Self-Signed CA Connector

The Self-Signed CA Connector generates its own self-signed certificate and is suitable for testing the OneTimeCryptoWorker without requiring a real CA.

To configure the Self-Signed CA Connector and set up a crypto worker referencing the source crypto worker, do the following:

1. Add a new worker using the template onetime-crypto.properties. See OneTimeCryptoWorker properties for details.

   Property	Value
   NAME	Update as appropriate, for example P11 or P12 and possibly slot.
   CACONNECTOR_IMPLEMENTATION	org.signserver.module.onetime.caconnector.SelfSignedCAConnector
   CERTSIGNATUREALGORITHM	SHA256WithRSA

   Example Configuration Sample
   The following shows a sample configuration onetime-crypto.properties for a crypto worker CryptoTokenP11OneTimeSelfSigned:

   Sample Configuration

   WORKERGENID1.TYPE=CRYPTO_WORKER

   WORKERGENID1.IMPLEMENTATION_CLASS=org.signserver.module.onetime.cryptoworker.OneTimeCryptoWorker

   # Name for other workers to reference this worker:

   WORKERGENID1.NAME=CryptoTokenP11OneTimeSelfSigned

   # References a source CryptoToken

   WORKERGENID1.CRYPTOTOKEN=CryptoTokenP11

   # Key generation

   WORKERGENID1.KEYALG=RSA

   WORKERGENID1.KEYSPEC=2048

   # CA Connector: Self-signed demo connector (not using a real CA)

   WORKERGENID1.CACONNECTOR_IMPLEMENTATION=org.signserver.module.onetime.caconnector.SelfSignedCAConnector

    

   # CSR & Certificate Signing

   WORKERGENID1.CERTSIGNATUREALGORITHM=SHA256WithRSA

2. Check that the status of the worker is ACTIVE, either on the SignServer Admin Web Worker Status page, or in the CLI using the command: ./bin/signserver getstatus brief.

EJBCA WS CA Connector

The EJBCA WS CA Connector connects to EJBCA using Web Services.

To configure the EJBCA WS CA Connector and set up a crypto worker referencing the source crypto worker, do the following:

1. Add a new worker using the template onetime-crypto.properties and make the following changes. See OneTimeCryptoWorker properties for details.

   Property	Value
   NAME	Update as appropriate, for example P11 or P12 and possibly slot.
   CACONNECTOR_IMPLEMENTATION	Enable the following by removing the comments for the EjbcaWSCAConnector properties: CACONNECTOR_IMPLEMENTATION=org.signserver.module.onetime.caconnector.EjbcaWSCAConnector TRUSTSTORETYPE TRUSTSTOREPATH or TRUSTSTOREVALUE (depending on TRUSTSTORETYPE) TRUSTSTOREPASSWORD TLSCLIENTKEY EJBCAWSURL CANAME ENDENTITYPROFILE CERTIFICATEPROFILE USERNAME_PATTERN SUBJECTDN_PATTERN SUBJECTALTNAME_PATTERN CERTIFICATESTARTTIME CERTIFICATEENDTIME
   CERTSIGNATUREALGORITHM	SHA256WithRSA

   Example Configuration Sample
   

   The following shows a sample configuration onetime-crypto.properties for a crypto worker CryptoTokenP11OneTimeEjbcaWS:

   Sample CryptoTokenP11OneTimeEjbcaWS Configuration

   WORKERGENID1.TYPE=CRYPTO_WORKER

    

   WORKERGENID1.IMPLEMENTATION_CLASS=org.signserver.module.onetime.cryptoworker.OneTimeCryptoWorker

    

   # Name for other workers to reference this worker:

   WORKERGENID1.NAME=CryptoTokenP11OneTimeEjbcaWS

    

   # References a source CryptoToken

   WORKERGENID1.CRYPTOTOKEN=CryptoTokenP11

    

   # Key generation

   WORKERGENID1.KEYALG=RSA

   WORKERGENID1.KEYSPEC=2048

    

   # CA Connector: EjbcaWS (using EJBCA through Web Services)

   WORKERGENID1.CACONNECTOR_IMPLEMENTATION=org.signserver.module.onetime.caconnector.EjbcaWSCAConnector

   WORKERGENID1.TRUSTSTORETYPE=JKS

    

   # To trust the TLS certificate of the CA the trust store properties must be configured and contain the issuer (i.e. CA) certificate that issued the TLS server certificate used when connecting to the CA

   WORKERGENID1.TRUSTSTOREPATH=/opt/jboss-eap-6.4-ca/standalone/configuration/keystore/truststore.jks

   WORKERGENID1.TRUSTSTOREPASSWORD=changeit

    

   WORKERGENID1.TLSCLIENTKEY=tls_key

   WORKERGENID1.EJBCAWSURL=https://localhost:9443/ejbca

   WORKERGENID1.ENDENTITYPROFILE=EMPTY

   WORKERGENID1.CERTIFICATEPROFILE=ENDUSER

   WORKERGENID1.USERNAME_PATTERN=onetime-${transactionId}

   WORKERGENID1.SUBJECTDN_PATTERN=CN=User ${username},UID=${transactionId},O=SignServer Testing,C=SE

    

   # CSR & Certificate Signing

   WORKERGENID1.CERTSIGNATUREALGORITHM=SHA256WithRSA

2. To trust the TLS certificate of the CA, the truststore properties must be configured and contain the issuer (i.e. CA) certificate that issued the TLS server certificate used when connecting to the CA. In some cases you can just point out the path to the truststore.jks from the application server where EJBCA is running.

3. Create a TLS client key (tls_key).

4. Generate a Certificate Signing Request (CSR) for the TLS key created in the step above, get the certificate for the CSR, and install the certificate for the key in the token.

5. Provide Administrator access for the TLS Client certificate under the EJBCA CA Administration section, to enable the TLS client to access the CA resource (Web Service).

6. Check that the status of the worker is ACTIVE, either on the SignServer Admin Web Worker Status page, or in the CLI using using the command: ./bin/signserver getstatus brief.

Test Signing with SignClient

To test signing using the SignServer CLI SignClient, run the following:

Note that a new certificate with a new key is used every time.

Signature Verification

• To verify the CMS Signature through OpenSSL, run the following:

  openssl cms -verify -in output.p7s -inform DER -content input.txt -CAfile cacert.pem > /dev/null

• To verify the code signature with jarsigner, run the following:

  jarsigner -verify -strict HelloJar_Signed.jar -certs

Performance Test using Stresstest Tool

To run a performance test using the stresstest tool, run the following:

For more information on using the stresstest tool, see Stresstest CLI.