Add Trusted CA Certificates

Trust storeYou must have the certificate(s) ready in a PKCS12 trust store named truststore.p12. The trust store must contain all certificates required for all trusted communication initiated by xorlab Authentication Service (LDAP, SAML2, etc.). For every service, only the outermost signer certificate is required to be a part of the trust store as long as the service supplies a correct certificate chain. By inserting a concrete server certificate into the trust store, that certificate is pinned explicitly.To create a trust store, you can use Keytool or OpenSSL. In a nutshell, you have to add your certificate file (.pem, .crt, .cer, .p7b, or .p7c) to the trust store. You can do this with the following keytool command:keytool -import -file certificate.pem -alias ca1 -keystore truststore.p12This command will export your certificate.pem file to the truststore.p12 trust store file, giving the certificate a ca1 alias.

Open the auth/auth/auth.yml file using the XCC Expert Editor.

Add the following block and enter the password of your provided trust store:

auth.yml

trustStore:
  # The type of the trust store to use. Default is PKCS12 which is also the default
  # these days when using the 'keytool' shipped with the JRE.
  type: pkcs12
  # The default trust store file. Defaults to 'truststore.p12'. Relative paths are resolved
  # relative to the config directory.
  file: truststore.p12
  # The trust store password.
  password: <trust_store_password>

The password of the trust store delivered with a new deployment is documented in Deployment Defaults → Trust store password. Access to that page is restricted.

Click Publish. The authentication configuration becomes active within about one minute.

Switch to the CLI of the XCC and execute the following instructions one by one:

sudo su -s /bin/bash xcc_backend
cd /var/lib/xorlab/xcc/config/work/ag_local/auth/auth

Copy the truststore.p12 file containing your certificate into the folder specified above.

Execute the following instructions one by one:

git add .
git commit -m "Adding truststore file"
exit

The Authentication service restarts automatically and applies the new configuration.

⌘I