Is there a way a spring cloud config client can decrypt cipher text fetched from a config server? -

our config server relatively insecure , handful of clients need encrypted properties. ideally, want server have public key , each client can use private key decryption. trouble default, config server attempt decrypt cipher text you. prevent that, disabled default behavior so:

@springbootapplication(exclude = encryptionautoconfiguration.class) @enableconfigserver public class configserverapplication {      public static void main(string[] args) {         springapplication.run(configserverapplication.class, args);     } } 

now when client application fetches properties config server, gets this:

      "source": {         "username": foobar,         "password": "{cipher}cibnmk+y3zlsxhvgajmaiunylqo3p0e..."       } 

i've implemented textencrypter bean , tested make sure works on client. on client application startup, expect environmentdecryptapplicationinitializer class process client's local bootstrap , application properties fetched config server. see client's local files considered. if cipher text present in local bootstrap.yml, gets decrypted. however, if cipher text comes config server, not decrypted. there way include properties fetched config server well?

this super simple do. according issue:

https://github.com/spring-cloud/spring-cloud-config/issues/365

all have configure cloud config client cloud config server. means is, if using symmetric encryption have

1.) add following application.properties on spring cloud config server server not decrypt properties before sending client:

spring.cloud.config.server.encrypt.enabled=false 

2.) on spring cloud config client, need add encryption key bootstrap.properties file:

encrypt.key=supersecretpassword 

that's it. properties decrypted when read client.

for asymetric encryption i'd assume can same adding symetric key properties bootstrap.properties file on client:

encrypt.keystore.location:classpath:/server.jks encrypt.keystore.password:letmein encrypt.keystore.alias:mytestkey encrypt.keystore.secret:changeme