[DISPATCH-1440] Deprecate the passwordFile field in sslProfile and consolidate all password scenarios to use the password field

• Type: Improvement
• Status: Closed
• Priority: Major
• Resolution: Fixed
• Affects Version/s: 1.9.0
• Fix Version/s: 1.10.0
• Component/s: Container
• Assignee: Ganesh Murthy
• Reporter: Ganesh Murthy
• Created: 04/Oct/19 14:57
• Updated: 11/Aug/21 18:27
• Resolved: 09/Oct/19 17:05

Description

Deprecate the passwordFile field and consolidate all password scenarios to use  the password field. We will use the password options that openssl uses (see Pass Phrase Options sections). Going forward, here are three ways to specify a password in an sslProfile
 

sslProfile {
     caCertFile: .....
      certFile: .....
      # Get the password from the environment variable TLS_SERVER_PASSWORD. Note the env: prefix
      password: env:TLS_SERVER_PASSWORD 
         OR
      # Get the password from the absolute file path. Note the file: prefix
      password: file:/home/tls/password-file.txt 
         OR
      # Specify the actual password. Note the pass: prefix
      password: pass:actual_password 
} 

(We will not be supporting the openssl options fd: and stdin
 
 
While you can still specify the actual password in the password field using the pass: prefix, which casual users might want to do, you are also able to specify the file path or environment variable for more robust security.

This change will be backward compatible which means, you will still be able to specify the actual password in the password field without the pass: prefix. The "literal" prefix will continue to work as well. The passwordFile field will be deprecated and eventually removed when we to a major version.

 

Issue Links

• is duplicated by: DISPATCH-1435 Special handling of SSL password text is not documented nor consistent with SASL
• links to: GitHub Pull Request #582