Enabling HTTPS Connectivity for Nodes

The default certificate presented by the application server uses localhost.localdomain. This works only for local node installations (server and node on a single host).

Note.

• You can use the default certificate - remember that you may need to use the ./node_add_ssl_cert.sh script after future updates to refresh the certificate on the node

• Default password for our keystore is changeit

• For the default certificate - jump to the Node configuration and use the localhost.localdomain instead of the vplus.local

• When registering the node locally over HTTPS note that the URL you should use is localhost.localdomain - NOT localhost

• When registering a node via HTTPS, please note that the server must have an FQDN that is different from the IP address (hostname like 10.10.10.10 can be processed incorrectly).

This section presents the steps necessary for generating an SSL certificate, to set up vPlus to use it and how to register a remote node.

vPlus Server (when using own certificate)

This section describes certificate generation and import on the vPlus Server side. It uses a self-signed certificate. If you would like to use CSR and your own CA instead - check for additional steps described in the next section.

1. SSH to vPlus Server host

2. Generate the key and certificate (remember to provide a valid vPlus Server DNS hostname - in our example it was vplus.local):

   openssl req -x509 -newkey rsa:4096 -keyout vplus.key -out vplus.crt -days 365

   Example output (you need to input some information, especially passphrase for certificate):

   Generating a 4096 bit RSA private key
   ...............................................................................++
   .............................................................................................................................................................................................................................................................................................................................................++
   writing new private key to 'vplus.key'
   Enter PEM pass phrase:
   Verifying - Enter PEM pass phrase:
   -----
   You are about to be asked to enter information that will be incorporated
   into your certificate request.
   What you are about to enter is what is called a Distinguished Name or a DN.
   There are quite a few fields but you can leave some blank
   For some fields there will be a default value,
   If you enter '.', the field will be left blank.
   -----
   Country Name (2 letter code) [XX]:PL
   State or Province Name (full name) []:
   Locality Name (eg, city) [Default City]:Warsaw
   Organization Name (eg, company) [Default Company Ltd]: your Company
   Organizational Unit Name (eg, section) []:
   Common Name (eg, your name or your server's hostname) []:vplus.local
   Email Address []:

3. Create the PKCS12 bundle from the certificate and the key:

   openssl pkcs12 -export -in vplus.crt -inkey vplus.key -out vplus.p12 -name vplus

   You need to input passphrase defined before and define export password:

   Enter pass phrase for vplus.key:
   Enter Export Password:
   Verifying - Enter Export Password:

4. Create a keystore for the vPlus Server with the PKCS12 bundle (as a root):

   Note: Default password for our keystore is changeit.

   keytool -importkeystore -destkeystore /opt/vprotect/keystore.jks -srckeystore vplus.p12 -srcstoretype PKCS12 -alias vplus
   #Enter destination keystore password:
   #Re-enter new password:
   #Enter source keystore password:

5. Change ownership on the keystore to the vprotect user:

   chown vprotect:vprotect /opt/vprotect/keystore.jks

6. Edit /opt/vprotect/payara.properties, change the path to the keystore and password (use password generated in step 3 of this instruction, default keystore password is changeit):

   eu.vplus.vprotect.ssl.certname=[certificate alias]
   javax.net.ssl.keyStore=/opt/vprotect/keystore.jks
   javax.net.ssl.keyStorePassword=[keystorepassword]

7. Restart the Server:

   systemctl stop vprotect-server
   systemctl start vprotect-server

vPlus Node (any SSL certificate)

1. SSH to vPlus Node host

2. Make sure that your nodes resolve the hostname (FQDN) of the vPlus Server. You also can add an entry in the /etc/hosts like this (example IP: 1.2.3.4):

   1.2.3.4 vplus.local

3. Check with your browser that https://vPlus_HOST:8181 presents the certificate that you have just generated. You also can execute the openssl client from the node to print it (check the hostname that you have provided in the certificate):

   openssl s_client -connect vplus.local:8181 < /dev/null

4. Import the server certificate using the script under the /opt/vprotect/scripts folder:

   cd /opt/vprotect/scripts
   ./node_add_ssl_cert.sh [SERVER_HOST] [PORT] [KEYSTORE_PASS]

   • [SERVER_HOST] - FQDN name of vPlus Server

   • [PORT] - port for SSL communication on vPlus Server (you need to open it on server # firewall-cmd --permanent --add-port=[PORT]/tcp && firewall-cmd --reload)

   • [KEYSTORE_PASS] - password which you defined in step 3 of that instruction

     Note:

   If you have the node on the same host as the server, You could use default variables of script (and you can use script without arguments). Default variables are:

   • SERVER_HOST = 127.0.0.1

   • PORT = 8181

   • KEYSTORE_PASS = changeit

   It applies if you would not generate any certificate.

5. Register the node with the NODE_NAME of your choice, the ADMIN_USER user name which you would like to use and the URL to vPlus API, and provide the password when prompted:

   vprotect node -r NODE_NAME ADMIN_USER http(s)://vPlus_SERVER:PORT/api

   Examples:

   • Remote server with a generated certificate:

   vprotect node -r node1 admin https://vplus.local:8181/api

   • Local installation with default certificate:

   vprotect node -r node1 admin https://localhost.localdomain:8181/api

Notes on using your own certificate with CSR and your own CA

When using CSR to get a trusted certificate, you need to replace step 2 in vPlus Server (when using own certificate) with several steps including CSR generation, and download the CRT signed by your CA. The steps are as follows:

1. Generate the CSR - answer the same set of questions as above:openssl req -new -newkey rsa:2048 -nodes -keyout vplus.key -out vplus.csr.

2. Send your CSR and have it signed by your CA.

3. Download your CRT file and save it as vplus.crt (note that you should have your working directory set to /opt/vprotect).

4. Download your CA certificate chain (for example for a singleca.crt) and import it with the CA_ALIAS of your choice as follows:

   keytool -import -trustcacerts -keystore /usr/lib/jvm/jre/lib/security/cacerts -storepass changeit -noprompt -alias CA_ALIAS -file ca.crt

5. Now continue from PKCS12 bundle generation (step 3 in the section above).