| Table of Contents | ||||
|---|---|---|---|---|
|
Description
Debbie is a tool used to validate certificates and signatures. Its REST interface allows an easy way to obtain a JSON response that indicates if a signature is valid and if it complies with a validation policy.
Its services can be configured to respond over an HTTP or HTTPS protocol.
Debbie runs over any JVM 1.8 and can be configured to run as a service on Windows or Linux OS.
Also, a Docker distribution is available.
Connectivity
To perform the certificates status validation, and depending on the elements and policies that are configured, Debbie requires access to the services provided by a Certificate Authority.
These services are usually accessible through HTTP, both for the publication of the List of Revoked Certificates (CRL) and for OCSP (Online Certificate Status Protocol) services. It is convenient that you consider this need.
Service & Policy
Debbie responds to the requests in each of the URLs defined in its configuration files. Each defined policy must have its own unique URL, and there cannot be a defined URL within another.
At least one policy must be defined so that the service can be started.
CertiSur, to perform tests of the service, makes available the following URL where the service can be accessed:
https://homo-debbie.certisur.com:4443/<tenant>
Step 1- Download Docker image
In order to download the images, the user must be registered in the aforesaid platform. Contact CertiSur to request access, and inform the Docker Hub profile to grant access to the docker image.
Login using a Docker Hub account:
| Code Block | ||||||
|---|---|---|---|---|---|---|
| ||||||
# docker login -u <docker hub account> Password: WARNING! Your password will be stored unencrypted in /root/.docker/config.json. Configure a credential helper to remove this warning. See https://docs.docker.com/engine/reference/commandline/login/#credentials-store Login Succeeded |
| Info | ||
|---|---|---|
| ||
You have to inform your docker hub account in order to authorize to download the package. Send an email to support@certisur.com. |
| Note | ||
|---|---|---|
| ||
It is possible to save the user’s credentials so as to login safely following the steps on this link(https://docs.docker.com/engine/reference/commandline/login/#credentials-store). |
Step 2- Pulling an image from Docker
| Code Block | ||||||
|---|---|---|---|---|---|---|
| ||||||
# docker pull certisursa/debbie:latest latest: Pulling from certisursa/debbie a02a4930cb5d: Pull complete b5ffff9dbcda: Pull complete ... 7e5f58de12ac: Pull complete Digest: sha256:332ee89371399b7c6235465beb00fbd2071868fecee33fc14d04b87ba99b265d Status: Downloaded newer image for certisursa/debbie:latest docker.io/certisursa/debbie:latest |
Step 3- Run debbie docker image
To run debbie container you have to execute the following command line:
| Code Block | ||||||
|---|---|---|---|---|---|---|
| ||||||
# docker run -d \ -it \ -p <external_port>:8080 \ -v <debbie_config_folder>:/app/config/ \ -v <debbie_log_folder>:/app/log/ \ -v <debbie_doc_repository_folder>:/app/repository/ \ debbie |
It is necessary to overwrite the directory where the configuration of the tenants is located. The volume configuration explained below.
Volumes
The following volumes must be mounted on the Docker image to overwrite the variables of each defined tenant.
| Source (host) | Path (container) | Description |
|---|---|---|
| /home/opera/docker/debbie/config | /app/config | configuration files |
| /home/opera/docker/debbie/log | /app/log | log files |
| /home/opera/docker/debbie/repository | /app/repository | doc repository |
Step 4- Test debbie
Execute the following command to run default debbie docker container
| Code Block | ||||||
|---|---|---|---|---|---|---|
| ||||||
# docker run -d \ -it \ --name debbie \ -p 8080:8080 \ certisursa/debbie:latest |
Open your browser pointing to localhost:8080 (or the port defined by you) to access the URL where you published your Debbie installation. You'll see the following image.
| If you can see this image means that you have Debbie running into your docker container. |
|
| Info | ||
|---|---|---|
| ||
Debbie docker image includes an ACME tenant inside. You must overwrite that definition to include your own company or project tenants. |
After you have Debbie running on your own container, you can add a custom tenant following the next steps:
Step 5- Download a custom example (looney) and customize
Download the files from the following link looney-validation-demo.tgz.
| Code Block | ||||||||
|---|---|---|---|---|---|---|---|---|
| ||||||||
├── debbie │ ├── config │ │ ├── certstore │ │ │ ├── CertiSur.root.ClassB.G1.pilot.509.cer │ │ │ └── CertiSur.shared.ClassB.G1.pilot.509.cer │ │ ├── debbie.json │ │ ├── debbielog.properties │ │ └── policies │ │ └── looney.policy.json │ ├── logs │ └── repository └── docker-compose.yml |
Configure your docker-compose file to mount the following volumes.
| External directory | Container directory |
|---|---|
./debbie/config | /app/config |
./debbie/repository | /app/repository |
./debbie/logs | /app/log |
Note: ./debbie/config external directory is the directory included in the example tenant config file (looney-validation-demo.tgz) that you downloaded and stored on your local computer.
Step 6- Configure docker-compose.yml and restart the container
Use the previous variables and volume mappings to define the new configuration, in this example as a docker_compose.yml file.
| Code Block | ||||||
|---|---|---|---|---|---|---|
| ||||||
version: '3'
services:
debbie:
image: certisursa/debbie:latest
volumes:
- "./debbie/config:/app/config"
- "./debbie/repository:/app/repository"
- "./debbie/logs:/app/log"
ports:
- 8081:8080
|
Launch the container from a shell
| Code Block | ||||
|---|---|---|---|---|
| ||||
> docker-compose --verbose -f docker-compose.yml up -d |
Open your browser pointing to localhost:8081 (or the port defined by you) to access the URL where you published your Debbie installation. You'll see the following image.
| If you can see this image means that you have Debbie running into your docker container. |
|
