Edit

Prepare certificates

Before installing Workfusion Intelligent Automation Cloud you need to provide the following files:

• ca.crt
• server.crt
• server.key

note

If you do not provide the above files, self-signed certificates will be generated automatically with the command below.

The following table describes these files:

File names	Description
server.crt	Server certificate in the PEM format. server.crt must include the end certificate plus all intermediate certs, if exist. The Certificate's CommonName or Subject Alternative Names (SANs) must match all hostnames provided in hosts.yml. For example: int.example.com ct.example.com ocr.example.com bep-master.example.com bep-agent.example.com rpa.example.com bi.example.com vault-lb.example.com minio-lb.example.com nexus-lb.example.com rabbitmq-lb.example.com mesos-lb.example.com marathon-lb.example.com workspace-lb.example.com workfusion-lb.example.com bot-manager-lb.example.com kibana-lb.example.com ocr-lb.example.com bi-lb.example.com If you have all DNS records in a single domain (for example, *.example.com), you may use a wildcard certificate with Common Name *.example.com in its Subject.
server.key	Private key file for server.crt in the PEM format. The private key must not be password-protected.
ca.crt	The Root certification authority (CA) certificate in the PEM format. server.crt must be signed by ca.crt. ca.crt must include only the Root cert, without any intermediate certs.

To prepare certificates:

1. Login via SSH to the INT server and place all three files into the PACKAGE_DIR/certificates/ directory. Skip the step, if you do not have them.

   $ ls -la PACKAGE_DIR/certificates/
   total 24
   drwxr-xr-x.  3 ec2-user ec2-user   78 Sep 24 14:47 .
   drwxr-xr-x. 12 ec2-user ec2-user 4096 Sep 27 17:20 ..
   -rw-r--r--.  1 ec2-user ec2-user 2984 Sep 24 14:42 ca.crt
   -rw-r--r--.  1 ec2-user ec2-user 4835 Sep 24 14:42 server.crt
   -rw-r--r--.  1 ec2-user ec2-user 1674 Sep 24 14:42 server.key
   

2. Generate the additional client certs that are used internally by the Workfusion services for communication and authentication among each other. Execute the following command on the INT server:

   $ ./install.sh certs generate
   

   The command creates the _auth_internal/ directory inside the certificates/ directory and generates all required internal certs. If you haven't placed your ca.crt, server.crt, and server.key files to the /certificates directory, they also will be automatically generated (self-signed).

   Here is how the certificates/ directory's content must look like:

   $ cd PACKAGE_DIR/
   $ tree certificates/
   certificates/
   |-- _auth_internal
   |   |-- elk-ca.crt
   |   |-- elk-ca.key
   |   |-- kibana.crt
   |   |-- kibana.key
   |   |-- logstash.crt
   |   |-- logstash.key
   |   |-- logstash.p12
   |   |-- mtls-ca.crt
   |   |-- mtls-ca.key
   |   |-- mtls-client.crt
   |   |-- mtls-client.key
   |   |-- vault_admin.crt
   |   |-- vault_admin.p12
   |   |-- vault_workfusion.crt
   |   `-- vault_workfusion.p12
   |-- ca.crt
   |-- server.crt
   `-- server.key