Join us in the third Virtual meetup to learn more about securing APIs by implementing one-way and two-way SSL.

1. August 19, 2020: Toronto Virtual Meetup #3
TORONTO

2. All contents © MuleSoft Inc.
Agenda
2
• Introductions
• SSL Implementation in Mule
• What’s next

3. All contents © MuleSoft Inc.
Introductions
3
• About the organizers:
– Alexandra Martinez
– Mahesh Pujari
– Pravallika Nagaraja
– Kishore Reddy

4. Secure your API’s by implementing one-way &
two-way SSL
SSL IN MULE

5. All contents © MuleSoft Inc.
Agenda
5
• Introductions
• What is SSL?
• Anatomy of a certificate?
• CA certificate
• KeyStore vs TrustStore
• SSL handshake – one way
• SSL handshake – two way
• What’s next
• Networking time

6. All contents © MuleSoft Inc.
SSL ????
6
Secure your API’s by implementing one-way & two-way
SSL
Certificates
? http vs
https?
Truststores
and
keystores?

7. All contents © MuleSoft Inc. 7
• Though deprecated in 1999 the term SSL is still heavily used which
indicates how popular it is.
• But what is SSL ? – SSL stands for secure sockets layer. Its successor
TLS or Transport Security Layer (TLS 1.0) was introduced in 1999.
• Good, but still what are they ? – SSL/TLS are protocols for facilitating
a secure way of connecting two computers.
• Why do we need security between two computers ? – when two
computers communicate over a network there are possibilities of
eavesdropping and tampering. To prevent these malicious actions a
means of security is needed.
What is SSL?

8. All contents © MuleSoft Inc. 8
The most ideal situation
But is this reality ?
X
This is the reality

9. All contents © MuleSoft Inc. 9
Anatomy of a certificate?
• Public key certificate or simply certificate is a digital identity of its owner.
• A digital certificate binds a user, a computer or service’s identity to a
public key by providing information about the subject of the
certificate.
There are two types of certificates
• Self signed certificates
• CA certificates

10. All contents © MuleSoft Inc. 10
CA – certificate authority or certification authority is an entity that issues a publicly
trusted digital certificates.
There are three hierarchies of CA structures.
• Single/one tier
• Two tier
• Three tier
The mostly commonly used is the two tier hierarchy.
ROOT CERTIFICATE: is a public key certificate that identifies the root CA.
CERTIFICATE CHAIN: also called chain of trust, is a mechanism of validating
Each component of hardware and software from the end entity up to the root.
CA certificate

11. All contents © MuleSoft Inc. 11
• Keystore is a repository where the server stores its certificates and keys, in simple
terms it can be visualized as a folder containing certificate files.
• Truststore is a repository where a client or a server will store certificates of entities
it is willing to trust.
Keystore vs truststore

12. All contents © MuleSoft Inc. 12
• Keytool : key and certificate management utility
• Location: <JAVA_HOME>/bin
• Some important command options
Generating keys
Options Purpose Defaults
-genkey generate the key-pair
-alias unique identifier associated with the key-pair Mykey
-keyalg encryption algorithm used to generated the key-pair DSA/DES
-keypass password for the key-pair
-storepass keystore password
-keystore name of the keystore in which key-pair should be
stored
-storetype type of keystore “keystore.type” Value from
security properties file

13. All contents © MuleSoft Inc. 13
• keytool -genKey -alias myserver -keystore serverkeystore.jks -
storetype jks -keypass keypassword
-storepass storepassword -keyalg RSA
With the above command I am asking to generate key-pair with alias myserver and
store it in a keystore file named serverksytore where my keystore is of type jks and
the algorithm used to generate my key-pair is RSA. The password for my key-pair is
“keypassword” and the password for my keystore is “storepassword” as well.
Decoding keytool command

14. All contents © MuleSoft Inc. 14
• A client tries to access a resource via https://
• Server respond by providing its SSL certificate stored in keyStore
• Client takes the SSL certificate and verifies its using its TrustStore (client
TrustStore has list of certificates it is willing to trust)
• If the SSL certificate provided by Server is present in client’s TrustStore the
communication is established and happens over a shared secret key.
SSL handshake – One way
Can I trust you ?
Of course you can. Here is my certificate
Thank you, I trust you now

15. All contents © MuleSoft Inc. 15
• In two way SSL the client and server need to authenticate and validate each others
identities.
• A client request access to protected resources hosted on the server.
• The server present its certificate to the client.
• The client verifies the server’s certificate.
• If the validation is successful the client then sends its certificate to the server.
• The server verified the clients certificate.
• If successful, the server grants access to the protected resource requested by the
client.
• This is also called as server side validation of the client.
SSL handshake – TWO way

16. All contents © MuleSoft Inc. 16
• In standard cloudhub deployment strategy the anypoint platform automatically
provides a frontend Elastic Load Balancer (ELB) which is pre configured with CA
certificates for .cloudhub.io domain.
• The purpose of providing a self signed certificate for the Mule application is to
enable HTTPS/SSL between the load balancer and the mule worker for the
application.
• This methodology provides complete end to end SSL encryption
On cloudhub
Client
HTTP
S
Cloudhub
ELB
HTTP
S
Mule
APP

17. Q&A

18. Quiz time!
3 lucky winners get a training or certification voucher!
18

19. All contents © MuleSoft Inc.
What’s next
19
• Share:
– Tweet your pictures with the hashtag #MuleMeetup
– Invite your network to join: https://meetups.mulesoft.com/toronto
• Feedback:
– Contact your organizers Alex, Mahesh, Pravallika, Kishore to suggest topics
– Contact MuleSoft at meetup@mulesoft.com for ways to improve the program
• Next event
– September 16th, 2020
– 5:30 PM (EDT)
– Anypoint Monitoring (Dashboards, Alerts) and Visualizer
– https://meetups.mulesoft.com/events/details/mulesoft-toronto-presents-
toronto-virtual-meetup-4/#/

20. See you next time
Please send topic suggestions to the organizers