CENM Signer Helm chart

This Helm chart is to configure, deploy and run CENM Signing service.

As the initial step this chart runs automatically PKI tool which creates and stores certificates necessary for correct Corda Network operation. By default the certificates have sample X.500 subject names (e.g. Identity Manager certificate has the subject name “CN=Test Identity Manager Service Certificate, OU=HQ, O=HoldCo LLC, L=New York, C=US”). The subject name can be set by configuration options starting with pki.certificates. prefix.

For more information about PKI Tool and Certificate Hierarchy refer to:

• Certificate Hierarchy Guide
• PKI Tool

Example usage

Using default values:

helm install signer signer

Overwriting default values with password for SSH console:

helm install signer signer --set shell.password="superDifficultPassword"

Parameters starting with prefix “pki.certificates.” allow to override the default subject/issuer X500 names of the Corda certificates. The example command to bootstrap Signer with the X500 name “CN=Company A TLS Signer Certificate […]” of the subject and the issuer of the certificate for signing the CRL:

helm install signer signer --set idmanPublicIP=13.71.57.219 --set pki.certificates.tlscrlsigner.subject="CN=Company A TLS Signer Certificate\, OU=HQ\, O=HoldCo LLC\, L=London\, C=UK" --set pki.certificates.tlscrlsigner.crl.issuer="CN=Company A TLS Signer Certificate\, OU=Corda\, O=R3 HoldCo LLC\, L=New York\, C=US"

The name needs to be a valid X500 name and commas need to be escaped by backslash ().

Configuration variables