JSON Configuration for Listeners
"privatekey": "-----BEGIN PRIVATE KEY-----\nMIIEvQIBADA...removed...peGYffSn9E8=\n-----END PRIVATE KEY-----\n",
"certificates": ["-----BEGIN CERTIFICATE-----\nMIIESTCC... removed...\n-----END CERTIFICATE-----\n"]
"privatekey": "-----BEGIN PRIVATE KEY-----\n...removed...DlqjF8s=\n-----END PRIVATE KEY-----\n",
"certificates": ["-----BEGIN CERTIFICATE-----\nMIIFUDCCAz...removed...HGSDk=\n-----END CERTIFICATE-----\n"]
"certificate": "-----BEGIN CERTIFICATE-----\nMIIDrzCCApegAwIBA...removed...40KPMbp1ZWVbd4=\n-----END CERTIFICATE-----"
Configuration via Ceptor Console
Here, you can define which ports to listen for connections on, and which protocols to use.
You can add any number of listeners here, a listener is a TCP port that the gateway listens for connections for clients on, and for each port, you select the protocol (AJP, HTTP or HTTPS) to use.
Adding a new listener
When adding a new listener, select the protocol, and optionally specify the IP address to restrict listening to, then specify the TCP port number to use.
Once created, each listener has these properties which you can edit - note that the SSL options are only used if the protocol is set to https.
JSON key: A listener is specified as an object within a listener array.
Scheme / Protocol
Scheme / Protocol to use when listening on the TCP port.
Must be either https, http or ajp
If https is specified, the SSL settings must also be filled in - otherwise they are ignored.
HTTP over SSL.
Apache JServ Protocol - a binary unencrypted protocol used by some proxy servers, such as Apache or nginx.
Use of ajp is to be considered experimental and not generally recommended.
Note that for HTTP, all current versions of the HTTP protocol are supported by the gateway, meaning 0.9/1.0/1.1 and HTTP/2.
JSON key: scheme
IP Address specifies which interface to listen for connections on - leave blank or set to 0.0.0.0 to listen on all interfaces.
JSON key is: address
TCP Port to listen for connections on
JSON key is port
Support Proxy Protocol
Check to enable support for the HA Proxy protocol - use this to allow a proxy in front of Ceptor to forward IP address and TCP port information using this protocol instead of in HTTP headers.
JSON key is: useproxyprotocol
Check to enable support for the Forwarded HTTP header - use this to allow a proxy in front of Ceptor to forward IP address and TCP port information using the RFC7239 HTTP Forwarded header.
SSL settings for https protocol
SSL settings for the https protocol.
JSON key: All ssl settings are in the JSON object sslcontext within the individual listener object.
Name of SSL JCE Provider to use, or leave blank for default JDK provider.
Default: Default in JDK/JRE.
JSON key: ssl.provider
Name of SSL Protocol (e.g. TLS), or leave blank for default.
JSON key: ssl.protocol
Want client auth
Ask client to optionally present an SSL client certificate - if set, the client is asked to provide a certificate, but allowed to proceed without one. Modern browsers support this by checking the CA certificate list sent by the server - if the client has any certificates issued by one of the trusted CA certs, then it prompts the user to select one of them. If there is no match, the client continues anonymously without sending a client certificate.
JSON key: wantclientauth
Need client auth
Require client to present an SSL client certificate. If set, the client needs to provide an SSL client certificate, or the connection will be terminated.
JSON key: needclientauth
Allow unsecure renegotiation, turn off for best security
JSON key: allowrenegotiate
Comma/semicolon separated list of SSL/TLS protocols to exclude from the JCE default protocols list - patterns are regex expressions.
JSON key: excludeprotocols
Comma/semicolon separated list of protocols to include from the JCE supported protocols list - patterns are regex expressions.
JSON key: includeprotocols
Require SNI hostname to match available certificates
If set, incoming SNI hostname request must match a certificate, so no default is used.
This will give an SSL error in the client, if it does not send a SNI servername this server has a certificate that matches.
In the default case, the first available certificate will be used if an exact match cannot be found to the client SNI request.
JSON key: sni.requirematch
Use ciphersuites order
If set, use configured cipher suites order and prefer first specified in the list.
JSON key: useciphersuites.order
Comma/semicolon separated list of ciphersuites to exclude from the JCE default ciphersuites list - patterns are regex expressions.
JSON key: excludeciphersuites
Comma/semicolon separated list of ciphersuites to include from the JCE supported ciphersuites list - patterns are regex expressions
JSON key: includeciphersuites
Type of keystore, e.g. PKCS12, or JKS - must be a type supported by the specified Keystore provider.
JSON key: keystore.type
Name of JCE provider (default BC - BouncyCastle Provider)
JSON key: keystore.provider
Name of and path to file containing keystore
JSON key: keystore.file
Password for the keystore and keys within - can optionally be encrypted/obfuscated.
JSON key: keystore.password
This allows you to define additional keystores to load certificates from, or you can add the certificates and private keys directly to the configuration without needing to load them from external files. (Requires minimum version 6.5.0)
Ceptor Gateway combines multiple keystores into one logical keystore - so if you load keys and certificates from multiple places using multiple providers, e.g. from both files and from hardware HSMs, then both types can be used simultaneously.
In this example above, you can define a new keystore of a different type and provider, and you can define extra keys and certificates directly without loading them from external sources.
For more specific information about the JSON layout, refer to: Keystore configuration
JSON key: keystores
Type of truststore, e.g. PKCS12, or JKS (default PKCS12)
All certificates found in this keystore will be loaded and used as accepted CA certificates when prompting for SSL client certificates.
Note that authentication is not done solely on these certificates - authentication of SSL client certificates is done by authentication plugins in the Ceptor Session Controller which have their own set of allowed and configured root CAs.
JSON key: truststore.type
Name of JCE provider
JSON key: truststore.provider
Name of and path to file containing truststore
JSON key: truststore.file
Password for the truststore and keys within - can optionally be encrypted/obfuscated
JSON key: truststore.password
This allows you to define additional keystores to load trusted certificates from, or you can add the certificates directly to the configuration without needing to load them from external files. (Requires minimum version 6.5.0)
JSON key: keystores