diff --git a/_includes/snippets/oidc/certificates.md b/_includes/snippets/oidc/certificates.md deleted file mode 100644 index bd7e1361..00000000 --- a/_includes/snippets/oidc/certificates.md +++ /dev/null @@ -1,8 +0,0 @@ -{% capture ssl %} -``` -openssl req -nodes -x509 -days 365 -newkey rsa:2048 -keyout private.pem -out public.crt -``` -{% endcapture %} -
-{{ ssl | markdownify }} -
diff --git a/_pages/oidc/certificates.md b/_pages/oidc/certificates.md index 879e4dbc..896c416f 100644 --- a/_pages/oidc/certificates.md +++ b/_pages/oidc/certificates.md @@ -24,6 +24,8 @@ sidenav: Login.gov's public key, used to verify signed JWTs (such as the `id_token`), is available in [JWK](https://tools.ietf.org/html/rfc7517){:class="usa-link--external"} format at the `/api/openid_connect/certs` endpoint. This public key is rotated periodically (on at least an annual basis). It is important to assume the `/api/openid_connect/certs` endpoint could contain multiple JWKs when rotating application signing keys. Be sure to use the JWK endpoint dynamically through [auto-discovery](/oidc/getting-started/#auto-discovery) rather than hardcoding the public key. This ensures that your application will not require manual intervention when the Login.gov public key is rotated. + +For your own public/private keypair used to sign your JWT, please refer to the [Creating a public certificate](/testing/#creating-a-public-certificate) section of our Testing documentation. {% endcapture %}
@@ -31,11 +33,5 @@ This public key is rotated periodically (on at least an annual basis). It is imp {{ content | markdownify }} Next step: Logout
-
-
- OpenSSL Command - {% include snippets/oidc/certificates.md %} -
-
- Next step: Logout + Next step: Logout diff --git a/_pages/oidc/getting-started.md b/_pages/oidc/getting-started.md index 8b1b1b1c..ffb56f12 100644 --- a/_pages/oidc/getting-started.md +++ b/_pages/oidc/getting-started.md @@ -60,7 +60,7 @@ You are able to test authentication methods in real time with a testing account If you chose to integrate your app using the OIDC private_key_jwt protocol, you will need to create a private key that will be used to sign your request to our token endpoint, and a corresponding public certificate that you will upload to your app in the Partner Portal. Login.gov will use your public certificate to verify the signature in your request. -More details on how to create this public/private keypair are available in the [Creating a public certificate](https://developers.login.gov/testing/#creating-a-public-certificate) section of our Testing documentation. +More details on how to create this public/private keypair are available in the [Creating a public certificate](/testing/#creating-a-public-certificate) section of our Testing documentation. ### Auto-discovery diff --git a/_pages/production.md b/_pages/production.md index c307b7bb..f3fb4485 100644 --- a/_pages/production.md +++ b/_pages/production.md @@ -51,6 +51,11 @@ Make sure you have the following items ready before you start the deployment pro - You must include an agency logo for your application. [Learn more about our logo guidelines.](/user-experience/agency-logo/) +- A public certificate that adheres to these standard best practices: + - Expiration date of 1 to 3 years depending on use and risk factors (see [NIST 800-57 Part 1 Rev. 5](https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-57pt1r5.pdf)). We recommend 1 year or less to be on the safe side. + - Positive serial number at least 16 characters in length + - Signed by a trusted Certificate Authority + Depending on your agency’s integration additional items may be needed: - **If this is a SAML integration (not OpenID Connect), then please ensure that:** diff --git a/_pages/testing.md b/_pages/testing.md index 79c33f8b..94892050 100644 --- a/_pages/testing.md +++ b/_pages/testing.md @@ -73,7 +73,7 @@ Login.gov does not manage user accounts. If you have lost access to a team: ### Creating a public certificate -You can use the following OpenSSL command to generate a self-signed 2048-bit PEM-encoded public certificate for your testing/sandbox application (with a 1-year validity period). Self-signed certificates should be for testing/sandbox purposes only. We recommend using Certificate Authority (CA) issued certificates for your production integration. +You can use the following OpenSSL command to generate a self-signed 2048-bit PEM-encoded public certificate for your testing/sandbox application (with a 1-year validity period). Self-signed certificates should be for testing/sandbox purposes only. **For security reasons, we highly recommend using Certificate Authority (CA) issued certificates for your production integration.** ``` openssl req -nodes -x509 -days 365 -newkey rsa:2048 -keyout private.pem -out public.crt