Leo Galambos
b19edf17fd
Add directory-bound ACME accounts, orders, authorizations, challenge evidence, strict JWS processing, issuance, rollover and revocation. Isolate bounded ACME execution from administrative and public services while preserving explicit authority, profile, issuer and chain-path selection.
120 lines
3.8 KiB
JSON
120 lines
3.8 KiB
JSON
{
|
|
"version": 4,
|
|
"serverName": "zeroecho-admin",
|
|
"realm": {
|
|
"realmId": "production",
|
|
"displayName": "ZeroEcho Production",
|
|
"authorityExposure": {
|
|
"mode": "ALL_REALM_AUTHORITIES",
|
|
"authorityIds": [],
|
|
"creationPermitted": false
|
|
},
|
|
"authorizationCommitment": "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef",
|
|
"approvalCommitment": "96f85d99cb556b16af9b963833a832f905010681f437a757d94aab4a22e4c29c",
|
|
"disclosureCommitment": "abcdef0123456789abcdef0123456789abcdef0123456789abcdef0123456789",
|
|
"disclosureDefaults": {
|
|
"rootCa": "PUBLIC",
|
|
"intermediateCa": "PUBLIC",
|
|
"caChain": "PUBLIC",
|
|
"crl": "PUBLIC",
|
|
"leaf": "OWNER_ONLY",
|
|
"sensitiveLeaf": "RESTRICTED"
|
|
},
|
|
"controlLog": "state/server-control.log",
|
|
"controlStoreId": "0123456789abcdef0123456789abcdef",
|
|
"approvalPolicy": {
|
|
"policyId": "high-risk",
|
|
"threshold": 1,
|
|
"eligibleApprovers": ["bootstrap-approver"],
|
|
"requiredRoleTemplateIds": [],
|
|
"requesterSeparation": true,
|
|
"lifetimeMillis": 3600000,
|
|
"justificationRequired": true
|
|
},
|
|
"pkiSession": {
|
|
"version": 1,
|
|
"store": {"id": "fs", "properties": {"root": "state/pki"}},
|
|
"audit": {"id": "file", "properties": {"root": "state/audit"}},
|
|
"publishers": [],
|
|
"bindingProviders": []
|
|
}
|
|
},
|
|
"listener": {
|
|
"address": "127.0.0.1",
|
|
"port": 8443,
|
|
"tlsProvider": {
|
|
"id": "jsse-pkcs12",
|
|
"properties": {
|
|
"keyStore": "tls/server-identity.p12",
|
|
"keyStorePasswordEnvironment": "ZEROECHO_TLS_KEYSTORE_PASSWORD",
|
|
"trustStore": "tls/administrators-trust.p12",
|
|
"trustStorePasswordEnvironment": "ZEROECHO_TLS_TRUSTSTORE_PASSWORD"
|
|
}
|
|
},
|
|
"clientCertificateRequired": true,
|
|
"maximumHeaderBytes": 32768,
|
|
"maximumBodyBytes": 1048576
|
|
},
|
|
"authentication": {
|
|
"mode": "DIRECT_MTLS",
|
|
"directClientMappings": [{
|
|
"mappingId": "bootstrap-administrator",
|
|
"principalId": "bootstrap-admin",
|
|
"certificateSha256": "0000000000000000000000000000000000000000000000000000000000000000"
|
|
}]
|
|
},
|
|
"execution": {
|
|
"transportWorkers": 8,
|
|
"transportQueueCapacity": 64,
|
|
"operationWorkers": 4,
|
|
"operationQueueCapacity": 32,
|
|
"maximumAdmittedRequests": 96,
|
|
"defaultDeadlineMillis": 30000,
|
|
"maximumDeadlineMillis": 120000,
|
|
"gracefulShutdownMillis": 30000,
|
|
"forcedShutdownMillis": 10000
|
|
},
|
|
"publicListener": {
|
|
"enabled": true,
|
|
"address": "127.0.0.1",
|
|
"port": 8444,
|
|
"tlsProvider": {
|
|
"id": "jsse-pkcs12",
|
|
"properties": {
|
|
"keyStore": "tls/public-server-identity.p12",
|
|
"keyStorePasswordEnvironment": "ZEROECHO_PUBLIC_TLS_KEYSTORE_PASSWORD",
|
|
"trustStore": "tls/repository-clients-trust.p12",
|
|
"trustStorePasswordEnvironment": "ZEROECHO_PUBLIC_TLS_TRUSTSTORE_PASSWORD"
|
|
}
|
|
},
|
|
"allowPlaintextLoopback": false,
|
|
"authentication": {
|
|
"mode": "DIRECT_MTLS",
|
|
"directClientMappings": [{
|
|
"mappingId": "repository-client",
|
|
"principalId": "repository-client",
|
|
"subjectPublicKeyInfoSha256": "3333333333333333333333333333333333333333333333333333333333333333"
|
|
}]
|
|
},
|
|
"maximumHeaderBytes": 32768,
|
|
"maximumBodyBytes": 1024,
|
|
"execution": {
|
|
"transportWorkers": 4,
|
|
"transportQueueCapacity": 32,
|
|
"operationWorkers": 4,
|
|
"operationQueueCapacity": 32,
|
|
"maximumAdmittedRequests": 32,
|
|
"defaultDeadlineMillis": 30000,
|
|
"maximumDeadlineMillis": 120000,
|
|
"gracefulShutdownMillis": 30000,
|
|
"forcedShutdownMillis": 10000
|
|
},
|
|
"maximumStreamDurationMillis": 120000,
|
|
"publicImmutableCacheMillis": 86400000,
|
|
"publicAliasCacheMillis": 300000,
|
|
"authorityListExposed": true
|
|
},
|
|
"acmeListener": {"enabled": false},
|
|
"runtime": {}
|
|
}
|