Announcement: You can find the guides for Commerce 7.5 and later on the new Elastic Path Documentation site. This Developer Center contains the guides for Commerce 6.13.0 through 7.4.1.Visit new site

This version of Elastic Path Commerce is no longer supported or maintained. To upgrade to the latest version, contact your Elastic Path representative.

Securing your deployment

Securing your deployment

Application level security in Elastic Path is handled through the Spring Security framework in combination with security best practices.

Network Security

Network security is a concern in any distributed environment deployment, and in commerce systems sensitive information such as client credit cards, logins, and other database info are vulnerable to packet sniffing if they are not encrypted.


Credit card numbers are always encrypted with an encryption key immediately after being provided by customers. No credit card number is ever transferred over the network or stored un-encrypted.

The Commerce Manager client assumes that network traffic is secured through firewalled VPN connections, and is thus safe from traffic sniffing by external sources. On the local network, traffic can be secured through the use of SSL between the Desktop Commerce Manager client and the Commerce Manager Server.

To enable SSL on your deployment:

  1. Enable HTTPS on your Commerce Manager server.
  2. If your SSL certificate was not issued from a recognized certificate-issuing authority (i.e. Thawte, Verisign, etc), for instance if you are using a self-signed certificate, then the certificate must be installed on the Commerce Manager Client machines as a trusted certificate. For more information see the instructions from Oracle .

    Tomcat example:

    cd <TOMCAT_HOME>
    <JDK_HOME>/bin/keytool -genkey -alias tomcat -keyalg RSA -keypass changeit -storepass changeit -keystore keystore.jks
    First and Last Name: localhost

    The command creates file: keystore.jks

    <JDK_HOME>/bin/keytool -export -alias tomcat -storepass changeit -file server.cer -keystore keystore.jks

    The command creates file: server.cer

    <JDK_HOME>/bin/keytool -import -v -trustcacerts -alias tomcat -file server.cer -keystore cacerts.jks -keypass changeit -storepass changeit

    The command creates file: cacerts.jks

    cd <JDK_HOME>/jre/lib/security
    chmod 777 cacerts
    cp cacerts cacerts.backup
    cp <TOMCAT_HOME>/cacerts.jks cacerts
    chmod 444 cacerts

    Edit <TOMCAT_HOME>/conf/server.xml:

      <Connector port="8443"
  3. Configure Spring Security's security.xml so that all requests to *.remote services used by the Commerce Manager Client are required to go through secure HTTPS
    <intercept-url pattern="*.remote" requires-channel="HTTPS" />
  4. All communications between the desktop Commerce Manager Client and the Commerce Manager Server will now be secured through SSL.

    It is critical that the deployment directory of your application is secure on the OS, to ensure that configuration files (e.g. commerce-config.xml, server.xml) are not accessible to unauthorized users. These files contain the credit card encryption key and database connection info.

Database Security

Database login credentials are stored within your specific application server's configuration file, which will need to be secure from unauthorized access on the file system.

Supported database drivers (Oracle, MySQL, SQL Server) secure their initial handshake to the database servers so that database login credentials are not intercepted over the network.