api-with-tls-pem

Protecting APIs with SSL/TLS (using PEM formatted files)

This example describes how to secure an API with SSL/TLS using PEM formatted files for the key and the certificate.

Running the Example

1. Run membrane.cmd or membrane.sh

2. Open the following URL in your browser. Please do not forget to use https instead of http.

   https://localhost:8443/

   You should get a warning that the certificate is not trustworthy. Here you can ignore the warning. In production, you should use your own certificates.

3. You can also access the API using curl. The option -k suppresses the check for self-signed certificates.

curl -k -v https://localhost:8443/

The output should look like this:

*   Trying 127.0.0.1:8443...
* Connected to localhost (127.0.0.1) port 8443 (#0)
* ALPN, offering h2
* ALPN, offering http/1.1
* successfully set certificate verify locations:
*  CAfile: /etc/ssl/cert.pem
*  CApath: none
* (304) (OUT), TLS handshake, Client hello (1):
* (304) (IN), TLS handshake, Server hello (2):
* (304) (IN), TLS handshake, Unknown (8):
* (304) (IN), TLS handshake, Certificate (11):
* (304) (IN), TLS handshake, CERT verify (15):
* (304) (IN), TLS handshake, Finished (20):
* (304) (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / AEAD-CHACHA20-POLY1305-SHA256
* ALPN, server did not agree to a protocol
* Server certificate:
*  subject: CN=membrane
*  start date: Aug  5 10:41:09 2015 GMT
*  expire date: Aug  2 10:41:09 2025 GMT
*  issuer: CN=membrane
*  SSL certificate verify result: self signed certificate (18), continuing anyway.
> GET / HTTP/1.1
> Host: localhost
> 
< HTTP/1.1 200 Ok
< Content-Type: application/json
< 
{
"success" : true
}

Configuration

Just put an SSL element into a proxy. See the documentation.

<serviceProxy port="8443">
  <ssl>
     <key>
        <private location="<<your privateKey>>" />
        <certificate location="<<your certificate>>" />
     </key>
  </ssl>
  <target host="localhost" port="2000"/>
</serviceProxy>

---

See:

• ssl reference