Skip to main content
Version: 5.1.1.0

Orchestra SSL Keystore Configuration

To establish HTTPS connections, Orchestra utilizes a private/public key-pair from an internal keystore. This occurs when a client requests a TLS-secured connection. The keystore configuration is defined in the orchestra_configuration.xml file:

<configuration>

   <service name = "MasterdataService" class = "emds.epi.impl.baseservice.OrchestraBaseService" > 
      ...
   <group name = "SSLSettings">
     <parameter   name = "PROTOCOL"                                  value = "TLS" /> 
     <parameter   name = "KEYSTORE"                                  value = "config/security/orchestra.keystore" /> 
     <parameter   name = "KEYSTORE.PASSWORD"                value = "000841454d455854414a00066d65646f626b000000105ef6774724235d102526ef03e131532f" /> 
     <parameter   name = "KEYSTORE.KEYPASSWORD"          value = "000841454d455854414a00066d65646f626b000000105ef6774724235d102526ef03e131532f" />
     <parameter   name = "TRUSTSTORE"                              value = "config/security/orchestra.truststore" />
     <parameter   name = "TRUSTSTORE.PASSWORD"        value = "000841454d455854414a00066d65646f626b000000105ef6774724235d102526ef03e131532f" />
     <parameter   name = "TRUSTSTORE.TYPE"                  value = "JKS"/> 
   </group>

The configuration parameters for using the server certificate are located in the orchestra_configuration.xml file. The following parameters within the group SSLSettings can be configured:

ParameterDescription
KEYSTORELocation of the keystore. The keystore must be inside the classpath of Orchestra. The default value is config/orchestra_keystore. It is not possible to use an absolute path outside Orchestra.
KEYSTORE.PASSWORDPassword for accessing the keystore, encrypted according to "Orchestra password encryption" (generated with the pwd_manager scripts from Orchestra, see Password).
KEYSTORE.KEYPASSWORDPassword for accessing the private key, encrypted according to "Orchestra password encryption" (generated with the pwd_manager scripts from Orchestra, see Password).
KEYSTORE.TYPEType of the used keystore. Possible values are "JKS" (Java Keystore) and "PKCS12" (Keystore in PKCS12 format).

Useful Commands for Creating Certificates and Keystores with OpenSSL​

Creation of a Private/Public Key-Pair with OpenSSL​

openssl req -new -x509 -extensions v3_ca -keyout cakey.pem -out cacert.pem -days 3650

The password is "ORCHESTRA".

Create PKCS#12 Keystore with the Created Private/Public Key-Pair with OpenSSL​

openssl pkcs12 -export -inkey cakey.pem -in cacert.pem -out cakeycert.pkcs12 -name orchestra -noiter -nomaciter

Convert PKCS#12 Keystore into a JKS Keystore​

keytool -importkeystore -srckeystore cakeycert.pkcs12 -srcstoretype pkcs12 -srcalias orchestra -destkeystore orchestra.keystore_soffico -deststoretype jks -deststorepass ORCHESTRA -destalias orchestra

Using KeyStore Explorer​

You may also use the free tool KeyStore Explorer, which provides a graphical user interface. Download it from https://keystore-explorer.org/.

  1. Copy \<path to tomcat\>\webapps\orchestra\WEB-INF\classes\config\security\orchestra.keystore.

  2. Execute KeyStore Explorer as administrator.

  3. Open the copied keystore in KeyStore Explorer (Password: ORCHESTRA).

  4. Delete the old key pair from the keystore (alias: orchestra).

  5. Import the new key pair.

  6. Select the key pair file.

  7. Enter the password for the private key.

  8. Select the key pair for import.

  9. Enter the alias for the key pair: orchestra.

  10. Enter the new password for the key pair: ORCHESTRA.

  11. Save the keystore.

info

Because we have used the same passwords as those used in the Orchestra configuration, no changes need to be made there.