2

Recently I ran into the problem of generating a custom certificate that does not bind to 0.0.0.0 in Neo4j. It turns out that Neo4j - in contrast to the documentation - expects DER certificates for both the public and private key.

I will post lessons learned in respons to this question.

Rob

rvaneijk
  • 663
  • 6
  • 20

2 Answers2

2

As of 3.0 this has been changed.

  • Open up /etc/neo4j/neo4j.conf and uncomment and change the following line:

      # dbms.directories.certificates=/PATH/TO/YOUR/CERTIFICATES

  • Make sure that directory contains you certificate files named neo4j.key and neo4j.cert.

  • Make sure the files can be written by neo4j.

If you're using only .pem files, you can just rename those to .cert and .key, they're all plain text files, .pem is just an extension.

See the reference

Directory for storing certificates to be used by Neo4j for TLS connections.

Certificates are stored in the certificates directory, and are called neo4j.key and neo4j.cert.

Community
  • 1
  • 1
Tieme
  • 62,602
  • 20
  • 102
  • 156
1

sudo vi /etc/neo4j/neo4j-server.properties 

uncomment org.neo4j.server.webserver.address=0.0.0.0
check: org.neo4j.server.webserver.https.enabled=true
check: org.neo4j.server.webserver.https.port=7473
change: org.neo4j.server.webserver.https.cert.location=/var/ssl/neo4j/server.crt
change: org.neo4j.server.webserver.https.key.location=/var/ssl/neo4j/server.key

now set up access to https note: both the private key and the certificate need to be in DER format

openssl genrsa -des3 -out ca.key 4096
openssl req -new -x509 -days 365 -key ca.key -out ca.pem
openssl genrsa -des3 -out server.key 4096
openssl req -new -key server.key -out server.csr
openssl x509 -req -days 365 -in server.csr -CA ca.pem -CAkey ca.key -set_serial 01 -out server.pem
sudo mkdir -p /var/ssl/neo4j
sudo openssl x509 -outform der -in server.pem -out /var/ssl/neo4j/server.crt
sudo openssl rsa -in server.key -inform PEM -out /var/ssl/neo4j/server.key -outform DER

See also [my notes] (http://www.blaeu.com/nl/doku.php/Notes)

rvaneijk
  • 663
  • 6
  • 20
  • note: make sure the COMMON NAME is the same as the server's ip address, or DNS name. – rvaneijk Apr 18 '15 at 11:45
  • You can have server.csr signed by any Certificate Authority. In that case skip line 1, 2, 5. Just use server.csr. After signing, rename the signed certificate to server.pem and continue from line 6. – rvaneijk Apr 19 '15 at 20:44
  • See also [use SSL certificates in Neo4j](http://stackoverflow.com/questions/29735738/how-to-use-ssl-certificates-in-neo4j-instead-of-self-signed-certificates-or-sna) – rvaneijk Apr 19 '15 at 20:57
  • I get `Caused by: java.io.IOException: Unrecognized private key format.` with neo4j 4.0.4. – gkcn May 18 '20 at 23:26