Enable HTTPS with your own certificate and TLS to your databases

openssl genrsa -out ca.key 4096
openssl req -x509 -new -nodes -key ca.key -sha256 -days 1825 -out ca.crt \
  -subj "/C=IT/O=Lab Example Org/CN=Lab Example Internal CA" \
  -addext "basicConstraints=critical,CA:TRUE" \
  -addext "keyUsage=critical,keyCertSign,cRLSign"

openssl genrsa -out gluesync.key 2048
openssl req -new -key gluesync.key -out gluesync.csr \
  -subj "/C=IT/O=Lab Example Org/CN=gluesync.lab.test"

printf 'basicConstraints=CA:FALSE\nkeyUsage=critical,digitalSignature,keyEncipherment\nextendedKeyUsage=serverAuth\nsubjectAltName=DNS:gluesync.lab.test,DNS:gluesync,DNS:localhost,IP:127.0.0.1\n' > gluesync.ext
openssl x509 -req -in gluesync.csr -CA ca.crt -CAkey ca.key -CAcreateserial \
  -out gluesync.crt -days 825 -sha256 -extfile gluesync.ext

openssl pkcs12 -export -name gluesync \
  -in gluesync.crt -certfile ca.crt -inkey gluesync.key \
  -out gluesync.p12

keytool -list -keystore gluesync.p12 -storetype PKCS12

{
  "ssl": {
    "sslCertificatePath": "/opt/gluesync/shared/gluesync.p12",
    "certificateAlias": "gluesync",
    "certificatePassword": "<keystore password>",
    "certificateKeyPassword": "<keystore password>"
  },
  "dh": {
    "diffieHellmanPassword": "gluesync-password",
    "salt": "gluesync-salt"
  }
}

docker compose exec gluesync-core-hub keytool -printcert -sslserver localhost:1717

openssl pkcs12 -in gluesync.p12 -clcerts -nokeys -out gluesync-cert.pem
openssl pkcs12 -in gluesync.p12 -nocerts -nodes -out gluesync-key.pem

grep -c "BEGIN PRIVATE KEY" gluesync-key.pem     # 1
grep -c "ENCRYPTED" gluesync-key.pem             # 0

cp gluesync-cert.pem gluesync-key.pem /path/to/kit/shared/
docker compose restart reverse-proxy

openssl s_client -connect gluesync.lab.test:443 -servername gluesync.lab.test \
  -CAfile ca.crt -verify_hostname gluesync.lab.test < /dev/null 2>&1 \
  | grep -E "Verification|Protocol|Verify return"

http:
  serversTransports:
    corehub:
      serverName: gluesync.lab.test
      rootCAs:
        - /etc/traefik/ca.crt

keytool -importcert -alias lab-ca -file ca.crt \
  -keystore truststore.jks -storepass <trust store password> -noprompt

keytool -list -keystore truststore.jks -storepass <trust store password>

mkdir mysql-certs
openssl genrsa -out mysql-certs/mysql.key 2048
openssl req -new -key mysql-certs/mysql.key -out mysql-certs/mysql.csr -subj "/C=IT/O=Lab Example Org/CN=mysql-tls"
printf 'basicConstraints=CA:FALSE\nkeyUsage=critical,digitalSignature,keyEncipherment\nextendedKeyUsage=serverAuth\nsubjectAltName=DNS:mysql-tls\n' > mysql-certs/mysql.ext
openssl x509 -req -in mysql-certs/mysql.csr -CA ca.crt -CAkey ca.key -CAcreateserial -out mysql-certs/mysql.crt -days 825 -sha256 -extfile mysql-certs/mysql.ext
cp ca.crt mysql-certs/ca.crt && chmod 644 mysql-certs/*

cat > mysql-init.sql <<'SQL'
CREATE DATABASE IF NOT EXISTS shop;
CREATE USER 'gluesync'@'%' IDENTIFIED BY 'password' REQUIRE SSL;
GRANT ALL ON *.* TO 'gluesync'@'%';
CREATE TABLE shop.customers (id INT PRIMARY KEY, full_name VARCHAR(100), country CHAR(2));
INSERT INTO shop.customers VALUES (1,'Anna Rossi','IT'),(2,'Hans Meier','DE'),(3,'John Smith','US');
SQL

docker run -d --name mysql-tls --network gluesync-net --network-alias mysql-tls \
  -e MYSQL_ROOT_PASSWORD=<root password> \
  -v "$PWD/mysql-certs:/certs:ro" -v "$PWD/mysql-init.sql:/docker-entrypoint-initdb.d/init.sql:ro" \
  mysql:8.0.37 --ssl-ca=/certs/ca.crt --ssl-cert=/certs/mysql.crt --ssl-key=/certs/mysql.key \
  --require_secure_transport=ON --server-id=1 --log-bin=mysql-bin --binlog-format=ROW

docker exec mysql-tls mysql -uroot -p<root password> --ssl-mode=REQUIRED \
  -e "select t.processlist_user, s.variable_value as ssl_version from performance_schema.status_by_thread s join performance_schema.threads t using(thread_id) where s.variable_name='Ssl_version' and t.processlist_user='gluesync'"

openssl s_client -connect <ibm i host>:9471 -showcerts < /dev/null 2>/dev/null \
  | awk '/BEGIN CERT/{n++} n==2{print} /END CERT/{if(n==2) exit}' > ibmi-ca.pem
openssl x509 -in ibmi-ca.pem -noout -subject -ext basicConstraints

keytool -importcert -alias ibmi-ca -file ibmi-ca.pem \
  -keystore ibmi-truststore.jks -storepass <trust store password> -noprompt

services:
  gluesync-core-hub:
    environment:
      - SSL_ENABLED=true
      - GS_LEGACY_TLS=1