Certificates and HCL Commerce GraphQL server

The HCL Commerce GraphQL application behaves as a server when it receives graphql requests over HTTP or HTTPS (or both), and as a client when it calls REST services provided by other servers, again over HTTP or HTTPS. When serving over HTTPS the application should be configured to use an appropriate TLS server/ key pair, and when acting as a client to trust the certificates used by the servers it connects with.

For development, demonstration, or test reasons, it may be necessary to temporarily run the application via HTTPS without configuring certificates.

If no self-signed key/certificate pair is set, the GraphQL server will fall back to a pre-supplied self-signed key/certificate pair. The server's opts.yaml configuration file contains the fallback key and certificate.

GraphQL can be used as a client without validating whether the certificates of the servers it connects to are trusted. The -k command option or the –tlsNoValidate long form option allow this behaviour.

When deploying into production, avoid these configuration options and instead use certificates and keys managed as part of a comprehensive site security plan.