CODEWITHSUNDEEP
scalarestssllift
Ashkan Kh. Nazary
Ashkan Kh. Nazary

Reputation: 22324

SSL in a REST Lift project, where to start?

We are doing a project in Scala, using Lift to provide some REST style web services for clients (Java-script through AJAX). For some business reasons we decided to put it all under SSL but I'm am not sure where to start. Insights would be much appreciated.

Upvotes: 0

Views: 724

Answers (3)

thoredge
thoredge

Reputation: 12601

This depend on which application server you're running.

Upvotes: 1

Alex Cruise
Alex Cruise

Reputation: 7979

Whatever server software is currently handling HTTP traffic (e.g. Jetty, Nginx, Apache...) almost certainly has some means of adding SSL support and disabling plain HTTP; try that first.

As for the basic mechanism of adding SSL support, it goes something like this:

  1. Generate an RSA keypair (the key size should be at least 1024 bits). This step should prompt you to fill in some information about you, your organization, and the server's hostname ("common name" in X.509 parlance). It should also prompt you for a passphrase, which will be used to encrypt the private key.
  2. The keypair consists of a private key (this is the part you shouldn't share with anyone) and a self-signed certificate, which contains, along with other metadata, the public key.
  3. If you want to get a real cartel-signed SSL certificate, so that members of the general public won't see nasty warnings when they visit your site, you'll need to generate a Certificate Signing Request (CSR) from your keypair and submit that to an SSL certificate authority, who will create a certificate derived from your CSR, but signed with their private key. Luckily, in recent years, the SSL CA business has gotten extremely competitive, so pricing shouldn't be a major hurdle anymore.
  4. If you're not planning to get a real cartel-signed SSL certificate, you can use the private key and self-signed cert as-is.
  5. Either way, you need to tell your web server how to find the certificate (whether self-signed or CA-signed) and private key. Apache HTTPD prefers to keep the two things in separate files; most JVM servers prefer that they be encapsulated in a keystore. The best keystore format for general use is called PKCS#12, it's an industry standard. Making a PKCS#12 file out of a separate key and cert is a bit tricky, look on ServerFault if you can't figure it out. :)
  6. You usually want to put the private key passphrase in the server's configuration file, so make sure that configuration file (and the file containing the private key) have the most restrictive permissions that will still work.

Upvotes: 1

dave4420
dave4420

Reputation: 47052

You're not sure where to start with which bit? The SSL?

Set up stunnel (or similar) in front of your webapp, and firewall your webapp off so that only stunnel can access it. Then your clients can only access your webapp over SSL, via stunnel.

Upvotes: 0

Related Questions