The steps that were followed to generate certificates to be used to deploy the CMSO Spring Boot services in OOM with HTTPS enabled in Windriver Lab. This assumes you already have access to the Windriver Lab.

Updating the oof.onap Certificate in AAF 

...

The Application FQDN is the FQDN * oof.onap so we will add our Windriver lab VPN IP that to our /etc/hosts file as well

On Unix host, run ifconfig while connected to the VPN

These files will not be accessible by default when the script is done because it is going to a docker volume that is in the VOLUME attribute in aaf.props. For some reason, the script does not allow the VOLUME to be a local folder on your host so, the easiest thing to so is.... The docker volume will automatically be created, in the case below docker volume cert (volume can be any name) created with the local driver.

Image Added

WIth luck this will have generated all of the artifacts in the docker cert volume:

Image Added

Retrieving the artifacts from the docker volume

Note that when we retrieve the artifacts, the various passwords will be encrypted and can only be unencrypted by cadi. The cadi showpass command expects the artifacts to be in /opt/app/osaaf/local folder, so the following command can be used to put the files from the cert docker volume into your local /opt/app/osaaf/local folder.

Important note on the Mac, had to update the docker preferences to include /opt/app as a mountable folder.

Image Added

In essence the above runs a docker container (ubuntu) with the docker cert volume mounted and the local /opt/app/osaaf/local folder mounted as a different volume so we can copy the artifacts from the docker volume to our local host.

Retrieving the artifact passwords

The agent.sh can be used to decrypt  the passwords in the org.onap.oof.cred.props file.

There are several things to address. 

1. Copy the truststoreONAPall.jks to the agent.sh folder
2. Make sure the CADI jar agent.sh is in the local folder. You will get this error: For local use, you need to have 'aaf-cadi-aaf-2.1.12-SNAPSHOT-full.jar'
3. The AAF account you are using needs to have showpass privieges in AAF, so we added those privileges to the admin role in the namespace

For 1:

For 2: 

I had a local version that was different than the version in agent.sh so I copied the jar I had to the agent.sh folder and updated VERSION in aaf.props

For 3:

Image Added

So finally you can run

This will prompt for oof@oof.onap.org password which is the default demo123456!

Note that if you fat finger the password you get a goofy error 

org.onap.aaf.cadi.CadiException: org.onap.aaf.cadi.LocatorException: No Entries found for 'https://aaf-onap-test.osaaf.org:8095/locate/AAF_NS.cm:2.1'

which can send you on a wild goose chase. 

Image Added

Not sure why I bothered to obscure the passwords 

Using certificates with Spring Boot Application

1. Copy these 2 artifacts to a folder accessible to your application 
   1. truststoreONAPall.jks (for outgoing HTTPS requests)
   2. org.onap.<app>.jks (i.e. org.onap.oof.jks) (for incoming HTTPS requests)
2. Add the following to the JVM args
   1. -Dserver.ssl.key-store=<folder>/org.onap.oof.jks
   2. -Dserver.ssl.key-store-password=<cadi_keystore_password_jks>
   3. -Djavax.net.ssl.trustStore=<folder>/truststoreONAPall.jks