CODEWITHSUNDEEP
sslhttpscloud-foundryca
ichbinblau
ichbinblau

Reputation: 4809

How to keep the SSL server certificate for verification in Cloud Foundry/Heroku?

I am developing an app to run in Cloud Foundry.

The problem is that I have to re-upload the app to Cloud Foundry once the public key of the SSL cert changes.

Here are some possible solutions:

  1. Register a host name in DNS. In that case, the certificate is only bound to host name. (Might not be possible cos of the budget. )
  2. Create a private CA and issue certificates from the CA, then install the CA as the trusted CA on the client. It is feasible and a common way for internal services. However, what if the app is pushed to the CF? How can we configure the node for the certs?
  3. Disable the SSL server authentication. Not sure whether it would put the app at risk if the authentication is skipped. For the time being, the app pulls data from the web service.
  4. I've been thinking of keeping the public key in the database. In that case, I don't need to re-upload the app to make it take effect. But I am not sure whether it is a safe way.

Question

I am seeking for a common and safe way to keep the SSL server cert in a Cloud Foundry env. Are any of the above solutions viable? If not, is there any other CF preferred ways?

Thank you

Upvotes: 0

Views: 623

Answers (1)

claudius
claudius

Reputation: 131

This is a bit old, but in case this helps...

Did you try to generate your server SSL certificate with whatever hostname (even "localhost"). As you are uploading this certificate in your application (i.e. to "blindly" trust it), I think that it could work and this would avoid dependencies with your IP address.

Upvotes: 0

Related Questions