There are several questions on stackoverflow regarding Akka, SSL and certificate management to enable secure (encrypted) peer to peer communication between Akka actors.
Since the actors are running on internal servers, the Generation of a server CA for
example.com (or really any DNS name) seems unrelated.
Most servers (for example EC2 instances running on Amazon Web Services) will be run in a VPC and the initial Akka remotes will be private IP addresses like
remote = "akka.tcp://sampleActorSystem@172.16.0.10:2553"
My understanding, is that it should be possible to create a self signed certificate and generate a trust store that all peers share.
As more Akka nodes are brought online, they should (I assume) be able to use the same self signed certificate and trust store used by all other peers. I also assume, there is no need to trust all peers with an ever growing list of certificates, even if you don't have a CA, since the trust store would validate that certificate, and avoid man in the middle attacks.
The ideal solution, and hope - is that it possible to generate a single self signed certificate, without the CA steps, a single trust store file, and share it among any combination of Akka remotes / (both the client calling the remote and the remote, i.e. all peers)
There must be a simple to follow process to generate certificates for simple internal encryption and client authentication (just trust all peers the same)
Question: can these all be the same file on every peer since they are internal and private (no DNS)?
key-store = "/example/path/to/mykeystore.jks" trust-store = "/example/path/to/mytruststore.jks"
Question: Are X.509 instructions linked above overkill - Is there a simple self signed / trust store approach without the CA steps? Specifically for internal IP addresses only (no DNS) and without an ever increasing web of IP addresses in a cert, since servers could autoscale up and down.
Since everything is internal & private, can we just do this:
#!/bin/bash # create self signed certificate for use in Java SSL export PW=`pwgen -Bs 10 1` echo $PW > example-self-cert-password # generate a key valid for 9999 days, or 27 years # self signed certificate for encryption keytool -genkeypair -alias example-self -keyalg RSA \ -keypass:env PW -storepass:env PW \ -keystore example-self-keystore.jks -validity 9999 \ -keysize 4096 \ -dname "CN=example-selfCA, OU=Cloud Services, O=example company, L=San Francisco, ST=m=California, C=US" # Extract the certificate keytool -export -keystore example-self-keystore.jks -alias example-self -file example-self.cer \ -keypass:env PW \ -storepass:env PW # Importing into the truststore keytool -import -alias example-self -file example-self.cer -keystore example-self-truststore.jks \ -storepass:env PW << EOF yes EOF # optional # list out to confirm keytool -list -v \ -keystore example-self-truststore.jks \ -storepass:env PW # optional # if you want an openssl PEM file, convert it openssl x509 -inform der -in example-self.cer -out example-self.pem