Benoit Schweblin benweet

Client-side SSL

For excessively paranoid client authentication.

openssl x509 -in server.crt -out server.der -outform DER
openssl x509 -in server.der -inform DER -out server.pem -outform PEM

This is an unsupported scenario, see rancher/rancher#14731 when there is an official solution.

When cattle-cluster-agent and/or cattle-node-agent are accidentally deleted, or when server-url/cacerts are changed.

Generate API token in the UI (user -> API & Keys) and save the Bearer token
Find the clusterid in the Rancher UI (format is c-xxxxx), its in the address bar when the cluster is selected

java -jar -Djavax.net.debug=ssl:handshake:verbose app.jar --server.port=8443 --server.security.require-ssl=true --server.ssl.key-store=/path/to/keystore --server.ssl.key-store-password=password --server.ssl.protocol=TLS

	<!-- MIT License -->
	<html>
	<head>
	<script>
	function generateKey(alg, scope) {
	return new Promise(function(resolve) {
	var genkey = crypto.subtle.generateKey(alg, true, scope)
	genkey.then(function (pair) {
	resolve(pair)
	})

	package demo;

	import static java.lang.reflect.Modifier.*;

	import java.util.Arrays;
	import java.util.Set;

	import org.springframework.beans.BeansException;
	import org.springframework.beans.factory.annotation.Value;
	import org.springframework.beans.factory.config.BeanExpressionResolver;

	package at.favre.lib.bytes.otherPackage;

	import org.junit.Test;

	import javax.crypto.Cipher;
	import javax.crypto.SecretKey;
	import javax.crypto.spec.GCMParameterSpec;
	import javax.crypto.spec.SecretKeySpec;
	import java.nio.ByteBuffer;
	import java.nio.charset.StandardCharsets;