Update from non-SSL to SSL

WorkFusion platform uses several x509 certificates to secure communications between the services. This documentation explains how you can move non-SSL installation under SSL.

Predefined common variables:

<INSTALL_DIR> - WorkFusion Home Directory. Default is /opt/workfusion
<PACKAGE_DIR> - WorkFusion Installer Directory. Default is /opt/workfusion/wf_installer

Available <SERVER_ROLE>:

apm - APM server
app - APP server
db - DB server
ocr - OCR server
vds-master - AutoML Master server
vds-slave - AutoML Agent server

Linux Servers

Solution 1. Public Trusted Certificates

This solution cannot be implemented for the intermediate certificate(-s). In this case, you should use the solution 2 and place the entire certificate chain to certificate/CA.cert

This approach is intended to use Public Certificate signed by a trusted Certificate Authority.

You need to obtain as many valid certificates as required, each of certificates should match to each of DNS names specified in config.yml

Stop all services on all Linux servers (as wfuser):
```
wfmnager stop all
```
Copy x509 Server-certs and x509 Client-certs files in PEM format to the certificates directory and edit the secrets.yml
Set in config.yml file https_enabled: true on all Linux servers

Run install command on all Linux servers (as wfuser):

cd <PACKAGE_DIR>
./install.sh install <SERVER_ROLE>

Solution 2. Entity Trusted Certificates

Ensure that you have imported the intermediate certificate to each component/workplace, which interacts with the WorkFusion platform.

This solution is similar to Solution 1, the only difference is that you should place the entire certificate chain in PEM format to the certificate/CA.cert file. This approach is intended to use the Entity Trusted Certificates signed by a local intermediate Certificate Authority.

Stop all services on all Linux servers (as wfuser):
```
wfmnager stop all
```
Copy x509 Server-certs and x509 Client-certs files in PEM format to the certificates directory and edit the secrets.yml
Set in config.yml file https_enabled: true on all Linux servers

Run install command on all Linux servers (as wfuser):

cd <PACKAGE_DIR>
./install.sh install <SERVER_ROLE>

Solution 3. Self-Signed Certificates

Certificates should be generated by generate-certificates.sh in the previous installation.

Stop all services on all Linux servers (as wfuser):
```
wfmnager stop all
```
Set in config.yml file https_enabled: true on all Linux servers

Run install command on all Linux servers (as wfuser):

cd <PACKAGE_DIR>
./install.sh install <SERVER_ROLE>

RPA Manager in SSL mode

This section provides a brief description how to setup the two way authentication between RPA Manager and RPA Hub.

There are two possibilities to configure TLS client authentication:

using self-signed certificates
using existing certificates.

Solution 1. Сonfigure TLS client authentication with self-signed certificates

Generate keys and self-signed certificates
1. Obtain the shell access to APP Server where RPA Manager is installed.
2. Go to the /rpa_manager directory.
3. Generate the certificates pair:
  
  Run this script to generate the certificates pair, put them to the /rpa_manager/ssl directory and add them to client.jks and server.jks
```
cd <INSTALL_DIR>/rpa-manager/
mkdir ssl
./rpa.sh -g <RPAHUB_SERVER_DNS>
```
  Repeat these steps for each RPA Hub installed.
  
  It's possible to generate SSL certificates using wildcards. In Example 2 below the asterisks character (*) allows using the certificates for any subdomain of example.com on a few RPA Hub servers. Alternatively, you should run rpa.sh for each RPA Hub installed.
  
  Possible usage
```
cd <INSTALL_DIR>/rpa-manager/
mkdir ssl
## Example 1
./rpa.sh -g rpahub01.example.com
 ## Example 2
./rpa.sh -g *.example.com
```
  example 1 output
```
ls -1 <INSTALL_DIR>/rpa-manager/ssl

./client-public-rpa1.example.com.cer   
./client-rpa1.example.com.p12      ## P12 cert: may be imported to web-browser
./client-rpa1.example.com.pem      ## Client certificate
./server-public-rpa1.example.com.cer
./server-rpa1.example.com.key      ## Server key file
./server-rpa1.example.com.p12
./server-rpa1.example.com.pem      ## Server certificate 
```
Configure application.properties
1. Ensure that use.ssl is set to true in the RPA Manager configuration file on APP server: <INSTALL_DIR>/rpa_manager/grid-router/application.properties
```
use.ssl=true
```
2. Ensure, that use.ssl.client.authorization is set to true in the RPA Manager configuration file on APP server: <INSTALL_DIR>/rpa_manager/grid-router/application.properties
```
use.ssl.client.authorization=true
```

Configure RPA Hub quota

Modify the user.xml file on APP server: /rpa_manager/grid-router/quota/user.xmlPut the correct values for host name, port and count properties in "<host name="rpa-hub.example.com" port="443" count="2"/>".

Example

<qa:browsers xmlns:qa="urn:config.gridrouter.qatools.ru">
    <browser name="chrome" defaultVersion="1.0">
        <version number="1.0">
            <region name="hub1">
                <host name="rpa-hub.example.com" port="443" count="2"/>
            </region>
        </version>
    </browser>
    <browser name="internet explorer" defaultVersion="11">
        <version number="11">
            <region name="hub1">
                <host name="rpa-hub.example.com" port="443" count="2"/>
            </region>
        </version>
    </browser>
    <browser name="desktop" defaultVersion="1.0">
        <version number="1.0">
            <region name="hub1">
                <host name="rpa-hub.example.com" port="443" count="2"/>
            </region>
        </version>
    </browser>
    <browser name="universal" defaultVersion="1.0">
        <version number="1.0">
            <region name="hub1">
                <host name="rpa-hub.example.com" port="443" count="2"/>
            </region>
        </version>
    </browser>
</qa:browsers>

Restart RPA manager service on APP Server.
```
wfmanager restart rpa-manager
```

Transfer the following certificates to RPA Hub (Windows Server) and proceed with configuring nginx with SSL on RPA Hub.

example 1 output

<INSTALL_DIR>/rpa-manager/ssl/client-rpa1.example.com.pem      ## Client certificate
<INSTALL_DIR>/rpa-manager/ssl/server-rpa1.example.com.key      ## Server key file
<INSTALL_DIR>/rpa-manager/ssl/server-rpa1.example.com.pem      ## Server certificate

Rename certificates.

example 1 output

client.pem      ## Client certificate
server.key      ## Server key file
server.pem      ## Server certificate

Put the certificates and the key with the following names to Hub servers into the nginx/ssl folder (by default c:\RPA\nginx\ssl\).

Check the Nginx configuration file (by default, c:\RPA\nginx\conf\nginx.conf) on a Windows machine with RPA Hub and make sure, that the certificates names and paths match to the currently used:
```
ssl_certificate ..\ssl\server.pem;
ssl_certificate_key ..\ssl\server.key;
ssl_client_certificate ..\ssl\client.pem;
ssl_verify_client on;
```

Solution 2. Сonfigure TLS client authentication with existing certificates

Update/generate client.jks and server.jks.
1. Gain shell access to WF server where RPA manager has installed.
2. Go to the <INSTALL_DIR>/rpa_manager directory.
3. Store the existing certificates in client.jks and server.jks.
```
cd <INSTALL_DIR>/rpa-manager/
./rpa.sh -a <RPAHUB_SERVER_DNS> <arbitrary_certificate_alias>

## Example
./rpa.sh -a rpa1.example.com rpa1
./rpa.sh -a rpa2.example.com rpa2
```
Configure application.properties
1. Ensure that use.ssl is set to true in the RPA Manager configuration file on APP server: <INSTALL_DIR>/rpa_manager/grid-router/application.properties
```
use.ssl=true
```
1. Ensure that use.ssl.client.authorization is set to true in the RPA Manager configuration file on APP server: <INSTALL_DIR>/rpa_manager/grid-router/application.properties
```
use.ssl.client.authorization=true
```
Modify the PORT variable properly defined (see the RPA Hub configuration) for each RPA Hub in the user.xml configuration file on APP server:
```
#link: manager_quota

<INSTALL_DIR>/rpa_manager/grid-router/quota/user.xml. 
#By default it should be 443 port.
```
Restart the RPA Manager service on APP Server:
```
wfmanager restart rpa-manager
```
Put the certificates and the key with the following names to Hub servers into the nginx/ssl folder (by default, c:\RPA\nginx\ssl\).

Check the Nginx configuration file (by default, c:\RPA\nginx\conf\nginx.conf) on a Windows machine with RPA Hub and make sure that the certificate names and paths match to the currently used:
```
ssl_certificate ..\ssl\server.pem;
ssl_certificate_key ..\ssl\server.key;
ssl_client_certificate ..\ssl\client.pem;
ssl_verify_client on;
```

WorkFusion Analytics Server

Add to Tableau config <INSTALL_DIR>/WorkFusion Analytics Server/conf/tabsvc.yml on BI Server.
```
ssl.enabled: true
ssl.cert.file: <path to the certificate>
ssl.key.file: <path to the key>
```
Example:
Restart WorkFusion Analytics Server.

WorkFusion Documentation

9.2

General services

APP

DB

OCR

VDS

OOTB configuration

Infrastructure scaling

Run preinstall manually

Using TLS certificates

Elastic Monitoring

Linux Servers

Solution 1. Public Trusted Certificates

Solution 2. Entity Trusted Certificates

Solution 3. Self-Signed Certificates

RPA Manager in SSL mode

Solution 1. Сonfigure TLS client authentication with self-signed certificates

Solution 2. Сonfigure TLS client authentication with existing certificates

WorkFusion Analytics Server