Automic Workload Automation

Hi,

in AWA-Help 12.2 

https://docs.automic.com/documentation/webhelp/english/AWA/12.2/DOCU/12.2/AWA%20Guides/help.htm#_Common/Security/Security_Hardening_HTTPS_SSL.htm?Highlight=https

under Securing Access with HTTPS in subchapter Create a Keystore File for Your Tomcat Installation is written, that I should use SHA-256 instead of SHA-1: 

"….Warning! SHA-1 certificates are considered to be unsafe by modern browsers. Use SHA-256 instead"

"%JAVA_HOME%\bin\keytool" -genkey -alias tomcat -keyalg RSA -keystore tomcat-keystore.jks -storepass myTomcatKeystorePassword

Question 1:

- Which parameter  of the program keytool do I have to modify or add, that i use SHA-256? 

Question 2:

I have adopted the command "%JAVA_HOME%\bin\keytool" -genkey -alias tomcat -keyalg RSA -keystore tomcat-keystore.jks -storepass myTomcatKeystorePassword I only changed the Password and the Java path. After the creation of the file tomcat-keystore.jks I got following message in mein CLI: 

DE:

Der JKS-Keystore verwendet ein proprietäres Format. Es wird empfohlen, auf PKSC12 zu migrieren, das ein Industriestandardformat mit "keytool -importkeystore -srckeystore tomcat-keystore.jks -destkeystore tomcat-keystore.jks -deststoretype pkcs12" ist.

UK/US (my own translation)

The JKS-Keystore use a proprietary format. It is recommended to migrate to PKSC12, that is an default industrial format with "keytool -importkeystore -srckeystore tomcat-keystore.jks -destkeystore tomcat-keystore.jks -deststoretype pkcs12".

Has this message anything got to do with my first question (Q1: SHA-256 instead of SHA-1)?

- What is PKCS12?

- Are there any secrutiy reasons to switch over to PKCS12?

- How do I switch over to  pkcs12?

In the same page it's something written about PKSC12, but I should skip this because "...Skip this step if you are using the self-signed certificate created in the previous step.". I skipped it, because I use a self-signed certificate.

Question 3

Can I see afterwards if I use SHA-256 and PKSC12 (where can I verify it?)

Yours sincerely/Mit freundlichen Grüßen

Martin Zeise-Kaucic

Hi Martin,

the answer for your question 1 should be: add the following parameters right after -keyalg RSA:

-sigalg SHA256withRSA -keysize 2048

Answer for question 2: PKCS 12 is a file format. I do not know if there are security reasons for switching to PKCS #12.

Answer for question 3: You can validate the algorithm (e.g. SHA-256) in your browser and so the answer ist browser dependent. Here you can find more information: How to View SSL Certificate Details in Each Browser and What You Can Learn 

Greetings from Germany

Tim

Hi.

As Tim said, pkcs12 is a container format. There is no security reason to use one over the other when it comes to pkcs12, PEM, DER or even JKS. It's mostly a matter of what's required for a particular software to work with it, e.g. Tomcat only supports JKS (proprietary format only used by Java keystores), or the more open pkcs12.

One container format file can be converted into another container format, here's a page of helpful one-liners to do that.

Besides using the browser, which requires the certificate to be installed, you can also view certificte files directly in openssl. On any Linux box (or otherwise, a machine that has openssl installed):

openssl x509 -inform [DER|NET|PEM] -in <filename> -text

This will dump certificates to plain text. Use a recent openssl if able, older versions have certain display bugs, e.g. with Subject Alternate Names.

And yes, avoid sha1 at all cost. It's dead.

Best,

Carsten