Securing your deployment
Securing your deployment
Application level security in Elastic Path is handled through the Spring Security framework in combination with security best practices.
Network security is a concern in any distributed environment deployment, and in commerce systems sensitive information such as client credit cards, logins, and other database info are vulnerable to packet sniffing if they are not encrypted.
Credit card numbers are always encrypted with an encryption key immediately after being provided by customers. No credit card number is ever transferred over the network or stored un-encrypted.
The Commerce Manager client assumes that network traffic is secured through firewalled VPN connections, and is thus safe from traffic sniffing by external sources. On the local network, traffic can be secured through the use of SSL between the Desktop Commerce Manager client and the Commerce Manager Server.
To enable SSL on your deployment:
- Enable HTTPS on your Commerce Manager server.
- If your SSL certificate was not issued from a recognized certificate-issuing authority (i.e. Thawte, Verisign, etc), for instance if you are using a self-signed certificate, then the certificate must be installed on the Commerce Manager Client machines as a trusted certificate. For more information see the instructions from Oracle .Note:
cd <TOMCAT_HOME> <JDK_HOME>/bin/keytool -genkey -alias tomcat -keyalg RSA -keypass changeit -storepass changeit -keystore keystore.jks First and Last Name: localhost
The command creates file: keystore.jks
<JDK_HOME>/bin/keytool -export -alias tomcat -storepass changeit -file server.cer -keystore keystore.jks
The command creates file: server.cer
<JDK_HOME>/bin/keytool -import -v -trustcacerts -alias tomcat -file server.cer -keystore cacerts.jks -keypass changeit -storepass changeit
The command creates file: cacerts.jks
cd <JDK_HOME>/jre/lib/security chmod 777 cacerts cp cacerts cacerts.backup cp <TOMCAT_HOME>/cacerts.jks cacerts chmod 444 cacerts
<Connector port="8443" maxHttpHeaderSize="8192" maxThreads="150" minSpareThreads="25" maxSpareThreads="75" enableLookups="false" disableUploadTimeout="true" acceptCount="100" scheme="https" secure="true" clientAuth="false" sslProtocol="TLS" keystoreFile="keystore.jks"/commerce-legacy/>
- Configure Spring Security's security.xml so that all requests to *.remote services used by the Commerce Manager Client are required to go through secure HTTPS
<intercept-url pattern="*.remote" requires-channel="HTTPS" />
- All communications between the desktop Commerce Manager Client and the Commerce Manager Server will now be secured through SSL.Note:
It is critical that the deployment directory of your application is secure on the OS, to ensure that configuration files (e.g. commerce-config.xml, server.xml) are not accessible to unauthorized users. These files contain the credit card encryption key and database connection info.
Database login credentials are stored within your specific application server's configuration file, which will need to be secure from unauthorized access on the file system.
Supported database drivers (Oracle, MySQL, SQL Server) secure their initial handshake to the database servers so that database login credentials are not intercepted over the network.