how to use two separate SSL certs when my app calls different endpoints?
hey guys. i have a spring application. there are two endpoints that are being called in it (for example
endpoint1 and endpoint2). and also there are two security certificates (for example cretificate1 for endpoint1 and certificate2 for endpoint2). i have a problem. how to switch between certificates? because once the application is running, the JKS is already loaded. how to approach this issue? thanks in advance.55 Replies
⌛ This post has been reserved for your question.
Hey @bambyzas! Please useTIP: Narrow down your issue to simple and precise questions to maximize the chance that others will reply in here./closeor theClose Postbutton above when your problem is solved. Please remember to follow the help guidelines. This post will be automatically closed after 300 minutes of inactivity.
A jks can contain multiple certificates. You could put both certificates into the one keystore and the Endpoints will decide what certificate to use by themselves.
💤 Post marked as dormant
This post has been inactive for over 300 minutes, thus, it has been archived.
If your question was not answered yet, feel free to re-open this post or create a new one.
In case your post is not getting any attention, you can try to use /help ping.
Warning: abusing this will result in moderative actions taken against you.really? i had an idea about being able to load both certificates into the keystore and reference the one i need at any given time with an alias
shouldnt i be using SSL bundles?
Have you installed the KeyStore Explorer? It is a very nice tool.
sure, i have it
i have set up my jks with two certs long time ago
so this part is done
but i dont know what to do next
Start the app and try to use the endpoints. Are there any exceptions?
app starts fine
but wait there for a minute. how is Spring gonna decide which certificate to use for which endpoint?
i just want to understand
Is it a incomming connection to your app? Is it a outgoing connection from your app?
um, idk tbh. my app is running, and then it will be making calls to the 3rd party endpoints. so as i understand its outgoing connection
ok, then it is an outgoing connection from your app.
Well we have 3 phases.
1. Handshake
2. Certificate check
3. Key Exchange.
Here is a good tutorial:
https://youtu.be/j9QmMEWmcfo?t=194
In stage 3 the keys decide what certificates are used for data-transfer.
In phase 1 the TLS asks what chiphres should be used, what encoding algorithm should be used and what blocksize should be used for data-transfer and key-interchange.
In phase 2 the endpoint guarantees to your app that he is authentic.
In phase 3 your app send the signatures of all certificates your app knows, the endpoint then report what signature matches best, then your app use the according certificate.
Then you have a TLS session (aka ssl-session).
btw: in the video your app is the "client" and the endpoint is the "server".
In phase 3 your app send the signatures of all certificates your app knows, the endpoint then report what signature matches best, then your app use the according certificate. okay, but if i have completely different endpoints with different hosts? like facebook.com/endpoint1 and google.com/endpoint2?Unknown User•6mo ago
Message Not Public
Sign In & Join Server To View
but there are two completely separate targets with separate hostnames. how does the target know which cert to choose?
it will just blindly check trustedCertEntry?
Unknown User•6mo ago
Message Not Public
Sign In & Join Server To View
wait. so i can just dump all my certs into one jks, and i can just call two completely different apis and everything will be fine?
Unknown User•6mo ago
Message Not Public
Sign In & Join Server To View
😦
Unknown User•6mo ago
Message Not Public
Sign In & Join Server To View
i dont have such env var
Unknown User•6mo ago
Message Not Public
Sign In & Join Server To View
can you explain this? i dont understand how to read it
and why is it a match like u said?
Unknown User•6mo ago
Message Not Public
Sign In & Join Server To View
and why is it a match like u said?
Unknown User•6mo ago
Message Not Public
Sign In & Join Server To View
but you are sending one certificate here
Unknown User•6mo ago
Message Not Public
Sign In & Join Server To View
ok
Unknown User•6mo ago
Message Not Public
Sign In & Join Server To View
but here i cant see
trustedCertEntry field that u mentionedUnknown User•6mo ago
Message Not Public
Sign In & Join Server To View
but wait. java app isnt sending jks
its sending one cert to the api
Unknown User•6mo ago
Message Not Public
Sign In & Join Server To View
um, yes
Unknown User•6mo ago
Message Not Public
Sign In & Join Server To View
yes. i never said such thing as
trust storeUnknown User•6mo ago
Message Not Public
Sign In & Join Server To View
yes
Unknown User•6mo ago
Message Not Public
Sign In & Join Server To View
oh, now it makes sense
Unknown User•6mo ago
Message Not Public
Sign In & Join Server To View
okay. but what would happen if my api provider changes root cert?
Unknown User•6mo ago
Message Not Public
Sign In & Join Server To View
no, i mean root certificate in general
you know, companies sometimes change their root certs. thats what i meant
Unknown User•6mo ago
Message Not Public
Sign In & Join Server To View
current root cert is
CN DigiCert Global Root CA. but soon it will be changed to digicert global g2 tls rsa sha256 2020 ca1. so the signer (like u said) will not remain unchangedUnknown User•6mo ago
Message Not Public
Sign In & Join Server To View
idk if signer changes. as i understand it remains the same
DigiCert Globalb?Unknown User•6mo ago
Message Not Public
Sign In & Join Server To View
can you provide me some info/resources on that? bc i tried googling and couldnt find any info 😦
Unknown User•6mo ago
Message Not Public
Sign In & Join Server To View
hi
Unknown User•6mo ago
Message Not Public
Sign In & Join Server To View
I was bizzy but I see @imp_o_rt took it just right. Thanks.
💤 Post marked as dormant
This post has been inactive for over 300 minutes, thus, it has been archived.
If your question was not answered yet, feel free to re-open this post or create a new one.
In case your post is not getting any attention, you can try to use /help ping.
Warning: abusing this will result in moderative actions taken against you.