Ssl – obfuscating keystore password in JBoss 4.2.2 GA

application-serverconfigurationjbossssltomcat

I've setup my jboss app-server to use SSL. The relevant extract from my config is below. Everything is working ok, however some people have expressed concern over the keystorePass attribute being in plain text. Is there any way to obfuscate / encrypt this value?

I'm using JBoss 4.2.2.GA (on Red Hat Enterprise Edition, if that makes any difference)

<Connector port="8080" 
    protocol="HTTP/1.1" 
    SSLEnabled="true"
    maxThreads="150" 
    scheme="https" 
    secure="true"
    clientAuth="false" 
    sslProtocol="TLS"
    keystoreFile="/somewhere/some.keystore"
    keystorePass="somePassword"
    keyAlias="tomcat"/>

Edit, To get away from the security by obscurity approach, an alternative to obfuscating this would be to not supply it at all and have tomcat prompt for the p/w on startup. However as far as I know this isn't supported. Can anyone confirm or deny this?

Best Answer

It is possible according to this wiki entry by Anil Saldhana, Lead JBoss Security Architect for JBoss:

http://community.jboss.org/wiki/EncryptKeystorePasswordInTomcatConnector

I have not personally implemented this, but I would imagine Anil knows the subject pretty well.

Related Topic