Skip to main content

Enable TLS

As a best practice, it is recommended that you configure the Authenticator with HTTPS. This will help prevent the Corsha Cred from being intercepted.

The Authenticator hosts two services, a RESTful service for fetching a Corsha Cred and a proxy service that injects a Corsha Cred into HTTP requests.

Each service can be configured with server certificates independently.

Configure the Authenticator Service​

In the config.yaml file for the Authenticator, there are two options for the server key pair authenticator.tlsServerCertFile and authenticator.tlsServerKeyFile:

authenticator:
  tlsServerCertFile: "/opt/corsha/ssl/server.crt"
  tlsServerKeyFile: "/opt/corsha/ssl/server.key"

These files must be made available to the Authenticator process. With Docker, you will need to mount these files as a volume.

For example, if we update the docker-compose.yaml file from our Docker how-to. We add the volume mount to the services.authenticator.volumes array.

version: "3.9"
services:
    authenticator:
        image: corsha-docker.jfrog.io/corsha-authenticator:<latest version>
        ports:
            - "127.0.0.1:8082:8082"
            - "127.0.0.1:8083:8083"
        volumes:
            - ./authenticator/config:/config
            - ./authenticator/data:/opt/corsha/authenticator

            # We've added this volume to mount the server key material:
            - ./authenticator/ssl:/opt/corsha/ssl
        command: --config=/config/config.yaml
        environment:
            - AUTHENTICATOR_SECRET=<fill in>

Configure the Authenticator's Proxy Service​

The server certificate for the Authenticator's Proxy Service is just as easy to configure. There is one caveat. The server cert will need to be valid for all hostnames served by the proxy. The samples below demonstrate configuring an Authenticator serving one or more clients with TLS.

Serving a Single Client​

For configurations with single proxy configured, once you have a server key pair, you simply need to configure the tlsServerCertFile and tlsServerKeyFile values in config.yaml file. In this example, the subject of the server cert will be api.example.com:

listen: "0.0.0.0:8080"
proxies:
    exampleAPI:
        host: "api.example.com"
        upstreamURL: "http://api.some-service.com/"

tlsServerCertFile: "/opt/corsha/proxy/ssl/server.crt"
tlsServerKeyFile: "/opt/corsha/proxy/ssl/server.key"
Serving Multiple Clients​

For configurations with multiple proxies configured, the subject will need to be a wildcard certificate. In this example, the subject of the server cert will need to be *.example.com:

listen: "0.0.0.0:8080"
proxies:
    exampleAPI:
        host: "api.example.com"
        upstreamURL: "http://api.some-service.com/"
    exampleWeb:
        host: "www.example.com"
        upstreamURL: "http://www.some-service.com/"

tlsServerCertFile: "/opt/corsha/proxy/ssl/server.crt"
tlsServerKeyFile: "/opt/corsha/proxy/ssl/server.key"
Example docker-compose.yaml​

Just as before, if you're using the Docker container, you will need to provide the key material as a volume. See below for the docker-compose.yaml example.

version: "3.9"
services:
    authenticator:
        image: corsha-docker.jfrog.io/corsha-authenticator:<latest version>
        ports:
            - "127.0.0.1:8082:8082"
            - "127.0.0.1:8083:8083"
        volumes:
            - ./authenticator/config:/config
            - ./authenticator/data:/opt/corsha/authenticator
            - ./authenticator/ssl:/opt/corsha/ssl

            # We have a separate volume for the proxy service
            - ./authenticator/proxy/ssl:/opt/corsha/proxy/ssl
        command: --config=/config/config.yaml
        environment:
            - AUTHENTICATOR_SECRET=<fill in>