Skip to content

Commit a9e9696

Browse files
v-dirichardsv-dirichards
authored
Merge pull request #271256 from GennadNY/gennadyk9076
Gennadyk9076
2 parents fb65b64 + 56189d6 commit a9e9696

File tree

3 files changed

+129
-97
lines changed

3 files changed

+129
-97
lines changed

‎articles/postgresql/TOC.yml

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -321,6 +321,8 @@
321321
items:
322322
- name: Encrypted connectivity using TLS/SSL
323323
href: flexible-server/how-to-connect-tls-ssl.md
324+
- name: Update application client SSL/TLS certificates
325+
href: flexible-server/how-to-update-client-certificates-java.md
324326
- name: Private access with virtual network integration
325327
items:
326328
- name: Azure portal

‎articles/postgresql/flexible-server/concepts-networking-ssl-tls.md

Lines changed: 7 additions & 97 deletions
Original file line numberDiff line numberDiff line change
@@ -101,110 +101,18 @@ For more on SSL\TLS configuration on the client, see [PostgreSQL documentation](
101101
> * For connectivity to servers deployed to Azure government cloud regions (US Gov Virginia, US Gov Texas, US Gov Arizona): [DigiCert Global Root G2](https://www.digicert.com/kb/digicert-root-certificates.htm) and [Microsoft RSA Root Certificate Authority 2017](https://www.microsoft.com/pkiops/docs/repository.htm) root CA certificates, as services are migrating from Digicert to Microsoft CA.
102102
> * For connectivity to servers deployed to Azure public cloud regions worldwide : [Digicert Global Root CA](https://www.digicert.com/kb/digicert-root-certificates.htm) and [Microsoft RSA Root Certificate Authority 2017](https://www.microsoft.com/pkiops/docs/repository.htm), as services are migrating from Digicert to Microsoft CA.
103103
104-
### Importing Root CA Certificates in Java Key Store on the client for certificate pinning scenarios
104+
### Downloading Root CA certificates and updating application clients in certificate pinning scenarios
105105

106-
Custom-written Java applications use a default keystore, called *cacerts*, which contains trusted certificate authority (CA) certificates. It's also often known as Java trust store. A certificates file named *cacerts* resides in the security properties directory, java.home\lib\security, where java.home is the runtime environment directory (the jre directory in the SDK or the top-level directory of the Java™ 2 Runtime Environment).
107-
You can use following directions to update client root CA certificates for client certificate pinning scenarios with PostgreSQL Flexible Server:
108-
1. Make a backup copy of your custom keystore.
109-
2. Download following certificates:
106+
To update client applications in certificate pinning scenarios you can download certificates from following URIs:
110107
* For connectivity to servers deployed to Azure Government cloud regions (US Gov Virginia, US Gov Texas, US Gov Arizona) download Microsoft RSA Root Certificate Authority 2017 and DigiCert Global Root G2 certificates from following URIs:
111108
Microsoft RSA Root Certificate Authority 2017 https://www.microsoft.com/pkiops/certs/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crt,
112109
DigiCert Global Root G2 https://cacerts.digicert.com/DigiCertGlobalRootG2.crt.pem.
113110
* For connectivity to servers deployed in Azure public regions worldwide download Microsoft RSA Root Certificate Authority 2017 and DigiCert Global Root CA certificates from following URIs:
114111
Microsoft RSA Root Certificate Authority 2017 https://www.microsoft.com/pkiops/certs/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crt, Digicert Global Root CA https://cacerts.digicert.com/DigiCertGlobalRootCA.crt
115-
3. Optionally, to prevent future disruption, it's also recommended to add the following roots to the trusted store:
112+
* Optionally, to prevent future disruption, it's also recommended to add the following roots to the trusted store:
116113
Microsoft ECC Root Certificate Authority 2017 - https://www.microsoft.com/pkiops/certs/Microsoft%20ECC%20Root%20Certificate%20Authority%202017.crt
117-
4. Generate a combined CA certificate store with both Root CA certificates are included. Example below shows using DefaultJavaSSLFactory for PostgreSQL JDBC users.
118114

119-
* For connectivity to servers deployed to Azure Government cloud regions (US Gov Virginia, US Gov Texas, US Gov Arizona)
120-
```powershell
121-
122-
123-
keytool -importcert -alias PostgreSQLServerCACert -file D:\ DigiCertGlobalRootG2.crt.pem -keystore truststore -storepass password -noprompt
124-
125-
keytool -importcert -alias PostgreSQLServerCACert2 -file "D:\ Microsoft ECC Root Certificate Authority 2017.crt.pem" -keystore truststore -storepass password -noprompt
126-
```
127-
* For connectivity to servers deployed in Azure public regions worldwide
128-
```powershell
129-
130-
keytool -importcert -alias PostgreSQLServerCACert -file D:\ DigiCertGlobalRootCA.crt.pem -keystore truststore -storepass password -noprompt
131-
132-
keytool -importcert -alias PostgreSQLServerCACert2 -file "D:\ Microsoft ECC Root Certificate Authority 2017.crt.pem" -keystore truststore -storepass password -noprompt
133-
```
134-
135-
5. Replace the original keystore file with the new generated one:
136-
137-
```java
138-
System.setProperty("javax.net.ssl.trustStore","path_to_truststore_file");
139-
System.setProperty("javax.net.ssl.trustStorePassword","password");
140-
```
141-
6. Replace the original root CA pem file with the combined root CA file and restart your application/client.
142-
143-
For more information on configuring client certificates with PostgreSQL JDBC driver, see this [documentation](https://jdbc.postgresql.org/documentation/ssl/)
144-
145-
> [!NOTE]
146-
> Azure Database for PostgreSQL - Flexible server doesn't support [certificate based authentication](https://www.postgresql.org/docs/current/auth-cert.html) at this time.
147-
148-
### Get list of trusted certificates in Java Key Store
149-
150-
As stated above, Java, by default, stores the trusted certificates in a special file named *cacerts* that is located inside Java installation folder on the client.
151-
Example below first reads *cacerts* and loads it into *KeyStore* object:
152-
```java
153-
private KeyStore loadKeyStore() {
154-
String relativeCacertsPath = "/lib/security/cacerts".replace("/", File.separator);
155-
String filename = System.getProperty("java.home") + relativeCacertsPath;
156-
FileInputStream is = new FileInputStream(filename);
157-
KeyStore keystore = KeyStore.getInstance(KeyStore.getDefaultType());
158-
String password = "changeit";
159-
keystore.load(is, password.toCharArray());
160-
161-
return keystore;
162-
}
163-
```
164-
The default password for *cacerts* is *changeit* , but should be different on real client, as administrators recommend changing password immediately after Java installation.
165-
Once we loaded KeyStore object, we can use the *PKIXParameters* class to read certificates present.
166-
```java
167-
public void whenLoadingCacertsKeyStore_thenCertificatesArePresent() {
168-
KeyStore keyStore = loadKeyStore();
169-
PKIXParameters params = new PKIXParameters(keyStore);
170-
Set<TrustAnchor> trustAnchors = params.getTrustAnchors();
171-
List<Certificate> certificates = trustAnchors.stream()
172-
.map(TrustAnchor::getTrustedCert)
173-
.collect(Collectors.toList());
174-
175-
assertFalse(certificates.isEmpty());
176-
}
177-
```
178-
### Updating Root CA certificates when using clients in Azure App Services with Azure Database for PostgreSQL - Flexible Server for certificate pinning scenarios
179-
180-
For Azure App services, connecting to Azure Database for PostgreSQL, we can have two possible scenarios on updating client certificates and it depends on how on you're using SSL with your application deployed to Azure App Services.
181-
182-
* Usually new certificates are added to App Service at platform level prior to changes in Azure Database for PostgreSQL - Flexible Server. If you are using the SSL certificates included on App Service platform in your application, then no action is needed. Consult following [Azure App Service documentation](../../app-service/configure-ssl-certificate.md) for more information.
183-
* If you're explicitly including the path to SSL cert file in your code, then you would need to download the new cert and update the code to use the new cert. A good example of this scenario is when you use custom containers in App Service as shared in the [App Service documentation](../../app-service/tutorial-multi-container-app.md#configure-database-variables-in-wordpress)
184-
185-
### Updating Root CA certificates when using clients in Azure Kubernetes Service (AKS) with Azure Database for PostgreSQL - Flexible Server for certificate pinning scenarios
186-
187-
If you're trying to connect to the Azure Database for PostgreSQL using applications hosted in Azure Kubernetes Services (AKS) and pinning certificates, it's similar to access from a dedicated customers host environment. Refer to the steps [here](../../aks/ingress-tls.md).
188-
189-
### Updating Root CA certificates for For .NET (Npgsql) users on Windows with Azure Database for PostgreSQL - Flexible Server for certificate pinning scenarios
190-
191-
For .NET (Npgsql) users on Windows, connecting to Azure Database for PostgreSQL - Flexible Servers deployed in Azure Government cloud regions (US Gov Virginia, US Gov Texas, US Gov Arizona) make sure **both** Microsoft RSA Root Certificate Authority 2017 and DigiCert Global Root G2 both exist in Windows Certificate Store, Trusted Root Certification Authorities. If any certificates don't exist, import the missing certificate.
192-
193-
For .NET (Npgsql) users on Windows, connecting to Azure Database for PostgreSQL - Flexible Servers deployed in Azure pubiic regions worldwide make sure **both** Microsoft RSA Root Certificate Authority 2017 and DigiCert Global Root CA **both** exist in Windows Certificate Store, Trusted Root Certification Authorities. If any certificates don't exist, import the missing certificate.
194-
195-
196-
197-
### Updating Root CA certificates for other clients for certificate pinning scenarios
198-
199-
For other PostgreSQL client users, you can merge two CA certificate files like this format below:
200-
201-
202-
-----BEGIN CERTIFICATE-----
203-
(Root CA1: DigiCertGlobalRootCA.crt.pem)
204-
-----END CERTIFICATE-----
205-
-----BEGIN CERTIFICATE-----
206-
(Root CA2: Microsoft ECC Root Certificate Authority 2017.crt.pem)
207-
-----END CERTIFICATE-----
115+
Detailed information on updating client applications certificate stores with new Root CA certificates has been documented in this [tutorial](../flexible-server/how-to-update-client-certificates-java.md).
208116

209117
### Read Replicas with certificate pinning scenarios
210118

@@ -213,8 +121,10 @@ Therefore, for clients that use **verify-ca** and **verify-full** sslmode config
213121
* For connectivity to servers deployed to Azure Government cloud regions (US Gov Virginia, US Gov Texas, US Gov Arizona): [DigiCert Global Root G2](https://www.digicert.com/kb/digicert-root-certificates.htm) and [Microsoft RSA Root Certificate Authority 2017](https://www.microsoft.com/pkiops/docs/repository.htm) root CA certificates, as services are migrating from Digicert to Microsoft CA.
214122
* For connectivity to servers deployed to Azure public cloud regions worldwide: [Digicert Global Root CA](https://www.digicert.com/kb/digicert-root-certificates.htm) and [Microsoft RSA Root Certificate Authority 2017](https://www.microsoft.com/pkiops/docs/repository.htm), as services are migrating from Digicert to Microsoft CA.
215123

124+
> [!NOTE]
125+
> Azure Database for PostgreSQL - Flexible server doesn't support [certificate based authentication](https://www.postgresql.org/docs/current/auth-cert.html) at this time.
216126
217-
## Testing SSL\TLS Connectivity
127+
## Testing SSL/TLS Connectivity
218128

219129
Before trying to access your SSL enabled server from client application, make sure you can get to it via psql. You should see output similar to the following if you established an SSL connection.
220130

‎articles/postgresql/flexible-server/how-to-update-client-certificates-java.md

Lines changed: 120 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,120 @@
1+
---
2+
title: Updating Client SSL/TLS Certificates for Java
3+
description: Learn about updating Java clients with Flexible Server using SSL and TLS.
4+
author: GennadNY
5+
ms.author: gennadyk
6+
ms.date: 04/04/2024
7+
ms.service: postgresql
8+
ms.subservice: flexible-server
9+
ms.topic: conceptual
10+
---
11+
12+
# Update Client TLS Certificates for Application Clients with Azure Database for PostgreSQL - Flexible Server
13+
14+
[!INCLUDE [applies-to-postgresql-flexible-server](../includes/applies-to-postgresql-flexible-server.md)]
15+
16+
17+
## Import Root CA Certificates in Java Key Store on the client for certificate pinning scenarios
18+
19+
Custom-written Java applications use a default keystore, called *cacerts*, which contains trusted certificate authority (CA) certificates. It's also often known as Java trust store. A certificates file named *cacerts* resides in the security properties directory, java.home\lib\security, where java.home is the runtime environment directory (the jre directory in the SDK or the top-level directory of the Java™ 2 Runtime Environment).
20+
You can use following directions to update client root CA certificates for client certificate pinning scenarios with PostgreSQL Flexible Server:
21+
1. Make a backup copy of your custom keystore.
22+
2. Download [certificates](../flexible-server/concepts-networking-ssl-tls.md#downloading-root-ca-certificates-and-updating-application-clients-in-certificate-pinning-scenarios)
23+
3. Generate a combined CA certificate store with both Root CA certificates are included. Example below shows using DefaultJavaSSLFactory for PostgreSQL JDBC users.
24+
25+
* For connectivity to servers deployed to Azure Government cloud regions (US Gov Virginia, US Gov Texas, US Gov Arizona)
26+
```powershell
27+
28+
29+
keytool -importcert -alias PostgreSQLServerCACert -file D:\ DigiCertGlobalRootG2.crt.pem -keystore truststore -storepass password -noprompt
30+
31+
keytool -importcert -alias PostgreSQLServerCACert2 -file "D:\ Microsoft ECC Root Certificate Authority 2017.crt.pem" -keystore truststore -storepass password -noprompt
32+
```
33+
* For connectivity to servers deployed in Azure public regions worldwide
34+
```powershell
35+
36+
keytool -importcert -alias PostgreSQLServerCACert -file D:\ DigiCertGlobalRootCA.crt.pem -keystore truststore -storepass password -noprompt
37+
38+
keytool -importcert -alias PostgreSQLServerCACert2 -file "D:\ Microsoft ECC Root Certificate Authority 2017.crt.pem" -keystore truststore -storepass password -noprompt
39+
```
40+
41+
5. Replace the original keystore file with the new generated one:
42+
43+
```java
44+
System.setProperty("javax.net.ssl.trustStore","path_to_truststore_file");
45+
System.setProperty("javax.net.ssl.trustStorePassword","password");
46+
```
47+
6. Replace the original root CA pem file with the combined root CA file and restart your application/client.
48+
49+
For more information on configuring client certificates with PostgreSQL JDBC driver, see this [documentation.](https://jdbc.postgresql.org/documentation/ssl/)
50+
51+
52+
53+
## Get list of trusted certificates in Java Key Store
54+
55+
As stated above, Java, by default, stores the trusted certificates in a special file named *cacerts* that is located inside Java installation folder on the client.
56+
Example below first reads *cacerts* and loads it into *KeyStore* object:
57+
```java
58+
private KeyStore loadKeyStore() {
59+
String relativeCacertsPath = "/lib/security/cacerts".replace("/", File.separator);
60+
String filename = System.getProperty("java.home") + relativeCacertsPath;
61+
FileInputStream is = new FileInputStream(filename);
62+
KeyStore keystore = KeyStore.getInstance(KeyStore.getDefaultType());
63+
String password = "changeit";
64+
keystore.load(is, password.toCharArray());
65+
66+
return keystore;
67+
}
68+
```
69+
The default password for *cacerts* is *changeit* , but should be different on real client, as administrators recommend changing password immediately after Java installation.
70+
Once we loaded KeyStore object, we can use the *PKIXParameters* class to read certificates present.
71+
```java
72+
public void whenLoadingCacertsKeyStore_thenCertificatesArePresent() {
73+
KeyStore keyStore = loadKeyStore();
74+
PKIXParameters params = new PKIXParameters(keyStore);
75+
Set<TrustAnchor> trustAnchors = params.getTrustAnchors();
76+
List<Certificate> certificates = trustAnchors.stream()
77+
.map(TrustAnchor::getTrustedCert)
78+
.collect(Collectors.toList());
79+
80+
assertFalse(certificates.isEmpty());
81+
}
82+
```
83+
## Update Root CA certificates when using clients in Azure App Services with Azure Database for PostgreSQL - Flexible Server for certificate pinning scenarios
84+
85+
For Azure App services, connecting to Azure Database for PostgreSQL, we can have two possible scenarios on updating client certificates and it depends on how on you're using SSL with your application deployed to Azure App Services.
86+
87+
* Usually new certificates are added to App Service at platform level prior to changes in Azure Database for PostgreSQL - Flexible Server. If you're using the SSL certificates included on App Service platform in your application, then no action is needed. Consult following [Azure App Service documentation](../../app-service/configure-ssl-certificate.md) for more information.
88+
* If you're explicitly including the path to SSL cert file in your code, then you would need to download the new cert and update the code to use the new cert. A good example of this scenario is when you use custom containers in App Service as shared in the [App Service documentation](../../app-service/tutorial-multi-container-app.md#configure-database-variables-in-wordpress)
89+
90+
## Update Root CA certificates when using clients in Azure Kubernetes Service (AKS) with Azure Database for PostgreSQL - Flexible Server for certificate pinning scenarios
91+
92+
If you're trying to connect to the Azure Database for PostgreSQL using applications hosted in Azure Kubernetes Services (AKS) and pinning certificates, it's similar to access from a dedicated customers host environment. Refer to the steps [here](../../aks/ingress-tls.md).
93+
94+
## Updating Root CA certificates for .NET (Npgsql) users on Windows with Azure Database for PostgreSQL - Flexible Server for certificate pinning scenarios
95+
96+
For .NET (Npgsql) users on Windows, connecting to Azure Database for PostgreSQL - Flexible Servers deployed in Azure Government cloud regions (US Gov Virginia, US Gov Texas, US Gov Arizona) make sure **both** Microsoft RSA Root Certificate Authority 2017 and DigiCert Global Root G2 both exist in Windows Certificate Store, Trusted Root Certification Authorities. If any certificates don't exist, import the missing certificate.
97+
98+
For .NET (Npgsql) users on Windows, connecting to Azure Database for PostgreSQL - Flexible Servers deployed in Azure public regions worldwide make sure **both** Microsoft RSA Root Certificate Authority 2017 and DigiCert Global Root CA **both** exist in Windows Certificate Store, Trusted Root Certification Authorities. If any certificates don't exist, import the missing certificate.
99+
100+
101+
102+
## Updating Root CA certificates for other clients for certificate pinning scenarios
103+
104+
For other PostgreSQL client users, you can merge two CA certificate files like this format below.
105+
106+
```azurecli
107+
108+
109+
-----BEGIN CERTIFICATE-----
110+
(Root CA1: DigiCertGlobalRootCA.crt.pem)
111+
-----END CERTIFICATE-----
112+
-----BEGIN CERTIFICATE-----
113+
(Root CA2: Microsoft ECC Root Certificate Authority 2017.crt.pem)
114+
-----END CERTIFICATE-----
115+
```
116+
117+
## Related content
118+
119+
- Learn how to create an Azure Database for PostgreSQL flexible server instance by using the **Private access (VNet integration)** option in [the Azure portal](how-to-manage-virtual-network-portal.md) or [the Azure CLI](how-to-manage-virtual-network-cli.md).
120+
- Learn how to create an Azure Database for PostgreSQL flexible server instance by using the **Public access (allowed IP addresses)** option in [the Azure portal](how-to-manage-firewall-portal.md) or [the Azure CLI](how-to-manage-firewall-cli.md).

0 commit comments

Comments
 (0)