High Security
The following examples provide a high level of security. All communication between the EMS and LSR are encrypted and require basic authentication to be accessed. The examples use a custom certificate and private key. The certificate is validated against a custom CA list. This configuration disallows self-signed certificates. This configuration is the recommended configuration for all production systems.
To learn about encrypting passwords and passphrases, refer to Protecting Data with Encryption.
Highly Secure Configuration: Authentication, Validation, and Custom Certificate / Key
EMS — config.json
LSR — config.lua
"http_server": {
"host": "localhost",
"port": 8000,
"ssl": true,
"certificate":
"/pathto/cert/file.pem",
"private_key":
"/pathto/private/key.pem",
"passphrase": "some_encrypted_passphrase",
"authenticate": true,
"user": "emsuser",
"password": "some_encrypted_password"
},
"certificates": {
"validate": true,
"allow_self_signed": false,
"cert_chain" :
"/path/to/ca/cert/list.pem"
"http_client_ca_certs"" "/path/to/ca/cert/client_list.pem"
"fingerprint_allowlist" : [
"E6:EF:5D:37:22:FC:EF:EA:4B:22:92:45:BD:49:D2:29:3D:
84:19:BC:C3:45:23:A1:22:A4:01:20:9D:03:E6:47",
"D1:BA:B0:17:66:6D:7F:42:7B:91:1E:22:7E:3A:27:D2:EF:
5D:37:22:FC:EF:EA:4B:22:92:45:BD:01:7E:92:52"
}
-- EMS Connection Configuration
scripts.rap_host = "localhost"
scripts.rap_port = 8000

-- EMS Connection TLS Configuration
scripts.rap_ssl = true
scripts.rap_deny_selfsigned = true
scripts.rap_validate = true
scripts.rap_cert_file =
"/path/to/ca/cert/list.pem"

-- EMS Connection Authentication
-- Configuration
scripts.rap_server_authenticate = true
scripts.rap_userid = "emsuser"
scripts.rap_password = "some_encrypted_password"

-- HTTP Server Configuration
scripts.script_resource_host = "localhost"
scripts.script_resource_port = 8001

-- HTTP Server TLS Configuration
scripts.script_resource_ssl = true
scripts.script_resource_certificate_chain =
"/path/to/web/server/certificate.pem"
scripts.script_resource_private_key =
"/path/to/web/server/private/key.pem"
scripts.script_resource_passphrase = "some_encrypted_passphrase"

-- HTTP Server Authentication
-- Configuration
scripts.script_resource_authenticate = true
scripts.script_resource_userid = "luauser"
scripts.script_resource_password = "some_encrypted_password"
Was this helpful?