10.0

Edit

Prepare TLS certificates

Before installation of Workfusion SPA, the TLS certificates must be placed to the INT server.

See the detailed description of certificates...

The following table describes all certificates that are required to install Workfusion SPA:

Nginx Certificates

File namesDescription
ca.crtThe Root CA certificate in the pem format. All following certificates in this table must be signed by this Root CA. It is imported into Java Truststore on all servers. Certificate file must include only Root cert, without any intermediate certs.
  • app.crt
  • app.key
The certificate and its private key files in the pem format for the APP server. Used by nginx on the APP server.
  • Certificate's CommonName or SANs must match app_hostname.
  • The certificate file must include end certificate plus intermediate certs, if exist.
  • The private key must not be password-protected.
  • s3.crt
  • s3.key
The certificate and its private key files in the pem format for S3 proxy located on the APP server. Used by nginx on the APP server.
  • Certificate's CommonName or SANs must match s3_hostname.
  • The certificate file must include the end certificate plusintermediate certs, if exist.
  • The private key must not be password-protected.
  • int.crt
  • int.key
The certificate and its private key files in the pem format for the INT server. Used by nginx on the INT server.
  • Certificate's CommonName or SANs must matchint_hostname.
  • The certificate file must include the end certificate plus intermediate certs, if exist.
  • The private key must not be password-protected.
  • ocr.crt
  • ocr.key
The certificate and its private key files in the pem format for the OCR server. Used by nginx on OCR server.
  • Certificate's CommonName or SANs must match ocr_hostname.
  • The certificate file must include the end certificate plus intermediate certs, if exist.
  • The private key must not be password-protected.
  • bi.crt
  • bi.key
The certificate and its private key files in the pem format for the BI server. Used by Tableau on BI server.
  • Certificate's CommonName or SANs must match bi_hostname.
  • The certificate file must include the end certificate plus intermediate certs, if exist.
  • The private key must not be password-protected.
  • rpa.crt
  • rpa.key
The certificate and its private key files in the pem format for the RPA server. Used by nginx on RPA server(s).
  • Certificate's CommonName or SANs must match all servers in the list of rpa_hostnames.
  • The certificate file must include end certificate plus intermediate certs, if exist.
  • The private key must not be password-protected.
  • ocrwin.crt
  • ocrwin.key
Optional, required if OCR platform is Windows.
The certificate and its private key files in the pem format for the OCR Windows server. Used by nginx on the OCR Windows server.
  • Certificate's CommonName or SANs must match all servers in the list of ocrwin_hostname.
  • The certificate file must include end certificate plus intermediate certs, if exist.
  • The private key must not be password-protected.
  • bep_master.crt
  • bep_master.key
The certificate and its private key files in the pem format for the BEP Master server. Used by nginx and mesos on the BEP Master server.
  • Certificate's CommonName or SANs must match vds_master_hostname.
  • The certificate file must include the end certificate plus intermediate certs, if exist.
  • The private key must not be password-protected.
  • bep_agent.crt
  • bep_agent.key
The certificate and its private key files in the pem format for the BEP Agent server(s). Used by mesos on the BEP Agent server(s).
  • Certificate's CommonName or SANs must match ALL existing and planned hostnames of BEP Agent(s).
  • The certificate file must include the end certificate plus intermediate certs, if exist.
  • The private key must not be password-protected.

Prerequisites

  • Hostnames of all your servers are in a single domain. For example, in hosts.yml, you have the following hostnames:

    int_hostname: int.example.com
app_hostname: app.example.com
ocr_hostname: ocr.example.com
bi_hostname: bi.example.com
bep_master_hostname: automlmaster.example.com
bep_agent_hostname: automlagent.example.com
s3_hostname: app-s3.example.com

  • You have received the following certificates from your SSL provider:

    ca.crt           # contains ROOT CA certificate in pem format (the file may have .crt, .cer, .pem, or .cert extension)
intermediate.crt # contains intermediate CA certificate in pem format signed by ROOT CA certificate (the file may have .crt, .cer, .pem, or .cert extension)
domain.crt       # contains wildcard server certificate in pem format signed by intermediate CA certificate issued for wildcard CommonName *.example.com (the file may have .crt, .cer, .pem, or .cert extension)
domain.key       # contains private key file for domain.crt certificate in pem format (the file may have .key, or .pem extension). This file should have been generated initially with CSR.

Install certificates

  1. Append intermediate.crt to domain.crt certificate:

    $ cat intermediate.crt >> domain.crt

    Order does matter. File domain.crt must be the first. If you have several intermediate CA certs, you need to bundle all of them. Each subsequent intermediate cert that is added to the file must be signed by the previous one. If you don't have any intermediate CA certs, you don't need the earlier step.

  2. Place the following trusted certificates (if you have them) to the PACKAGE_DIR/certificates directory on the INT server:

    • ca.crt
    • app.crt
    • app.key
    • s3.crt
    • s3.key
    • int.crt
    • int.key
    • ocr.crt
    • ocr.key
    • bi.crt
    • bi.key
    • rpa.crt
    • rpa.key
    • bep_master.crt
    • bep_master.key
    • bep_agent.crt
    • bep_agent.key

    The certificates must mandatory have the names specified earlier.
    If in PACKAGE_DIR/certificates, you have:

    • All required certificates – make sure they are named correctly, and then go to step 3.

    • Only some certificates, including ca.crt. The missing certificates can be generated on the basis of the existing one. To generate other required certificates, go to step 3.

    • No certificates at all – you can generate all the required certificates automatically. For that:

      1. In hosts.yml, specify hostnames for all servers.

        Note: a сertificate won't be created, if a respective hostname is not set in hosts.yml.

      2. Go to step 3.

  3. Generate the certificates by running the following command:

    $ ./install.sh certs generate

    The script generates all certificates that are required for product operation and places them to the PACKAGE_DIR/certificates directory.

    -rw-rw-r--. 1 ec2-user ec2-user 1424 Jun  3 12:15 elk-ca.crt
-rw-rw-r--. 1 ec2-user ec2-user 1766 Jun  3 12:15 elk-ca.key
-rw-rw-r--. 1 ec2-user ec2-user 1757 Jun  3 12:15 kibana.crt
-rw-rw-r--. 1 ec2-user ec2-user 3272 Jun  3 12:15 kibana.key
-rw-rw-r--. 1 ec2-user ec2-user 1761 Jun  3 12:15 logstash.crt
-rw-rw-r--. 1 ec2-user ec2-user 3272 Jun  3 12:15 logstash.key
-rw-rw-r--. 1 ec2-user ec2-user 4013 Jun  3 12:15 logstash.p12
-rw-rw-r--. 1 ec2-user ec2-user 1428 Jun  3 12:49 mtls-ca.crt
-rw-rw-r--. 1 ec2-user ec2-user 1766 Jun  3 12:49 mtls-ca.key
-rw-rw-r--. 1 ec2-user ec2-user 1769 Jun  3 12:49 mtls-client.crt
-rw-rw-r--. 1 ec2-user ec2-user 3272 Jun  3 12:49 mtls-client.key
-rw-rw-r--. 1 ec2-user ec2-user 1298 Jun  3 12:15 vault_admin.crt
-rw-rw-r--. 1 ec2-user ec2-user 2517 Jun  3 12:15 vault_admin.p12
-rw-rw-r--. 1 ec2-user ec2-user 1298 Jun  3 12:15 vault_workfusion.crt
-rw-rw-r--. 1 ec2-user ec2-user 2517 Jun  3 12:15 vault_workfusion.p12

    These certificates are used by internal services.

note

The script will not override the existing certificates, if a file with the same name exists in the /certificates directory.

← PreviousNext →