openquantumsafe/openlitespeed repository overview

⁠Purpose

This is an OpenLiteSpeed⁠ docker image building on OQS-BoringSSL⁠, which allows OpenLiteSpeed to negotiate quantum-safe keys in TLS 1.3.

⁠Quick start

Assuming Docker is installed⁠ the following command

docker network create lsws-test
docker run --network lsws-test --name lsws -it openquantumsafe/openlitespeed bash

will run the container for the quantum-safe crypto (QSC) protected OpenLiteSpeed server on the docker network called lsws-test.

Run the serverstart.sh script, /root/serverstart.sh, to generate certificate and key files and to start the server.

To start the server, run /usr/local/lsws/bin/lswsctrl start. For more commands, run /usr/local/lsws/bin/lswsctrl help

The document root is /usr/local/lsws/Example/html/

The CA.crt file is hosted on port 80 and QUIC is enabled on port 443.

⁠What is WebAdmin Console?

It is a GUI interface which makes OpenLiteSpeed configuration so much easier. It uses port 7080.

The WebAdmin Console can be accessed through your-server-ip:7080 For example 172.17.0.2:7080 Run ifconfig to find your IP address.

To get your WebAdmin Console username and password, run cat /usr/local/lsws/adminpasswd To reset your WebAdmin Console credentials, run /usr/local/lsws/admin/misc/admpass.sh

⁠Client

Assuming Docker is installed⁠ the following command

docker run --network lsws-test  --name client -it openquantumsafe/msquic-reach bash

will run the container on the docker network called lsws-test (assuming it has already been created. If not, run docker network create lsws-test).

The CA certificate should first be downloaded from the server with

wget <address>/CA.crt

For example, wget lsws/CA.crt

To interact with the openlitespeed server, run

SSL_CERT_FILE=CA.crt quicreach <address> --port <port> --stats

For example, SSL_CERT_FILE=CA.crt quicreach lsws --port 443 --stats

The environment variable SSL_CERT_FILE should point to the location of the downloaded CA.crt. The address and port should correspond to those of the openlitespeed server.

In order to change the list of algorithms, simply set the environment variable "TLS_DEFAULT_GROUPS" to a list of desired algorithms.

See list of quantum-safe key exchange algorithms which the OpenLiteSpeed server supports here⁠.

For example,

SSL_CERT_FILE=CA.crt TLS_DEFAULT_GROUPS=kyber768:kyber512 quicreach <address> --port <port>

For more options, run quicreach --help

⁠List of supported key exchange algorithms

See list of supported quantum-safe key exchange algorithms here⁠

⁠Disclaimer

THIS IS NOT FIT FOR PRODUCTION USE⁠.