8.8.3. Enabling Secure Connections to JBoss for Single-Node EKM Server (Optional)

Engineering Knowledge Manager

Installation Guide | Chapter 8: Installing a Front-End Web Server | 8.8. Overview of Client-Web Server Communications |

8.8.2. Enabling Secure Connections to the Web Server (Optional) |  | 8.9. Securely Connecting to EKM (Optional)
Prev |  | Next

### 8.8.3. Enabling Secure Connections to JBoss for Single-Node EKM Server (Optional)

This section applies only to single-node EKM servers.

Communications between the client browser and the application server (JBoss) can either be unencrypted (HTTP) or encrypted (HTTPS). In order to support encrypted connections, the application server must possess a signed Secure Sockets Layer (SSL)/TLS certificate (commonly referred to as a cert) and must be configured to enable encrypted connections over HTTPS.

#### 8.8.3.1. Creating and Installing a Test Certificate

In order to test the capability of connecting to the application server over HTTPS, a self-signed test SSL/TLS certificate can be installed on the application server and signed by the in-house Certificate Authority.

The steps for generating and installing a SSL/TLS certificate are as follows:

1. Generate a CSR (Certificate Signing Request) for the application server.

2. Sign the CSR with the local CA to produce a signed SSL/TLS certificate.

3. Install the signed certificate on the application server.

##### 8.8.3.1.1. Generating a Certificate Signing Request (CSR)

Follow the instructions below to generate a certificate signing request (CSR) on the EKM cluster node. User inputs are highlighted in bold.

1. Create the directory: `JBOSS_HOME/domain/configuration/keystore`

   The JBoss server’s private key and certificate will be stored in this directory.

2. In the `JBOSS_HOME/domain/configuration/keystore` directory, generate a private key for the application server:

       JBOSS_HOME/domain/configuration/keystore>openssl genrsa -out server.key 1024
       Loading 'screen' into random state - done
       Generating RSA private key, 1024 bit long modulus
       ............++++++
       ................++++++
       e is 65537 (0x10001)

   The `keystore` directory will now contain the private key for the JBoss server, in the file `server.key`.

3. In the `JBOSS_HOME/domain/configuration/keystore` directory, generate a CSR for the application server. When completed, the `keystore` directory will contain the CSR for the JBoss server in the file: `server.csr`:

       JBOSS_HOME/domain/configuration/keystore>openssl req -new -key server.key -out server.csr
       You are about to be asked to enter information that will be incorporated
       into your certificate request.
       What you are about to enter is what is called a Distinguished Name or a DN.
       There are quite a few fields but you can leave some blank
       For some fields there will be a default value,
       If you enter '.', the field will be left blank.
       -----
       Country Name (2 letter code) [AU]:Your Contry Code
       State or Province Name (full name) [Some-State]:Your State
       Locality Name (eg, city) []:Your Locality Name
       Organization Name (eg, company) [Internet Widgits Pty Ltd]:Your Organization Name
       Organizational Unit Name (eg, section) []:
       Common Name (eg, YOUR name) []:ekm.yourdomain.com
       Email Address []:
       Please enter the following 'extra' attributes
       to be sent with your certificate request
       A challenge password []:
       An optional company name []:

   Note: The Common Name is the host name that is used to connect to the application server. This is usually the Fully Qualified Domain Name (FQDN) of the server, for example: `ekm.yourdomain.com`. A certificate is valid only for the common name it is issued for; if the name that is used to connect to the `ekm` server is changed, then a new certificate for the new common name will need to be issued.

##### 8.8.3.1.2. Signing the CSR

Follow the instructions below to “sign” a certificate signing request (CSR). User inputs are highlighted in bold.

1. If necessary, copy the CSR file you created in the previous step into the requests directory of the in-house Certificate Authority.

2. Sign the Certificate Signing Request using the in-house Certificate Authority:

       C:\ssl>openssl x509 -req -days 1825 -in requests\server.csr -CA CA\CA.crt
        -CAkey CA\CA.key -CAcreateserial -out certs\server.crt
       Loading 'screen' into random state - done
       Signature ok
       subject=/CN=ekm.yourdomain.com/OU=none/O=Your Organization Name/L=Your
       Locality Name/ST=Your State/C=US
       Getting CA Private Key
       Enter pass phrase for CA\CA.key:

The self-signed SSL/TLS certificate produced by this command is named `server.crt` and is located in the `certs` directory of the in-house CA. This certificate is now ready to install on your application server.

##### 8.8.3.1.3. Installing the Certificate on the Application Server

Follow the instructions below to install a certificate on the JBoss application server. User inputs are highlighted in bold.

1. Copy the self-signed certificate to the `keystore` directory that was created for the application server in a previous step.

   Windows:

   `copy c:\ssl\certs\server.crt JBOSS_HOME\domain\configuration\keystore`

   Linux:

   `cp ssl/certs/server.crt JBOSS_HOME/domain/configuration/keystore`

2. Export the certificate to PKCS#12 format:

       JBOSS_HOME/domain/configuration/keystore>openssl pkcs12 -export -in server.crt
          -inkey server.key -out server.p12 -name default -CAfile c:\ssl\CA\CA.crt
       Loading 'screen' into random state - done
       Enter Export Password: <export password>
       Verifying - Enter Export Password:

   Remember the `<export password>` you entered – it will be needed later.

3. Create a Java keystore using the Java `keytool` and import the PKCS#12 certificate into the keystore:

       JBOSS_HOME/domain/configuration/keystore>keytool -importkeystore -deststorepass <secret password>
          -destkeypass <secret password> -destkeystore mycompany.com.jks -srckeystore server.p12
          -srcstoretype PKCS12 -srcstorepass <export password> -alias default

   Where:

   `<secret password>` is a secret password for the keystore.

   `<export password>` is the export password provided when the certificate was exported to PKCS#12 format.

   In the example above, the keystore file is created as: `mycompany.com.jks`. Substitute a filename appropriate for your deployment when creating the keystore.

4. Edit the JBoss host controller configuration:

   Add a `security-realm` child element named `SslRealm` to the `security-realms` element. This will be used to secure the HTTPS connection using the certificate in the keystore. See the example below in bold:

       <management>
         <security-realms>
         ...
         <security-realm name="SslRealm">
           <server-identities>
             <ssl>
               <keystore path="keystore/mycompany.com.jks" relative-to="jboss.server.config.dir"
                 keystore-password="secret password"/>
             </ssl>
           </server-identities>
         </security-realm>

   Provide the secret password for the keystore in the value of the `keystore-password` attribute in the `keystore` element.

5. Edit the JBoss domain Configuration:

   Add an HTTPS listener to the undertow subsystem. Undertow is the name of the built-in webserver of JBoss. See the example below in bold:

       <subsystem xmlns="urn:jboss:domain:undertow:1.2" instance-id="${jboss.server.name}">
       ...
         <server name="default-server">
           <ajp-listener name="ajp" socket-binding="ajp" max-post-size="0" max-parameters="5000"/>
           <http-listener name="default" socket-binding="http" max-post-size="0" max-parameters="5000"/>
           <https-listener name="https" socket-binding="https" security-realm="SslRealm"/>

6. Edit `EKM_HOME/conf/ekm.xml` and set the value of `ekmUrl` to the secure URL for EKM. If the value currently is:

       <ekmUrl>http://ekm.yourdomain.com/ekm:8080</ekmUrl>

   Change it to:

       <ekmUrl>https://ekm.yourdomain.com/ekm:8443</ekmUrl>

   Note: If the cluster node uses a JBoss port offset other than the default 0, adjust the port numbers in the URL accordingly.

7. Start the cluster node.

Contains proprietary and confidential information of ANSYS, Inc. and its subsidiaries and affiliates.

Prev | Up / Contents | Next

Release 18.2 - © ANSYS, Inc. All rights reserved.