Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Update SECURITY.md for #513 with some clearer instruction around keys and keystores #514

Open
wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Update SECURITY.md for #513 with some clearer instruction around keys and keystores #514

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 3 additions & 1 deletion SECURITY.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ If set to true, then the default certificates from the JVM are used in addition

### Providing custom certificates (`20.0.0.3+`)

It is possible to provide custom PEM certificates by mounting the files into the container. Files that will be imported are `tls.key`, `tls.crt` and `ca.crt`.
It is possible to provide custom PEM certificates by mounting the files into the container. Files that will be imported are `tls.key`, `tls.crt` and `ca.crt`. The private key `tls.key` must not be encrypted or container startup will fail.

The location can be specified by `TLS_DIR` environment variable. Default location
for certificates is `/etc/x509/certs/`.
Expand All @@ -26,6 +26,8 @@ A custom keystore can be provided during the application image's build phase by

You must then override the keystore's password by including your copy of the `keystore.xml` file inside the `/config/configDropins/defaults/` directory.

Adding the key.p12 file and the keystore.xml override must happen after any calls to `features.sh` or `configure.sh` so they take precedence over anything generated by `features.sh` and `configure.sh`.


## Single Sign-On configuration
The following variables configure container security for Single Sign-On using the socialLogin-1.0 feature.
Expand Down