![[Note]](images/note.png) | Note |
|---|---|
The |
| Note |
|---|---|
The |
The Config Server can use a symmetric (shared) key or an asymmetric one (RSA key pair).
The asymmetric choice is superior in terms of security, but it is often more convenient to use a symmetric key since it is a single property value to configure in the bootstrap.properties.
To configure a symmetric key, you need to set encrypt.key to a secret String (or use the ENCRYPT_KEY environment variable to keep it out of plain-text configuration files).
| Note |
|---|---|
You cannot configure an asymmetric key using |
To configure an asymmetric key use a keystore (e.g. as
created by the keytool utility that comes with the JDK). The
-keystore properties are encrypt.keyStore.* with * equal to
| Property | Description |
|---|---|
| Contains a |
| Holds the password that unlocks the keystore |
| Identifies which key in the store to use |
The encryption is done with the public key, and a private key is
+keystore properties are encrypt.keyStore.* with * equal to
| Property | Description |
|---|---|
| Contains a |
| Holds the password that unlocks the keystore |
| Identifies which key in the store to use |
| The type of KeyStore to create. Defaults to |
The encryption is done with the public key, and a private key is needed for decryption. Thus, in principle, you can configure only the public key in the server if you want to only encrypt (and are prepared to decrypt the values yourself locally with the private key). In practice, you might not want to do decrypt locally, because it spreads the key management process around all the clients, instead of diff --git a/single/spring-cloud-config.html b/single/spring-cloud-config.html index fbf99f3c..adf92062 100644 --- a/single/spring-cloud-config.html +++ b/single/spring-cloud-config.html @@ -545,7 +545,7 @@ the key value with "@" and provide the file path, as shown in the following exam AQAjPgt3eFZQXwt8tsHAVv/QHiY5sI2dRcR+...
| Note |
|---|---|
The |
The Config Server can use a symmetric (shared) key or an asymmetric one (RSA key pair).
The asymmetric choice is superior in terms of security, but it is often more convenient to use a symmetric key since it is a single property value to configure in the bootstrap.properties.
To configure a symmetric key, you need to set encrypt.key to a secret String (or use the ENCRYPT_KEY environment variable to keep it out of plain-text configuration files).
| Note |
|---|---|
You cannot configure an asymmetric key using |
To configure an asymmetric key use a keystore (e.g. as
created by the keytool utility that comes with the JDK). The
-keystore properties are encrypt.keyStore.* with * equal to
| Property | Description |
|---|---|
| Contains a |
| Holds the password that unlocks the keystore |
| Identifies which key in the store to use |
The encryption is done with the public key, and a private key is
+keystore properties are encrypt.keyStore.* with * equal to
| Property | Description |
|---|---|
| Contains a |
| Holds the password that unlocks the keystore |
| Identifies which key in the store to use |
| The type of KeyStore to create. Defaults to |
The encryption is done with the public key, and a private key is
needed for decryption.
Thus, in principle, you can configure only the public key in the server if you want to only encrypt (and are prepared to decrypt the values yourself locally with the private key).
In practice, you might not want to do decrypt locally, because it spreads the key management process around all the clients, instead of
diff --git a/spring-cloud-config.xml b/spring-cloud-config.xml
index 57a126e1..5764d007 100644
--- a/spring-cloud-config.xml
+++ b/spring-cloud-config.xml
@@ -1114,6 +1114,10 @@ keystore properties are