CLCL

I was creating a presentation for the Denver/Boulder Cybersecurity meetup and I found myself, as usual, complaining.

I was decrying the state of Java and SSL, in particular, the lack of good tools and libraries for crypto stuff, when I decided to stop complaining and do something about it.  Sigh.  And so CLCL, the com ltsllc crypto library, was born.

CLCL is a collection of classes that I have taken from the Miranda project and put into their own library.  CLCL does actually do anything it just makes it easier to use classes that do all the crypto stuff.  Java and SSL have both been around for over 10 years.  It is about time they got some tools.

Who is Responsible for nio TLS?

And I thought netty was bad...

It doesn't hold a candle to nio TLS...

Consider this link. My god, you would need to be a TLS expert to use it!  And this is from Oracle...

Putting the reasons aside for the moment, it seems clear that

• nio TLS is non-trival to use
• There are very few libraries available

And this is after 10 years!

I am speechless.  Either developer are not using SSL/TLS with java, or I am missing something.

Excelsior!

I have finally gotten TLS to work.

With the example up on GitHub that you can get from:

https://github.com/ClarkHobbie/ssltest2

My SSL/TLS test works!

Admittedly, this is without netty but still.  If I can't get netty to work then at least I have that as a backup.

I will spend the rest of the day adapting my example to work with netty.

Wasting Away Again in TLSville

I spent (wasted) the day trying to get TLS working.

For the record, here are the commands for creating the keys:

openssl req -x509 -newkey rsa:2048 -keyout ca-key.pem.txt -out ca-certificate.pem.txt -days 365 -nodes
keytool -import -keystore truststore -file ca-certificate.pem.txt -alias ca  -storepass whatever
keytool –keystore serverkeystore –genkey –alias server -keyalg rsa -storepass whatever
keytool –keystore serverkeystore -storepass whatever –certreq –alias server  –file server.csr
openssl x509 -req -CA ca-certificate.pem.txt -CAkey ca-key.pem.txt -in server.csr -out server.cer -days 365 –CAcreateserial
keytool -import -keystore serverkeystore -storepass whatever -file ca-certificate.pem.txt -alias ca
keytool -import -keystore serverkeystore -storepass whatever -file server.cer -alias server

I have developed a simpler program that doesn't use netty.  For the interested, I have put it up on Github at

https://github.com/ClarkHobbie/ssltest2

SSL/TLS can have an overpowering lure to it, and cause me to waste time trying to fix it; hence the wasted day.  My posting to Stack Overflow has gotten neither votes nor help, leading me to believe that if anything is going to happen with this problem, I will have to do it.

All hail netty!

Miranda and Encryption

Why does Miranda want to use a certificate authority?  Why does Miranda use encryption at all?

Briefly, Miranda uses local certificate authorities to make it cheaper to use and easier to evaluate. Miranda uses encryption because events (messages) may contain things like personally identifiable information or other sensitive information.

The long answers are, well, longer.

First of all, if you don't have a requirement to encrypt things, then you can turn encryption off. Miranda was designed to be used on things like Amazon cloud, however, with traffic potentially going across the internet, so your events (messages) could be sent in the clear.  If you are comfortable with that arrangement, then you can simply turn off encryption.

Miranda uses local certificate authorities because all nodes in the cluster are required to have certificates.  It can quickly get expensive creating CERTs for every node in your cluster, not to mention inconvenient, with that approach.  Instead, you create your own certificate authority and use the local CA to sign all your node keys.

Miranda uses encryption because I found myself in situations where I wished that its predecessor, Prospero, did.  In particular, one of the obstacles to using Prospero in AWS was its lack of support for encryption.  Another problem was crossing availability zones.  If we had a node on the West coast, and another on the East coast, then they would probably talk across the internet.

As far as what to use, I thought SSL/TLS with their wide use, would be well supported, secure, cheap, and easy to use.  While they are indeed well supported, secure and inexpensive I have not found SSL/TLS to be at all easy to use.  I have run across a problem that has forced me to do all my development work "in the clear."  I refer to the dreaded "Invalid signature" problem that I posted on Stack Overflow about.

At any rate, that is why Miranda uses local certificate authorities and encryption in general.

All hail netty!

Stategic Withdraw

After two weeks of wrestling with Netty TLS I'm going to go onto something else.  The sad fact is that I cannot get TLS to work, and it's holding up progress.

The idea is to work with TLS turned off until I can get it to working.  I will work on TLS every day, I will just not let it block other tasks.

For the curious, the problem is that the server does not seem to get messages.  The client gets them, but they are gibberish.

Fun and Games with SSL and Netty

I had so much fun with SSL and netty that I will relay my solutions here.

This servers two purposes: firstly, anyone trying to do this can refer to my notes, and hopefully avoid the hours of frustration I endured, but mostly, this will serve as a reminder when I have to do this again.  Which, given my luck will be tomorrow.

Paths

You will need to setup your paths so that openssl and keytool can be executed directly.

openssl

This post assumes that you have openssl.  I use windows so I got mine from

https://slproweb.com/products/Win32OpenSSL.html

You can get openssl for different platforms form

https://wiki.openssl.org/index.php/Binaries

Credit Where Credit is Due

This post borrows heavily for the Oracle docs for creating and using a certificate authority.  You can find theses posts at:

https://docs.oracle.com/cd/E19509-01/820-3503/ggezy/index.html

A Note on Passwords

For this example I am using the string "whatever" as my password to all the key stores.  You can use something else but the examples all assume "whatever" is the password.

What I am Trying to Achieve

I am trying to have Miranda nodes communicate with SSL.  So all the Miranda nodes need certificates.  Rather than getting CERTs for all the nodes, I am going to create a new certificate authority, sign all the keys and then use that CA when I use SSL.  

Instructions

1. Create a New CA
2. Create a tust store
3. Create keys for each node
4. Create certificate signing requests for each key
5. Sign each request keys with the CA
6. Import the CA to each node's keystore
7. Import each CERT to the node's keystore

Create a New CA

I used the instructions on this link to create a new CA.  Briefly, here they are:

openssl req -new -x509 -keyout ca-key.pem.txt -out ca-certificate.pem.txt -days 365

I used "whatever" as the password and took the defaults for the key.

Alternate Procedure for Creating the CA

openssl genrsa -out ca-key 2048

openssl req -x509 -new -key ca-key -out ca-certificate -days 365

Create a Trust Store

After a bit of trial-and-error, I came up with this command:

keytool -import -keystore truststore -file ca-certificate.pem.txt -alias ca -keyalg rsa -storepass whatever

I entered "yes" to accept the key.

Create Keys for the Sever

Going back to the Oracle docs, I used the following:

keytool –keystore serverkeystore –genkey –alias server -keyalg rsa -storepass whatever

I took the defaults.

Create a Certificate Singing Request for Each Key

Once again, from the Oracle docs:

keytool –keystore serverkeystore -storepass whatever –certreq –alias server –keyalg rsa –file server.csr

Sign the Server Request with the CA

From the Oracle docs:

openssl x509 -req -CA ca-certificate.pem.txt -CAkey ca-key.pem.txt -in server.csr -out server.cer  -days 365 -CAcreateserial

Import the CA to the Server's Keystore

keytool -import -keystore serverkeystore -storepass whatever -file ca-certificate.pem.txt -alias ca -keyalg rsa

It asked me whether I trusted the key ("yes").

Import the CERT to the Server's Keystore

From the Oracle docs:

keytool -import -keystore serverkeystore -storepass whatever -file server.cer -alias server -keyalg rsa

At this point, you should have a key store called "severkeystore" that contains the server keys and the CA.  You should also have a key store called "truststore" that contains just the CA.  You are now ready to test it out (in my next post).