Skip to content

Commit 54e91a1

Browse files
committed
docs: rewrite certificate validation page following doc guidelines
1 parent 66f3c8a commit 54e91a1

1 file changed

Lines changed: 66 additions & 61 deletions

File tree

Lines changed: 66 additions & 61 deletions
Original file line numberDiff line numberDiff line change
@@ -1,59 +1,63 @@
11
# Certificate validation
22

3-
This page explains how OpenAEV handles TLS/SSL certificate validation on the server side, and how administrators can enforce or relax certificate checks depending on their environment.
3+
OpenAEV enforces TLS/SSL certificate validation on the server side by default. This page explains how to configure certificate trust for outgoing and incoming connections.
44

5-
## Overview
5+
## What is this?
66

7-
By default, OpenAEV **enforces certificate validation** for all outgoing HTTPS connections (to injectors, collectors, external APIs, etc.). This means that the server will reject connections to endpoints presenting invalid, expired, or untrusted certificates.
7+
Certificate validation ensures that OpenAEV only communicates with trusted endpoints. When OpenAEV connects to injectors, collectors, or external APIs over HTTPS, it verifies that the remote certificate is valid, not expired, and issued by a trusted Certificate Authority (CA).
88

9-
OpenAEV provides several configuration options to control this behavior:
9+
## Why does it matter?
1010

11-
- **Strict mode (default):** Only connections with valid, trusted certificates are allowed.
12-
- **Unsecured mode:** Self-signed or untrusted certificates are accepted (useful for development or air-gapped environments).
13-
- **Custom trust store:** Add your own CA or self-signed certificates to the trust chain without disabling validation entirely.
11+
- **Security** — Prevents man-in-the-middle (MITM) attacks on all outgoing connections.
12+
- **Compliance** — Many security frameworks require strict TLS validation in production.
13+
- **Flexibility** — OpenAEV supports custom trust stores, so you can trust internal CAs without disabling validation.
1414

15-
## Configuration parameters
15+
## Outgoing connections (OpenAEV as client)
1616

17-
### Enforce strict certificate validation (default)
17+
### Strict validation (default)
1818

19-
By default, no additional configuration is needed. OpenAEV validates all TLS certificates against the JVM's default trust store (Java `cacerts`).
19+
By default, OpenAEV validates all outgoing TLS certificates against the JVM's default trust store (`cacerts`). No configuration is needed.
2020

21-
To explicitly ensure strict validation is enforced, verify the following:
21+
| Parameter | Environment variable | Default | Description |
22+
|:--|:--|:--|:--|
23+
| `openaev.unsecured-certificate` | `OPENAEV_UNSECURED-CERTIFICATE` | `false` | Reject untrusted SSL certificates |
2224

23-
| Parameter | Environment variable | Value | Description |
24-
|:------------------------------|:--------------------------------|:--------|:-----------------------------------------------------|
25-
| openaev.unsecured-certificate | OPENAEV_UNSECURED-CERTIFICATE | `false` | Reject self-signed or untrusted SSL certificates |
25+
⚠️ **Warning** — Keep this set to `false` in production. Setting it to `true` disables certificate chain validation for **all** outgoing connections and exposes the platform to MITM attacks.
2626

27-
!!! warning "Production recommendation"
27+
### Allow self-signed certificates (dev/test only)
2828

29-
In production environments, `openaev.unsecured-certificate` should **always** be set to `false` (the default). Enabling unsecured certificates bypasses critical security checks and exposes the platform to man-in-the-middle attacks.
29+
For development or air-gapped environments with self-signed certificates, disable strict validation:
3030

31-
### Allow self-signed or untrusted certificates
32-
33-
If your environment uses self-signed certificates (e.g., internal PKI, development setups, air-gapped networks), you can disable strict validation:
31+
```yaml
32+
services:
33+
openaev:
34+
image: openaev/platform:latest
35+
environment:
36+
- OPENAEV_UNSECURED-CERTIFICATE=true
37+
```
3438
35-
| Parameter | Environment variable | Value | Description |
36-
|:------------------------------|:--------------------------------|:-------|:---------------------------------------------------------|
37-
| openaev.unsecured-certificate | OPENAEV_UNSECURED-CERTIFICATE | `true` | Accept self-signed or untrusted SSL certificates |
39+
⚠️ **Warning** — Use this only in controlled, non-production environments.
3840
39-
!!! danger "Security risk"
41+
### Add custom trusted certificates (recommended)
4042
41-
Setting `openaev.unsecured-certificate` to `true` disables certificate chain validation for **all** outgoing connections. This should only be used in controlled, non-production environments.
43+
Instead of disabling validation, add your internal CA or self-signed certificates to the OpenAEV trust store:
4244
43-
### Add custom trusted certificates (recommended approach)
45+
| Parameter | Environment variable | Default | Description |
46+
|:--|:--|:--|:--|
47+
| `openaev.extra-trusted-certs-dir` | `OPENAEV_EXTRA-TRUSTED-CERTS-DIR` | — | Directory containing additional trusted PEM certificates |
4448

45-
Instead of disabling validation entirely, you can add your own trusted certificates (e.g., internal CA, self-signed certs for third-party integrations like CrowdStrike, Tanium, SentinelOne) to the OpenAEV trust store:
49+
**Requirements:**
4650

47-
| Parameter | Environment variable | Default | Description |
48-
|:--------------------------------|:----------------------------------|:--------|:---------------------------------------------------------------|
49-
| openaev.extra-trusted-certs-dir | OPENAEV_EXTRA-TRUSTED-CERTS-DIR | | Local directory containing additional trusted PEM certificates |
51+
- Certificate files must be in **PEM format** (`.pem`) or **DER-encoded X.509** format.
52+
- The directory must be readable by the OpenAEV process.
5053

51-
**Requirements:**
54+
### Example
5255

53-
- Certificate files must be in **PEM-armoured format** (`.pem` extension) or **DER-encoded X509** format.
54-
- The directory must be accessible by the OpenAEV process.
56+
You have an internal CA that signs certificates for your CrowdStrike and Tanium integrations.
5557

56-
**Example with Docker Compose:**
58+
1. Export your internal CA certificate as `internal-ca.pem`.
59+
2. Place it in a `./my-custom-certs/` directory on the host.
60+
3. Mount it into the container:
5761

5862
```yaml
5963
services:
@@ -65,25 +69,23 @@ services:
6569
- ./my-custom-certs:/opt/openaev/certs:ro
6670
```
6771

68-
Place your `.pem` certificate files in the `./my-custom-certs` directory on the host.
69-
70-
!!! tip "Best practice"
72+
OpenAEV now trusts your internal CA **while keeping strict validation** for everything else.
7173

72-
Using `openaev.extra-trusted-certs-dir` is the **recommended approach** for environments with internal CAs or self-signed certificates. It allows you to maintain strict certificate validation while trusting specific certificates.
74+
💡 **Tip** — This is the recommended approach for production environments with internal PKI.
7375

74-
## Server-side SSL/TLS (incoming connections)
76+
## Incoming connections (TLS termination)
7577

76-
OpenAEV can also terminate TLS directly (without a reverse proxy) using the built-in Spring Boot SSL support:
78+
OpenAEV can terminate TLS directly using Spring Boot's built-in SSL support, without a reverse proxy.
7779

78-
| Parameter | Environment variable | Default value | Description |
79-
|:-----------------------------|:-----------------------------|:----------------------|:-------------------------|
80-
| server.ssl.enabled | SERVER_SSL_ENABLED | `false` | Enable SSL on the server |
81-
| server.ssl.key-store-type | SERVER_SSL_KEY-STORE-TYPE | PKCS12 | Keystore type |
82-
| server.ssl.key-store | SERVER_SSL_KEY-STORE | classpath:localhost.p12 | Keystore path |
83-
| server.ssl.key-store-password| SERVER_SSL_KEY-STORE-PASSWORD| admin | Keystore password |
84-
| server.ssl.key-alias | SERVER_SSL_KEY-ALIAS | localhost | Key alias in keystore |
80+
| Parameter | Environment variable | Default | Description |
81+
|:--|:--|:--|:--|
82+
| `server.ssl.enabled` | `SERVER_SSL_ENABLED` | `false` | Enable SSL on the server |
83+
| `server.ssl.key-store-type` | `SERVER_SSL_KEY-STORE-TYPE` | `PKCS12` | Keystore type |
84+
| `server.ssl.key-store` | `SERVER_SSL_KEY-STORE` | `classpath:localhost.p12` | Keystore path |
85+
| `server.ssl.key-store-password` | `SERVER_SSL_KEY-STORE-PASSWORD` | `admin` | Keystore password |
86+
| `server.ssl.key-alias` | `SERVER_SSL_KEY-ALIAS` | `localhost` | Key alias in keystore |
8587

86-
**Example configuration:**
88+
### Example
8789

8890
```yaml
8991
services:
@@ -100,26 +102,29 @@ services:
100102
- ./keystore.p12:/opt/openaev/keystore.p12:ro
101103
```
102104

103-
!!! note "Reverse proxy"
104-
105-
Most production deployments terminate TLS at a reverse proxy (Nginx, Traefik, HAProxy) rather than on the OpenAEV server itself. In that case, leave `server.ssl.enabled` as `false` and configure TLS on your reverse proxy. Make sure to set `openaev.cookie-secure=true` if the end-user connection is over HTTPS.
105+
💡 **Tip** — Most production deployments terminate TLS at a reverse proxy (Nginx, Traefik, HAProxy). In that case, leave `server.ssl.enabled=false` and set `openaev.cookie-secure=true` if end-users connect over HTTPS.
106106

107107
## Proxy support
108108

109109
If OpenAEV connects to external services through a proxy, enable proxy support:
110110

111-
| Parameter | Environment variable | Default | Description |
112-
|:---------------------|:-----------------------|:--------|:---------------------------------|
113-
| openaev.with-proxy | OPENAEV_WITH-PROXY | `false` | Enable proxy environment support |
111+
| Parameter | Environment variable | Default | Description |
112+
|:--|:--|:--|:--|
113+
| `openaev.with-proxy` | `OPENAEV_WITH-PROXY` | `false` | Enable proxy environment support |
114114

115115
When enabled, OpenAEV respects the standard `HTTP_PROXY`, `HTTPS_PROXY`, and `NO_PROXY` environment variables.
116116

117-
## Summary: which option to choose?
117+
## Quick reference
118+
119+
| Scenario | Configuration |
120+
|:--|:--|
121+
| Production with public CA-signed certificates | Default (no changes needed) |
122+
| Internal CA or self-signed certs for integrations | `openaev.extra-trusted-certs-dir` → your PEM directory |
123+
| Development / testing | `openaev.unsecured-certificate=true` (temporary only) |
124+
| TLS termination on OpenAEV | `server.ssl.enabled=true` + keystore config |
125+
| TLS termination on reverse proxy | `server.ssl.enabled=false` + `openaev.cookie-secure=true` |
126+
127+
## What's next?
118128

119-
| Scenario | Recommended configuration |
120-
|:--------------------------------------------------|:---------------------------------------------------------------------------------|
121-
| Production with public CA-signed certificates | Default settings (no changes needed) |
122-
| Internal CA or self-signed certs for integrations | `openaev.extra-trusted-certs-dir` pointing to your PEM certificates directory |
123-
| Development / testing environment | `openaev.unsecured-certificate=true` (temporary only) |
124-
| TLS termination on OpenAEV server | `server.ssl.enabled=true` + keystore configuration |
125-
| TLS termination on reverse proxy | `server.ssl.enabled=false` + `openaev.cookie-secure=true` |
129+
- [Configuration reference](../configuration.md) — Full list of OpenAEV platform parameters.
130+
- [Deployment overview](../overview.md) — Architecture and deployment options.

0 commit comments

Comments
 (0)