Securing the Stormshield KMaaS with HTTPS

To secure your Stormshield KMaaS, Stormshield recommends that you:

  • Secure connections between the Stormshield KMaaS components with HTTPS.
    In the config.json file, fill-in the https.credentials section.
    For more information, refer to section https parameter.
  • Configure the appropriate TLS ciphers.
    For more information, refer to section Configuring TLS ciphers below.

When the Stormshield KMaaS is configured in HTTPS, it uses NodeJS which depends on OpenSSL for cryptographic operations.

In RPM mode, by default, the service starts with the following cipher list:

TLS 1.3

  • TLS_AES_256_GCM_SHA384

  • TLS_AES_128_GCM_SHA256

  • TLS_AES_128_CCM_SHA256

  • TLS_CHACHA20_POLY1305_SHA256

TLS 1.2

  • ECDHE-ECDSA-AES256-GCM-SHA384

  • ECDHE-RSA-AES128-GCM-SHA256

  • ECDHE-RSA-AES256-GCM-SHA384

In Docker mode, the default cipher list is the same as NodeJS 24. This version is based on OpenSSL version 3.5, with a higher security level than in RPM mode (i.e., NodeJS 20 and OpenSSL 3.2).

To communicate more securely when using the Stormshield KMaaS, you can restrict the list of ciphers allowed during TLS operations.

The ciphers used are important security elements. Refer to ANSSI documentation SDE-NT-35 on TLS ciphers.

Note that if you use SELinux to secure the machines, the list of TLS algorithms allowed on the machine may change. This may prevent the Stormshield Key Management as a service from starting or cause incompatibility with external resource retrieval. In this case, you must adjust the list of algorithms allowed by the Stormshield Key Management as a service by following the procedure below.

Modifying the list of TLS ciphers in Docker mode

  • Declare the NODE_OPTIONS environment variable:

    NODE_OPTIONS=--tls-cipher-list=<list-of-tls-algorithms>

    EXAMPLE
    docker run -e "NODE_OPTIONS=--tls-cipher-list=TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384" stormshield/kmaas:<version>

Modifying the TLS cipher list in RPM mode

  1. Add the cipher_list.conf file in the /etc/systemd/system/cse.service.d directory.

  2. Add the following lines in this file:

    [Service]
    Environment=NODE_OPTIONS=--tls-cipher-list=#CUSTOM_CIPHER_LIST#

    - where -

    #CUSTOM_CIPHER_LIST# represents the list of the desired ciphers, separated by ":".

    EXAMPLE
    [Service]
    Environment=NODE_OPTIONS=--tls-cipher-list=TLS_AES_128_GCM_SHA256:TLS_AES_256_GCM_SHA384:

    The cipher format must match the following rules:

    • The Stormshield KMaaS does not support the following cryptographic suites, nor the "!", "+", and "-" operators.

    • You must use the OpenSSL cipher format, and not the standard format.
      To list ciphers with both their standard names and OpenSSL names, run the command:
      openssl ciphers -stdname.
      To convert a standard cipher name to the OpenSSL format, run the command:
      openssl ciphers -convert STANDARD_CIPHER_NAME_TO_CONVERT.

  3. If the list contains valid but not recommended ciphers, a warning log is issued. If a cipher is unknown, an error is issued and the service does not start.