.felix.https.clientcertificate"Client Certificate Wanted"
8443 (or other desired port)
CONFIGURE THE REPLICATION AGENT ON AUTHOR
Configure the replication agent on the author instance to use the HTTPS protocol when connecting to
the publish instance. For complete information about configuring replication agents see Configuring Your
Replication Agents.
To enable MSSL, configure the properties on the Transport tab according to the following table:
Property
Value
URI
https://server_name:SSL_port/bin/receive?
sling:authRequestLogin=1
© 2012 Adobe Systems Incorporated.
All rights reserved.
Page 5
Created on 2015-01-08
Replicating Using Mutual SSL
For example:
https://localhost:8443/bin/receive?
sling:authRequestLogin=1
User
No value
Password
No value
SSL
Client Auth
After you configure the replication agent, test the connection to determine whether MSSL is configured
correctly.
29.08.2014 14:02:46 - Create new HttpClient for Default Agent
29.08.2014 14:02:46 - * HTTP Version: 1.1
29.08.2014 14:02:46 - * Using Client Auth SSL configuration *
29.08.2014 14:02:46 - adding header: Action:Test
29.08.2014 14:02:46 - adding header: Path:/content
29.08.2014 14:02:46 - adding header: Handle:/content
29.08.2014 14:02:46 - deserialize content for delivery
29.08.2014 14:02:46 - No message body: Content ReplicationContent.VOID is empty
29.08.2014 14:02:46 - Sending POST request to https://localhost:8443/bin/receive?
sling:authRequestLogin=1
29.08.2014 14:02:46 - sent. Response: 200 OK
29.08.2014 14:02:46 - -----------------------------------------------29.08.2014 14:02:46 - Sending message to localhost:8443
29.08.2014 14:02:46 - >> POST /bin/receive HTTP/1.0
29.08.2014 14:02:46 - >> Action: Test
29.08.2014 14:02:46 - >> Path: /content
29.08.2014 14:02:46 - >> Handle: /content
29.08.2014 14:02:46 - >> Referer: about:blank
29.08.2014 14:02:46 - >> Content-Length: 0
29.08.2014 14:02:46 - >> Content-Type: application/octet-stream
29.08.2014 14:02:46 - -29.08.2014 14:02:46 - << HTTP/1.1 200 OK
29.08.2014 14:02:46 - << Connection: Keep-Alive
29.08.2014 14:02:46 - << Server: Day-Servlet-Engine/4.1.64
29.08.2014 14:02:46 - << Content-Type: text/plain;charset=utf-8
29.08.2014 14:02:46 - << Content-Length: 26
29.08.2014 14:02:46 - << Date: Fri, 29 Aug 2014 18:02:46 GMT
29.08.2014 14:02:46 - << Set-Cookie: login-token=3529326c-1500-4888a4a3-93d299726f28%3ac8be86c6-04bb-4d18-80d6-91278e08d720_98797d969258a669%3acrx.default; Path=/;
HttpOnly; Secure
29.08.2014 14:02:46 - << Set-Cookie: cq-authoring-mode=CLASSIC; Path=/; Secure
29.08.2014 14:02:46 - <<
29.08.2014 14:02:46 - << R
29.08.2014 14:02:46 - << eplicationAction TEST ok.
29.08.2014 14:02:46 - Message sent.
29.08.2014 14:02:46 - -----------------------------------------------29.08.2014 14:02:46 - Replication (TEST) of /content successful.
Replication test succeeded
© 2012 Adobe Systems Incorporated.
All rights reserved.
Page 6
Created on 2015-01-08

Download Report