1. NIAGARA 3.7 AND NEW SECURITY FEATURES
Bill Smith
August, 2012
© Tridium 2012

2. 3.5 and 3.6 Security Patch Highlights
Blacklisting of critical files
Default Category Configuration for new stations
No blank passwords
Strong passwords enabled by default
Program objects now require super user privileges to install

3. SSL with 3.6 and Earlier
The following data regarding SSL for 3.6 and earlier is available on Niagara Central by perform a search for “Installing a Signed Cert”

4. Installing the TKS Provider
Download the Tks Provider jar: TridiumProvider.jar
Install the jar into the lib/ext directory of your chosen JRE. DO NOT INSTALL INTO THE NIAGARA JRE!
If you have previously installed StandaloneTksProvider.jar, delete it from the lib/ext directory!!
Add the following line to the list in lib/security/java.security file in your JRE.
Make sure the number after "security.provider." is sequential
security.provider.11=com.tridium.crypto.TksProvider

5. Generate Key Pair for Certificate Request
Open a command prompt and make sure that jre/bin is in your PATH.
Go to the security directory for your Niagara installation.
Rename the existing ssl.tks file to ssl.tks.orig as a backup.
Run keytool with the following command:
It may be necessary to adjust the -keyalg and -keysize arguments for the Certificate Authority you intend to use.
The alias
IMPORTANT: When prompted for your first and last name, enter the base domain name for the dns entry for your server: ex. tridium.com
Answer the remaining questions as accurately as possible.
When prompted to enter a password for the key pair, just hit enter to use the keystore password.
Make a copy of the new ssl.tks to ssl.tks.new as a backup.
keytool -genkey -alias tridium -keystore ssl.tks -storepass tridium -storetype TKS -keyalg RSA -keysize 2048

6. Generate the Certificate Request
Now that a key pair has been generated, create the cert request with the following command:
A new file called certreq.cer has been created. This file should be submitted to your Certificate Authority along with any other information that they require.
keytool -genkey -alias tridium -keystore ssl.tks -storepass tridium -storetype TKS -keyalg RSA -keysize 2048

7. Install Signed Certificate
When the CA has completed the signing process, you will receive an or file that contains something like :
-----BEGIN CERTIFICATE-----
MIIFUTCCBDmgAwIBAgIQdYL06pVxhgnBQNHptRI6NzANBgkqhkiG9w0BAQUFADCB yzELMAkGA1UEBhMCVVMxFzAVBgNVBAoTDlZlcmlTaWduLCBJbmMuMTAwLgYDVQQL EydGb3IgVGVzdCBQdXJwb3NlcyBPbmx5LiAgTm8gYXNzdXJhbmNlcy4xQjBABgNV BAsTOVRlcm1zIG9mIHVzZSBhdCBodHRwczovL3d3dy52ZXJpc2lnbi5jb20vY3Bz L3Rlc3RjYSAoYykwOTEtMCsGA1UEAxMkVmVyaVNpZ24gVHJpYWwgU2VjdXJlIFNl cnZlciBDQSAtIEcyMB4XDTExMDUxMzAwMDAwMFoXDTExMDYxMjIzNTk1OVowgakx CzAJBgNVBAYTAlVTMREwDwYDVQQIEwhWaXJnaW5pYTERMA8GA1UEBxQIUmljaG1v bmQxEjAQBgNVBAoUCUhvbmV5d2VsbDEQMA4GA1UECxQHVHJpZGl1bTE6MDgGA1UE CxQxVGVybXMgb2YgdXNlIGF0IHd3dy52ZXJpc2lnbi5jb20vY3BzL3Rlc3RjYSAo YykwNTESMBAGA1UEAxQJbG9jYWxob3N0MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCB iQKBgQDcGyBUtgqRiNNQ4bdeDSGZ3oH4AiclGw5TYW5aPEkHZqvXmHwdLHSKqMme X2FnqPbw2XCwwwcFMCKD9LT6glAIvGpnDSsoDEdWAG5W7YujM1Bp53uuziUpBWV6 g8ko81K6IoRQ/PnljGUWkOXqCJuP2SxPsUxiS2Hn966m6nruswIDAQABo4IB0zCC Ac8wCQYDVR0TBAIwADALBgNVHQ8EBAMCBaAwQwYDVR0fBDwwOjA4oDagNIYyaHR0 cDovL1NWUlRyaWFsLUcyLWNybC52ZXJpc2lnbi5jb20vU1ZSVHJpYWxHMi5jcmww SgYDVR0gBEMwQTA/BgpghkgBhvhFAQcVMDEwLwYIKwYBBQUHAgEWI2h0dHBzOi8v d3d3LnZlcmlzaWduLmNvbS9jcHMvdGVzdGNhMB0GA1UdJQQWMBQGCCsGAQUFBwMB BggrBgEFBQcDAjAfBgNVHSMEGDAWgBQoFxOKvdaitdwGLLe2jtoQZmBu5TB0Bggr BgEFBQcBAQRoMGYwJAYIKwYBBQUHMAGGGGh0dHA6Ly9vY3NwLnZlcmlzaWduLmNv bTA+BggrBgEFBQcwAoYyaHR0cDovL1NWUlRyaWFsLUcyLWFpYS52ZXJpc2lnbi5j b20vU1ZSVHJpYWxHMi5jZXIwbgYIKwYBBQUHAQwEYjBgoV6gXDBaMFgwVhYJaW1h Z2UvZ2lmMCEwHzAHBgUrDgMCGgQUS2u5KJYGDLvQUjibKaxLB4shBRgwJhYkaHR0 cDovL2xvZ28udmVyaXNpZ24uY29tL3ZzbG9nbzEuZ2lmMA0GCSqGSIb3DQEBBQUA A4IBAQCLmDayf1WCyO3bRBfy5EqF314Swj0RbX6sEWq+413R72KpUwMucK5ugo56 o7QlMl5vSMZdm70vjt6jiSnBPWUUYxggwP1ri565DuuRNYcjhdA/Lz7Aj+x2FLOx k9nwKt9oehPproEuMIJM/4NbijKOWNDndLOquuokITeL5Rp2s8p7lF0mfBYB4FTY cO+q0sbXZxN4swHSvf4RcfbC4xMHsenA86m5E6NuLlJshz3h5Yr4oASR2btm7htK myEslcmph/HcpdBAaTguhGvvqkCytc4Bry5IGedPgYgZStIudA1PdkeUtC5/mvy0
ctI785MRsEhTCsmryqIVrYrscYb8
-----END CERTIFICATE-----

8. Install Signed Certificate (continued)
Save that section to a file, ex. signedcert.cer and put it in the same directory as your ssl.tks.
If intermediate certs have also been provided, save them to files as well.
Documentation with your signed cert should provide you with a reference to the root certificate used to sign the chain. Download this root cert and save it to a file.
With a text editor, create a new file and copy and paste the contents of each cert file into the new one with the signed cert first, then the intermediate cert(s), and last the root (CA) cert .
Save this to a file called something like certchain.cer.
Run the following command: (This MUST be done on the same keystore that was used to generate the initial CSR.)
You may be promped with something like "... is not trusted. Install reply anyway?". Answer "yes".
keytool -importcert -trustcacerts -file certchain.cer -keystore ssl.tks -storepass tridium -storetype TKS -alias tridium

9. Check the Keystore
Dump the contents of the keystore with the following command:
The first few lines should contain something like:
Verify that this is PrivateKeyEntry.
The next thing to look at is the first cert. Look for the following lines:
Verify that the owner is the end certificate that you had signed.
Look through each subsequent certificate to make sure the owner is the same as the issuer on the previous certificate.
keytool -list -alias tridium -keystore ssl.tks -storepass tridium -storetype TKS -v
Alias name: tridium
Creation date: Jul 31, 2012
Entry type: PrivateKeyEntry
Certificate[1]:
Owner: CN=foo.com, OU=engineering, O=tridium, L=richmond, ST=virginia, C=us
Issuer: C=us, ST=virginia, L=richmond, O=tridium, OU=engineering, CN=intermediateca

10. Some Notes
The signed cert that you installed will only validate correctly for the domain that it was created.
Your Certificate Authority may have other requirements and instructions and should be able to assist you with any trouble.
The certificate chain must be installed into the keystore that contains the matching private key entry.

11. 3.7 SSL Features Certificate Generation
Trust Store and Key Store Management
Certificate Signing Request
Certificate Signing Tool
Importing/Export keys and certificates
Allowed Host Management
Improved SSL Support for Web, Fox and Niagarad
Improved SSL Api Support

12. Key Store Table

13. Trust Store Table

14. Allowed Hosts Table

15. Certificate Generation

16. Certificate Request Generation

17. Certificate Signing Tool

18. Approved Cipher List TLS_RSA_WITH_AES_256_CBC_SHA
TLS_DHE_RSA_WITH_AES_256_CBC_SHA
TLS_DHE_DSS_WITH_AES_256_CBC_SHA
SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
SSL_RSA_WITH_3DES_EDE_CBC_SHA
TLS_DHE_DSS_WITH_AES_128_CBC_SHA
TLS_DHE_RSA_WITH_AES_128_CBC_SHA
TLS_RSA_WITH_AES_128_CBC_SHA
SSL_RSA_WITH_RC4_128_MD5
SSL_RSA_WITH_RC4_128_SHA
TLS_EMPTY_RENEGOTIATION_INFO_SCSV

19. Certificate Verification

20. Session Information

21. SSLSocket Sample Code
ICryptoManager mgr = CertManagerFactory.getInstance(); SSLSocketFactory factory = (SSLSocketFactory) mgr.getClientSocketFactory(BSslTlsEnum.sslv3andtlsv1); SSLSocket socket = (SSLSocket) factory.createSocket(addr, port); socket.close();

22. HttpsConnection Sample Code
ICryptoManager mgr = CertManagerFactory.getInstance(); IClientSocketFactory factory = mgr.getClientSocketFactory(BSslTlsEnum.sslv3andtlsv1); HttpsConnection connection = new HttpsConnection(new BIpHost(" 443, "/", factory); connection.connect(); connection.close();

23. Server Configuration State: enabled, disabled or ssl only
if ssl only, will redirect from non-ssl port
Port: default for niagarad ssl is 5011
Certificate: server certificate selected from the key store
Protocol: SSLv3, TLSv1, or both

24. Server Configuration https enabled: true or false
https only: true or false, will redirect from http if http is enabled
Port: default for the web service is 443
Certificate: server certificate selected from the key store
Protocol: SSLv3, TLSv1, or both

25. Server Configuration foxs enabled: true or false
foxs only: true or false, will redirect from http if http is enabled
Port: default for the foxs service is 4911
Certificate: server certificate selected from the key store
Protocol: SSLv3, TLSv1, or both

26. SSLServerSocket Sample Code
ICryptoManager mgr = CertManagerFactory.getInstance(); SSLServerSocketFactory factory = (SSLServerSocketFactory) mgr.getServerSocketFactory(BSslTlsEnum.sslv3andtlsv1, false, "tridium"); SSLServerSocket serverSocket = (SSLServerSocket) factory.createServerSocket(); SSLSocket socket = (SSLSocket) serverSocket.accept(); socket.close();

27. Small Network Example CA Certificate Installed on Client Machines
in Their Trust Store
CA Private Key Used to
Sign Server Certificates

28. Large Network Example Root CA Certificate Root CA Private Key Used
Installed on Client
Machines in Their Trust
Store
Root CA Private Key Used
to Intermediate CA
Certificates
Intermediate CA
Certificate
Intermediate CA Private Key
Used to Sign Server
Certificates

29. Questions?