diff --git a/edexOsgi/build.edex/esb/conf/security/keystoreUtil.sh b/edexOsgi/build.edex/esb/conf/security/keystoreUtil.sh index 2e78a5c141..94f97c5260 100755 --- a/edexOsgi/build.edex/esb/conf/security/keystoreUtil.sh +++ b/edexOsgi/build.edex/esb/conf/security/keystoreUtil.sh @@ -14,6 +14,7 @@ truststore=truststore.jks keystorePw= keyPw= +cn= encryptionKey=encrypt truststorePw=password @@ -96,21 +97,36 @@ do fi done -cn=$(hostname) +while [ -z $cn ]; +do + echo -n "Enter canonical name/IP or blank for default [$(hostname)]: " + read cn + if [ -z $cn ]; + then + echo "Canonical Name defaulting to [$(hostname)];" + cn=$(hostname) + fi +done echo "Generating keystore..." -keytool -genkeypair -alias $keyAlias -keypass $keyPw -keystore $keystore -storepass $keystorePw -validity 360 -dname "CN=$cn, OU=AWIPS, O=Raytheon, L=Omaha, ST=NE, C=US" -keyalg RSA +# get rid of an existing key with same name +echo "Check to see if a key with this alias exists.....[$keyAlias]!" +keytool -delete -alias $keyAlias -keystore $securityDir/$keystore +# create and add key +keytool -genkeypair -alias $keyAlias -keypass $keyPw -keystore $keystore -storepass $keystorePw -validity 360 -dname "CN=$cn, OU=AWIPS, O=Raytheon, L=Silver Spring, ST=MD, C=US" -keyalg RSA echo -n "Exporting public key..." exportOutput=`keytool -exportcert -alias $keyAlias -keystore $keystore -file $keyAlias$publicKeyFile -storepass $keystorePw 2>&1` echo "Done!" obfuscatedKeystorePassword=`$JAVA_BIN -cp /awips2/edex/lib/dependencies/org.apache.commons.codec/commons-codec-1.4.jar:/awips2/edex/lib/plugins/com.raytheon.uf.common.security.jar com.raytheon.uf.common.security.encryption.AESEncryptor encrypt $encryptionKey $keystorePw 2>&1` echo "Generating trust store..." +echo "Check to see if a trusted CA with this alias exists.....[$keyAlias]!" +keytool -delete -alias $keyAlias -keystore $securityDir/$truststore keytool -genkey -alias tmp -keypass tempPass -dname CN=foo -keystore $truststore -storepass $truststorePw keytool -delete -alias tmp -keystore $truststore -storepass $truststorePw keytool -import -trustcacerts -file $keyAlias$publicKeyFile -alias $keyAlias -keystore $truststore -storepass $truststorePw -jettyObscuredPassword=`$JAVA_BIN -cp /awips2/edex/lib/dependencies/org.eclipse.jetty/jetty-http-7.6.14.v20131031.jar:/awips2/edex/lib/dependencies/org.eclipse.jetty/jetty-util-7.6.14.v20131031.jar org.eclipse.jetty.util.security.Password $keystorePw 2>&1 | grep OBF` +jettyObscuredPassword=`$JAVA_BIN -cp /awips2/edex/lib/dependencies/org.eclipse.jetty/jetty-http-8.1.15.v20140411.jar:/awips2/edex/lib/dependencies/org.eclipse.jetty/jetty-util-8.1.15.v20140411.jar org.eclipse.jetty.util.security.Password $keystorePw 2>&1 | grep OBF` obfuscatedTruststorePassword=`$JAVA_BIN -cp /awips2/edex/lib/dependencies/org.apache.commons.codec/commons-codec-1.4.jar:/awips2/edex/lib/plugins/com.raytheon.uf.common.security.jar com.raytheon.uf.common.security.encryption.AESEncryptor encrypt $encryptionKey $truststorePw 2>&1` @@ -167,6 +183,11 @@ do echo "Alias cannot be empty!" fi done + +# delete any existing cert in the truststore for this alias +echo "Check to see if a certificate with this alias exists.....[$userAlias]!" +keytool -delete -alias $userAlias -keystore $securityDir/$truststore +# add the cert as a Self Signed CA to truststore keytool -import -trustcacerts -file $keyfile -alias $userAlias -keystore $securityDir/$truststore } diff --git a/edexOsgi/com.raytheon.edex.plugin.goessounding/res/spring/goessounding-common.xml b/edexOsgi/com.raytheon.edex.plugin.goessounding/res/spring/goessounding-common.xml index fa8c2fb014..2a4df3374b 100644 --- a/edexOsgi/com.raytheon.edex.plugin.goessounding/res/spring/goessounding-common.xml +++ b/edexOsgi/com.raytheon.edex.plugin.goessounding/res/spring/goessounding-common.xml @@ -13,7 +13,7 @@ - + diff --git a/edexOsgi/com.raytheon.uf.edex.registry.ebxml/resources/com.raytheon.uf.edex.registry.ebxml.properties b/edexOsgi/com.raytheon.uf.edex.registry.ebxml/resources/com.raytheon.uf.edex.registry.ebxml.properties index bc7bef32c2..b0bb51534a 100644 --- a/edexOsgi/com.raytheon.uf.edex.registry.ebxml/resources/com.raytheon.uf.edex.registry.ebxml.properties +++ b/edexOsgi/com.raytheon.uf.edex.registry.ebxml/resources/com.raytheon.uf.edex.registry.ebxml.properties @@ -9,11 +9,15 @@ ebxml-federation-sync-threads=3 ebxml-email.enabled=false # The maximum number of events that will be batched and send # in a registry replication notification -ebxml-notification-batch-size=200 +ebxml-notification-batch-size=50 # The maximum number of threads that the ebxml registry will use for processing web requests -# This number must be >=5. As a general rule, the maximum number of connections should be: -# 5+{registries this registry is replicating to/from}=max-threads -ebxml-webserver-max-threads=8 +# There is a bug in Jetty 8.1.15 that causes this to throw SSL_NOT_HANDSHAKE exceptions constantly +# This effectively freezes the webservices portion of the registry app if you do not give it enough connections. +# A suggestions from the Jetty community was to set this param using the following math. +# This number must be > number of CPU cores. As a general rule, the maximum number of connections should be: +# CPU's+{registries this registry is replicating to/from}=max-threads +# 20 is a pretty good starting point for a default. +ebxml-webserver-max-threads=20 # EBXML thrift service port ebxml.thrift.service.port=9588 # EBXML webserver port