I would like to implement HPKP in my applications. I have 2 spring boot application, the server runs on https://localhost:9999 and the client tries to reach the https://localhost:9999/test.
I would like to pin the public key.
I found this: https://docs.spring.io/spring-security/site/docs/4.2.x/reference/html/headers.html#headers-hpkp
I tried to find projects what implement HPKP but there are ZERO amount on the web. How do I need to change this code to make it work? Should I put it in the client or the server?
@EnableWebSecurity
public class WebSecurityConfig extends WebSecurityConfigurerAdapter {
@Override
protected void configure(HttpSecurity http) throws Exception {
http
.headers()
.httpPublicKeyPinning()
.includeSubdomains(true)
.reportUri("https://example.net/pkp-report")
.addSha256Pins("d6qzRu9zOECb90Uez27xWltNsj0e1Md7GkYYkVoZWmM=", "E9CZ9INDbd+2eRQozYqqbQ2yXLVKB9+xcprMF+44U1g=";
}
}
My client application have a truststore that stores a CA certificate. With this CA certificate I signed and created a SERVER certificate. I set this certificate like:
Server:
application.properties
server.ssl.enabled=true
server.ssl.client-auth=none
server.ssl.key-store=keystore/server.jks
server.ssl.key-store-password=changeit
@Configuration
@RequiredArgsConstructor
public class SSLConfig {
private final Environment env;
@PostConstruct
private void configureSSL() {
System.setProperty("javax.net.ssl.keyStore", env.getProperty("server.ssl.key-store"));
System.setProperty("javax.net.ssl.keyStorePassword", env.getProperty("server.ssl.key-store-password"));
}
}
My client application just do a GET call on https://localhost:9999/test.
Client:
application.properties
client.ssl.trust-store=keystores/mycustom.truststore
client.ssl.trust-store-password=changeit
@Configuration
@RequiredArgsConstructor
public class SSLConfig {
private final Environment env;
@PostConstruct
private void configureSSL() {
System.setProperty("javax.net.ssl.trustStore", env.getProperty("client.ssl.trust-store"));
System.setProperty("javax.net.ssl.trustStorePassword", env.getProperty("client.ssl.trust-store-password"));
}
}
The documentation says: the client stores this information for a given period of time. Is the spring doing it automatically or am I supposed to extract this data and save it at the first time, then every time when I get a response from server check if it equals? (this would take a LOT of time and what if I forget somewhere to verify?)
Thanks in advance.