Spring-cloud-config: Is there a way a spring cloud config client can decrypt cipher text fetched from git repository when config server is down?

[jgawli]

We have added a mechanism for Spring Config Client to get properties from Git repository if Config Server is down but don't know how to decrypt cipher text from properties files on Config Client.

[dsyer]

Client side decryption is a feature of spring-cloud-commons. You should be able to configure the client in the same way as the server. It's covered in the user guide.

[lipinggm]

The user guide doesn't provide detail information about config server client cipher decryption

[dsyer]

Yes it does: http://cloud.spring.io/spring-cloud-static/spring-cloud.html#_encryption_and_decryption_2. We can always improve and add more material, and contributions are always gratefully accepted, but it totally has everything you need to know to configure a key.

[lipinggm]

Thank you @dsyer ! It finally works. Here is the lesson I learned:

1. Configure keystore correctly (same as you did for Config Server). I used window's absolute path to the keystore location for my local test, somehow the boot applicatioin doesn't find the jks file (I debug into Spring Boot code and find out the location value somehow gets altered)
   encrypt.keyStore.location=classpath:/xxx.jks
   encrypt.keyStore.password=xxx
   encrypt.keyStore.alias=xxx
   encrypt.keyStore.secret=xxx
2. Make sure to add the following dependency into your Config Server Client pom.xml file

            <dependency>
      <groupId>org.springframework.security</groupId>
      <artifactId>spring-security-rsa</artifactId>
  </dependency>

Thank you for your help!

[iPhotoner]

i used spring cloud finchley sr2,the keypass and the store pass allowed to be different,client side just add dependency:spring-cloud-starter-config,no need to add keystore information config,it works.