Orchestra TLS Truststore Configuration

Orchestra includes a truststore that stores public certificates of trusted Certification Authorities (CAs) and their associated certificate chains. All certificates issued by the CAs contained in the truststore will be successfully authenticated by Orchestra during the TLS handshake process.

The following basic parameters are preset inside orchestra_configuration.xml:

<configuration>

   <service name="MasterdataService" class="emds.epi.impl.baseservice.OrchestraBaseService">
      ...
   <group name="SSLSettings">
     <parameter name="PROTOCOL" value="TLS" /> 
     <parameter name="KEYSTORE" value="config/security/orchestra.keystore" /> 
     <parameter name="KEYSTORE.PASSWORD" value="000841454d455854414a00066d65646f626b000000105ef6774724235d102526ef03e131532f" /> 
     <parameter name="KEYSTORE.KEYPASSWORD" value="000841454d455854414a00066d65646f626b000000105ef6774724235d102526ef03e131532f" />
     <parameter name="TRUSTSTORE" value="config/security/orchestra.truststore" />
     <parameter name="TRUSTSTORE.PASSWORD" value="000841454d455854414a00066d65646f626b000000105ef6774724235d102526ef03e131532f" />
     <parameter name="TRUSTSTORE.TYPE" value="JKS" /> 
   </group>
   ...
   <service name="ServletEngine" class="emds.epi.impl.http.SimpleServletEngine">
      ...
      <parameter name="SSLPORT.USE.TRUSTSTORE" value="false" /> <!-- enable it here -->

The configuration for using the truststore is performed in the orchestra_configuration.xml file. The following parameters within the SSLSettings group can be set:

Parameter	Description
TRUSTSTORE	Location of the truststore. The file must be inside the classpath of Orchestra.
TRUSTSTORE.PASSWORD	Password for accessing the truststore, encrypted according to the "Orchestra Password Encryption" method.
TRUSTSTORE.TYPE	Type of the keystore used; possible values are "JKS" (Java Keystore) and "PKCS12" (PKCS12 format).

warning

The Truststore must be enabled in orchestra_configuration.xml!

Truststore usage is not enabled by default. You will need to set an additional parameter in orchestra_configuration.xml within the ServletEngine group:

Parameter	Description
SSLPORT.USE.TRUSTSTORE	true = use of truststore in SSL handshake is enforced when Orchestra acts as a server. false = all certificates will be considered as trusted.