KeyManager
The configuration of a Java Secure Socket Extension KeyManager to manage private keys for IG. The configuration references the keystore that holds the keys.
When IG acts as a server, it uses a KeyManager to prove its identity to the client. When IG acts as a client, it uses a KeyManager to prove its identity to the server.
Usage
{
"name": string,
"type": "KeyManager",
"config": {
"keystore": KeyStore reference,
"passwordSecretId": configuration expression<secret-id>,
"alg": configuration expression<string>,
"secretsProvider": SecretsProvider reference
}
}Properties
"keystore": KeyStore reference, requiredThe KeyStore that references the store for key certificates. When
keystoreis used in a KeyManager, it queries for private keys; whenkeystoreis used in a TrustManager, it queries for certificates.Provide either the name of the KeyStore object defined in the heap, or an inline KeyStore configuration object.
In web container mode, when ClientHandler or ReverseProxyHandler use
keystore, the keystore can be different to that used by the web container.See also "KeyStore".
"passwordSecretId": configuration expression<secret-id>, requiredThe secret ID of the password required to read private keys from the KeyStore.
For information about supported formats for
secret-id, see secret-id."alg"configuration expression<string>, optionalThe certificate algorithm to use.
Default: the default for the platform, such as
SunX509.See also "Expressions".
"secretsProvider": SecretsProvider reference, optionalThe SecretsProvider to query for the keystore password. For more information, see "SecretsProvider".
Default: The route's default secret service. For more information, see "Default Secrets Object".
Example
The following example configures a KeyManager that depends on a KeyStore configuration. The KeyStore takes a password that you supply as a Java system property when you start IG, for example -Dkeypass=password. The configuration uses the default certificate algorithm:
{
"name": "MyKeyManager",
"type": "KeyManager",
"config": {
"keystore": {
"type": "KeyStore",
"config": {
"url": "file://${env['HOME']}/keystore.jks",
"passwordSecretId": "keymanager.keystore.secret.id",
"secretsProvider": "SystemAndEnvSecretStore"
}
},
"passwordSecretId": "keymanager.secret.id",
"secretsProvider": "SystemAndEnvSecretStore"
}
}