HTTPS
PreviousProtect Google Workspace with eID MFANextProtect sensitive data, such as social security numbers, through obfuscation
Last updated
If SSL/TLS should be use with a Fortified ID product, a keystores must be configured containing keys and certificates to use and/or trust.
Two types of key-/truststores are supported:
Java Keystore format ("JKS")
PKCS#12 ("PKCS12")
Commands to create either of them will be shown below, but in the configuration examples below we will use a Java Keystore format ("JKS").
The examples will only be parts of the configuration.
There are some prerequisite for this use case. You will need the following environment:
Basic knowledge about configuration of the product and the file structure.
The Fortified ID product of your choice installed
We recommend the use of a keystore create from external CA like Digicert or internal PKI environment! If that is not available or for testing, you can create a self signed using one of the supported methods below.
"JKS")Open a command prompt
Change directory to the bin folder of the installed JRE that came with the product. ex. ..\FortifiedID\integrity\web
Run the following command to create the certificate store
Enter keystore password, we will use password as password for the examples.
We will fill in information in the following questions, you can enter the information of your choice.
What is your first and last name? web
What is the name of your organizational unit? test
What is the name of your organization? fortifiedid
What is the name of your City or Locality? stockholm
What is the name of your State or Province? stockholm
What is the two-letter country code for this unit? se
What is the name of your organization? y
Move the certificate to your installed product "config" folder.
"PKCS12")If you would like to use PKCS#12 certificate make sure to change according the modules documentation section.
You need to have openssl installed to run the following command
Change directory to the folder where you have openssl or add the path to the command.
Run the following commands to create the certificate store
In this section we will look at general module configuration needed for SSL/TLS . See the modules section in the documentation for more details.
http_port : port that should be used
http_use_ssl : enable SSL/TLS for the port, true / false
http_keystore_ref : --- add text ---
http_keystore_type : Keystore type PKCS12 or JKS, default PKCS12
http_keystore_alias : Keystore alias
http_keystore_password : Key password
The easiest way to test SSL/TLS is to use the Hello module in Integrity Web. This is the only complete configuration example in this document.
Make sure that you have the certificate in the correct folder.
Change the path and port to suit your environment.
Create / modify the configuration file
Surf to https://<address of your server>:8443,
You should see the following page
Verify the certificate information, if you used the same settings as in the example to create a Java Keystore above, the certificate would look similarly to the image below.
Recommendation: in more complex configurations where the certificate will be used in multiple places in the configuration, we recommend to use the "Globals" technique. In the example below we have used a mix of "globals" and values in the module. This example will give the same result as the example above.
Add SSL/TLS to the Auth module. The examples below is only parts of the configuration.
Add or modify the globals part of the configuration file with the following example, change the path and port to suit your environment.
Add the following in the "config" section of the Auth module, change the configuration to suit your environment.
Verify the configuration
The examples below is only parts of the configuration.
Add or modify the globals part of the configuration file with the following example, change the path and port to suit your environment.
Add the following in the "providers" section of the OIDCModule, change the configuration to suit your environment.
Verify the configuration
The examples below is only parts of the configuration.
Add or modify the globals part of the configuration file with the following example, change the path and port to suit your environment.
Add the following in the "config" section of the Portal module, change the configuration to suit your environment.
Verify the configuration
The examples below is only parts of the configuration.
Add or modify the globals part of the configuration file with the following example, change the path and port to suit your environment.
Add the following in the "config" section of the OathSwEnrollment and OathHwEnrollment modules, change the configuration to suit your environment.
Verify the configuration
