1

There are several questions on stackoverflow regarding Akka, SSL and certificate management to enable secure (encrypted) peer to peer communication between Akka actors.

The Akka documentation on remoting points readers to this resource as an example of how to Generate X.509 Certificates.

Since the actors are running on internal servers, the Generation of a server CA for example.com (or really any DNS name) seems unrelated. Most servers (for example EC2 instances running on Amazon Web Services) will be run in a VPC and the initial Akka remotes will be private IP addresses like

remote = "akka.tcp://sampleActorSystem@172.16.0.10:2553"

My understanding, is that it should be possible to create a self signed certificate and generate a trust store that all peers share.

As more Akka nodes are brought online, they should (I assume) be able to use the same self signed certificate and trust store used by all other peers. I also assume, there is no need to trust all peers with an ever growing list of certificates, even if you don't have a CA, since the trust store would validate that certificate, and avoid man in the middle attacks.

The ideal solution, and hope - is that it possible to generate a single self signed certificate, without the CA steps, a single trust store file, and share it among any combination of Akka remotes / (both the client calling the remote and the remote, i.e. all peers)

There must be a simple to follow process to generate certificates for simple internal encryption and client authentication (just trust all peers the same)

Question: can these all be the same file on every peer since they are internal and private (no DNS)?

key-store = "/example/path/to/mykeystore.jks"
trust-store = "/example/path/to/mytruststore.jks"

Question: Are X.509 instructions linked above overkill - Is there a simple self signed / trust store approach without the CA steps? Specifically for internal IP addresses only (no DNS) and without an ever increasing web of IP addresses in a cert, since servers could autoscale up and down.

Since everything is internal & private, can we just do this:

#!/bin/bash

# create self signed certificate for use in Java SSL

export PW=`pwgen -Bs 10 1`
echo $PW > example-self-cert-password

# generate a key valid for 9999 days, or 27 years
# self signed certificate for encryption
keytool -genkeypair -alias example-self -keyalg RSA \
-keypass:env PW -storepass:env PW \
-keystore example-self-keystore.jks -validity 9999 \
-keysize 4096 \
-dname "CN=example-selfCA, OU=Cloud Services, O=example company, L=San Francisco, ST=m=California, C=US"

# Extract the certificate
keytool -export -keystore example-self-keystore.jks -alias example-self -file example-self.cer \
-keypass:env PW \
-storepass:env PW

# Importing into the truststore
keytool -import -alias example-self -file example-self.cer -keystore example-self-truststore.jks \
-storepass:env PW << EOF
yes
EOF

# optional
# list out to confirm
keytool -list -v \
  -keystore example-self-truststore.jks \
  -storepass:env PW

# optional
# if you want an openssl PEM file, convert it
openssl x509 -inform der -in example-self.cer -out example-self.pem
  • ..More specifically, can anybody fork this template, lightbend.com/activator/template/akka-sample-cluster-scala create a bash script to create a certificate, and get this to work locally with IP address, by updating the application.conf then starting with sbt run? – Jeff Steinmetz Dec 19 '16 at 8:46
  • also found this netty.ssl = ${akka.remote.netty.tcp} as well as switching the seed from akka.tcp to akka.ssl.tcp://ClusterSystem@127.0.0.1:2551 referenced in someones blog, and doesn't seem to be documented anywhere on the akka site. – Jeff Steinmetz Dec 20 '16 at 0:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.