From abcacf1ef5ccc2536ac9ca8ba61d31678e36637f Mon Sep 17 00:00:00 2001 From: buildmaster Date: Wed, 12 Sep 2018 13:49:57 +0000 Subject: [PATCH] Sync docs from master to gh-pages --- multi/multi__spring_cloud_config_server.html | 2 +- single/spring-cloud-config.html | 2 +- spring-cloud-config.xml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/multi/multi__spring_cloud_config_server.html b/multi/multi__spring_cloud_config_server.html index a4bef3ab..e9b15ce7 100644 --- a/multi/multi__spring_cloud_config_server.html +++ b/multi/multi__spring_cloud_config_server.html @@ -420,7 +420,7 @@ The keys are passed to a TextEncryptorLocator, whic If you have configured a keystore (encrypt.keystore.location), the default locator looks for keys with aliases supplied by the key prefix, with a cipher text like resembling the following:

foo:
   bar: `{cipher}{key:testkey}...`

The locator looks for a key named "testkey". A secret can also be supplied by using a {secret:…​} value in the prefix. -However, if it is not supplied, the default is to use the keystore password (which is what you get when you build a keytore and do not specify a secret). +However, if it is not supplied, the default is to use the keystore password (which is what you get when you build a keystore and do not specify a secret). If you do supply a secret, you should also encrypt the secret using a custom SecretLocator.

When the keys are being used only to encrypt a few bytes of configuration data (that is, they are not being used elsewhere), key rotation is hardly ever necessary on cryptographic grounds. However, you might occasionally need to change the keys (for example, in the event of a security breach). In that case, all the clients would need to change their source config files (for example, in git) and use a new {key:…​} prefix in all the ciphers. diff --git a/single/spring-cloud-config.html b/single/spring-cloud-config.html index 8e9f3a41..7a854a0e 100644 --- a/single/spring-cloud-config.html +++ b/single/spring-cloud-config.html @@ -504,7 +504,7 @@ The keys are passed to a TextEncryptorLocator, whic If you have configured a keystore (encrypt.keystore.location), the default locator looks for keys with aliases supplied by the key prefix, with a cipher text like resembling the following:

foo:
   bar: `{cipher}{key:testkey}...`

The locator looks for a key named "testkey". A secret can also be supplied by using a {secret:…​} value in the prefix. -However, if it is not supplied, the default is to use the keystore password (which is what you get when you build a keytore and do not specify a secret). +However, if it is not supplied, the default is to use the keystore password (which is what you get when you build a keystore and do not specify a secret). If you do supply a secret, you should also encrypt the secret using a custom SecretLocator.

When the keys are being used only to encrypt a few bytes of configuration data (that is, they are not being used elsewhere), key rotation is hardly ever necessary on cryptographic grounds. However, you might occasionally need to change the keys (for example, in the event of a security breach). In that case, all the clients would need to change their source config files (for example, in git) and use a new {key:…​} prefix in all the ciphers. diff --git a/spring-cloud-config.xml b/spring-cloud-config.xml index db521697..0a456dae 100644 --- a/spring-cloud-config.xml +++ b/spring-cloud-config.xml @@ -1051,7 +1051,7 @@ If you have configured a keystore (encrypt.keystore.location) bar: `{cipher}{key:testkey}...` The locator looks for a key named "testkey". A secret can also be supplied by using a {secret:…​} value in the prefix. -However, if it is not supplied, the default is to use the keystore password (which is what you get when you build a keytore and do not specify a secret). +However, if it is not supplied, the default is to use the keystore password (which is what you get when you build a keystore and do not specify a secret). If you do supply a secret, you should also encrypt the secret using a custom SecretLocator. When the keys are being used only to encrypt a few bytes of configuration data (that is, they are not being used elsewhere), key rotation is hardly ever necessary on cryptographic grounds. However, you might occasionally need to change the keys (for example, in the event of a security breach).