How Flowable Engine can perform https calls and sending SSL certificate and key

Flowable Engine
1

Hi,

We have a Flowable model that perform https call to another Spring Boot application.
That Spring Boot application have the necessary trusted stored setup to enforce the security. The API have been tested with Postman by setting the CRT and Private Key. Therefore I know that part is working.

Although it is not clear, from the Flowable Engine how to send our Certificate (.crt) with the private key to allow the Flowable Engine to securely perform the https call to that external system.

Perhaps there is some additional configuration required in the flowable.cfg.xml?

Thank you.

2

In order to configure and https listener for your api that can be connected to by a flowable consumer or any other consumer you’ll need to provide a bit more information.

Is the certificate being used by your API to provide an https connection a self signed certificate? If so, then you’ll need to ensure that the public key of either the self signed cert, or the private CA that issued it, is added to the cacerts of the JVM being used by your flowable app.

There should be no private key required by the flowable consumer. If your API is configured correctly then all that flowable, or any other consumer for that matter, would need is the public key of the self signed cert or the CA that issued the cert your API is using to be configured in the cacerts of the JVM being used by your flowable app.

Providing the related errors from the Catalina.out file would also be helpful in debugging your issue

3

I believe he’s asking where do you configure the private key location in flowable config (of the Spring boot app) so the http REST activity does https. Not so much on what the consumer needs.

4

Thank you for your response. Sorry if my request was not clear enough. Please check railrhoad comment above. This is exactly what we want to do. It is unclear how to configure the private key location.

5

Hi,

Currently the following configuration is supported:

https://flowable.org/docs/userguide/index.html#bpmnHttpTaskClientConfiguration

The HttpClientConfig can be extended to also support two-way SSL and support adding a certificate and key store. This would be a good new feature.

In the meantime you can add a http request handler to the http service task and customise the HttpClient as needed:

This is an example BPMN XML file:

Best regards,

Tijs

6

Hi,

Do you have a specific example from the modeler on how to call another systems using https REST and sending the necessary CRT and Key file (like I does from Postman)?

Perhaps I am missing something here. I am new to Flowable.

I thought it would have make sense to add some code to HttpActivityBehaviorImpl something like below:

    if (config.isSslConnection())
    {
        try {
            // Trusted CA keystore
            KeyStore tks = KeyStore.getInstance(config.getCaKeyStoreType());
            InputStream tksInputStream = this.getClass().getClassLoader().getResourceAsStream(config.getCaKeyStorePath());
            tks.load(tksInputStream, config.getCaKeyStorePassword().toCharArray());

            // Client keystore
            KeyStore cks = KeyStore.getInstance(config.getClientKeyStoreType());
            InputStream cksInputStream = this.getClass().getClassLoader().getResourceAsStream(config.getClientKeyStorePath());
            cks.load(cksInputStream, config.getClientKeyStorePassword().toCharArray());

            SSLContext sslcontext = SSLContexts.custom()
                    .loadTrustMaterial(tks, new TrustSelfSignedStrategy())
                    .loadKeyMaterial(cks, config.getClientKeyStorePassword().toCharArray())
                    .build();
            httpClientBuilder.setSSLSocketFactory(
                    new SSLConnectionSocketFactory(sslcontext, new HostnameVerifier() {
                        @Override
                        public boolean verify(String s, SSLSession sslSession) {
                            return true;
                        }
                    })
            ).setSSLContext(sslcontext).build();
        } catch (Exception e) {
            LOGGER.error("Could not configure HTTP client SSL self signed strategy", e);
        }
    }
7

HI tijis ,
Httprequesthandler class can reside in any module as long as HttpRequestHandler interface is being implemented ?
I created handler in my project but whatever proxy i am setting in httpclient that is not getting reflected in HttpActivityExecutor class.
code is failing because of proxy .