Configuring mutual auth TLS to secure Node - JavaSidecar communications

Edit online

Mutual authentication TLS must be configured using AT-TLS.

Note: Sites that have previously configured AT-TLS for a previous version of IZSME® will need to configure AT-TLS again, to enable mutual authentication TLS with version 1.1.8.
You can configure AT-TLS rules by customizing the following template and adding it to the environment’s TLS policy file. Using one keyring for all of the AT-TLS rules will simplify the task of setting up secure communications:
TTLSRule IUW_JAVA_AS_SRV
{
 LocalAddr 127.0.0.1
 LocalPortRangeRef IUW_PORT_JAVA
 Userid <server_owner_id>
 Direction Inbound
 Priority 4
 TTLSGroupActionRef gAct1~IUW
 TTLSEnvironmentActionRef eAct1~IUW_AS_SRV
 TTLSConnectionActionRef cAct1~IUW_AS_SRV
}
TTLSRule IUW_JAVA_AS_CLIENT
{
 RemoteAddr 127.0.0.1
 RemotePortRangeRef IUW_PORT_JAVA
 Userid <server_owner_id>
 Direction Outbound
 Priority 4
 TTLSGroupActionRef gAct1~IUW
 TTLSEnvironmentActionRef eAct1~IUW_AS_CLIENT
 TTLSConnectionActionRef cAct1~IUW_AS_CLIENT
}
PortRange IUW_PORT_JAVA
{
 Port <java_sidecar_port>
}
TTLSGroupAction gAct1~IUW
{
 TTLSEnabled On
 Trace 4
 GroupUserInstance 1
}
TTLSEnvironmentAction eAct1~IUW_AS_CLIENT
{
 HandshakeRole Client
 EnvironmentUserInstance 0
 TTLSEnvironmentAdvancedParmsRef eAdv1~IUW
 TTLSKeyringParmsRef keyring~IUW
 Trace 4
}
TTLSEnvironmentAction eAct1~IUW_AS_SRV
{
 HandshakeRole ServerWithClientAuth
 EnvironmentUserInstance 0
 TTLSEnvironmentAdvancedParmsRef eAdv1~IUW
 TTLSKeyringParmsRef keyring~IUW
 Trace 4
}
TTLSConnectionAction cAct1~IUW_AS_SRV
{
 TTLSCipherParmsRef cipher-IUW
 TTLSConnectionAdvancedParmsRef cAdv1~IUW
 CtraceClearText On
 Trace 4
}
TTLSConnectionAction cAct1~IUW_AS_CLIENT
{
 HandshakeRole Client
 TTLSCipherParmsRef cipher-IUW
 TTLSConnectionAdvancedParmsRef cAdv1~IUW
 CtraceClearText On
 Trace 4
}
TTLSConnectionAdvancedParms cAdv1~IUW
{
 ResetCipherTimer 0
 SecondaryMap Off
 CertificateLabel <cert_label>
}
TTLSKeyringParms keyring~IUW
{
 Keyring <server_owner_id>/<ring_name>
}
TTLSEnvironmentAdvancedParms eAdv1~IUW
{
 ClientAuthType Required
 CertValidationMode RFC5280
 ApplicationControlled Off
 SSLv2 Off
 SSLv3 Off
 TLSv1 Off
 TLSv1.1 Off
 TLSv1.2 On
}
TTLSCipherParms cipher-IUW
{
 V3CipherSuites TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
 V3CipherSuites TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA384
 V3CipherSuites TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
 V3CipherSuites TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA384
 V3CipherSuites TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
 V3CipherSuites TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
 V3CipherSuites TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
 V3CipherSuites TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
}