RollSite: Configuring Secure Communications

Copying Certificates

Users please copy CA certificate, private key and public key to a certain dir. We recommend users put their certificates into a folder.

Modifying eggroll.properties

The following items are required to be added or modified in eggroll.properties:

# suppose your certs in /path/to/certs
# certificates in pem format
eggroll.rollsite.secure.port=9371
eggroll.core.security.client.ca.crt.path=/path/to/certs/ca.crt
eggroll.core.security.client.crt.path=/path/to/certs/public.crt
eggroll.core.security.client.key.path=/path/to/certs/private.key

Modifying route table

Users need to modify their route table when they need to use secure connection. Default setting is not using secure connection.

e.g.:

# suppose your default gateway is at `exchange.com:9371`, secure connection
# 10001 at `10001.com:9371`, secure connection,
# 10002 at `10002.com:9370, non-secure connection
"default":
{
  "default":[
    {
      "is_secure": true,           # this is the new setting
      "ip": "exchange.com",
      "port": 9371
    }
  ]
},
"10001":
{
  "default":[
    {
      "is_secure": true,           # this is the new setting
      "ip": "10001.com",
      "port": 9371
    }
  ]
},
"10002":
{
  "default":[
    {
      "ip": "10002.com",        # no need to set `"is_secure": true` here. you may explicit sets `"is_secure": false` or omit it.
      "port": 9370
    }
  ]
}

Restart RollSite

Once all setups are ready, please restart RollSite to activate the new secure port. You should be able to see the following log in rollsite.jvm.log if secure port (say 9371) are set:

secure server started at 9371