Modifying Your Crypto Configuration for a Production System

While the out-of-the-box (OOTB) crypto settings are adequate for typical development or test environments, they should be modified for production environments to protect and provide isolation between these relatively low-risk environments and high-risk production environments.

Some typical changes to the OOTB crypto configuration, in preparation for production, might include:

• Providing a new secret key.
  • Such a key can be generated using the JDK keytool utility; see How to Create a New Keystore
    • This secret key should be stored in a separate keystore.
    • The properties for these secret key changes would be as described in Key Management.
• Providing new digest settings
  • New digest settings can include a new salt, iteration count, and/or algorithm.
    • The properties for these digest changes would be as described in Cúram Digest Settings and How to Specify a Digest Salt and the process described in How to Utilize the Superseded Digest Settings for a Period of Migration.

Remember to keep your configuration files isolated from personnel who do not absolutely have to access; specifically, keeping development, test, and production configuration information isolated.