Update from non-SSL to SSL

Еру WorkFusion platform uses several x509 certificates to secure communications between the services. The document explains how you can move non-SSL installation under SSL.

The predefined common variables are as follows:

/opt/workfusion
/opt/workfusion/wf_installerAvailable
apm: APM server
app: APP server
db: DB server
ocr: OCR server
vds-master: master ML server
vds-slave: slave ML server

Linux servers

Solution 1. Public Trusted Certificates

This solution cannot be implemented for the intermediate certificate(-s). In this case, you should use the solution 2 and place the entire certificate chain to certificate/CA.cert. This approach is intended to use Public Certificate signed by a trusted Certificate Authority. You need to obtain as many valid certificates as required, each of certificates should match to each of DNS names specified in config.yml.

Stop all services on all Linux servers (as wfuser):
```
wfmnager stop all
```
Copy x509 Server-certs and x509 Client-certs files in PEM format to the certificates directory and edit secrets.yml.
In the config.yml file, set https_enabled: true on all Linux servers.
Run the install command on all Linux servers (as wfuser):
```
cd <PACKAGE_DIR>
./install.sh install <SERVER_ROLE>
```

Solution 2. Entity Trusted Certificates

Ensure that you have imported the intermediate certificate to each component/workplace that interacts with the WorkFusion platform. This solution is similar to Solution 1, the only difference is that you should place the entire certificate chain in PEM format to the certificate/CA.cert file. This approach is intended to use the Entity Trusted Certificates signed by a local intermediate Certificate Authority.

Stop all services on all Linux servers (as wfuser):
```
wfmnager stop all
```
Copy x509 Server-certs and x509 Client-certs files in PEM format to the certificates directory and edit secrets.yml.
In the config.yml fil, set https_enabled: true on all Linux servers.
Run the install command on all Linux servers (as wfuser):
```
cd <PACKAGE_DIR>
./install.sh install <SERVER_ROLE>
```

Solution 3. Self-Signed Certificates

Certificates should be generated by generate-certificates.sh in the previous installation.

Stop all services on all Linux servers (as wfuser):
```
wfmnager stop all
```
In the config.yml file, set https_enabled: true on all Linux servers.
Run the install command on all Linux servers (as wfuser):
```
cd <PACKAGE_DIR>
./install.sh install <SERVER_ROLE>
```

RPA Manager in SSL mode

This section provides a brief description how to set up the two way-authentication between RPA Manager and RPA Hub. There are two possibilities to configure TLS client authentication:

Using self-signed certificates
Using existing certificates

Solution 1. Сonfigure TLS client authentication with self-signed certificates

Generate keys and self-signed certificates

Obtain the shell access to APP Server where RPA Manager is installed.
Go to the /rpa_manager directory.
To generate the certificate pair, run this script, put the certificates to the /rpa_manager/ssl directory and add them to client.jks and server.jks.
```
cd <INSTALL_DIR>/rpa-manager/
mkdir ssl
./rpa.sh -g <RPAHUB_SERVER_DNS>
```
Repeat these steps for each RPA Hub installed.

You can generate SSL certificates using wildcards. In Example 2, the asterisk character (*) allows using the certificates for any subdomain of example.com on a few RPA Hub servers. Alternatively, run rpa.sh for each RPA Hub installed.

Possible usage:

cd <INSTALL_DIR>/rpa-manager/
mkdir ssl
## Example 1
./rpa.sh -g rpahub01.example.com
## Example 2
./rpa.sh -g *.example.com

Example 1 output:

ls -1 <INSTALL_DIR>/rpa-manager/ssl

./client-public-rpa1.example.com.cer   
./client-rpa1.example.com.p12      ## P12 cert: may be imported to web-browser
./client-rpa1.example.com.pem      ## Client certificate
./server-public-rpa1.example.com.cer
./server-rpa1.example.com.key      ## Server key file
./server-rpa1.example.com.p12
./server-rpa1.example.com.pem      ## Server certificate

Configure application.properties

Ensure that use.ssl is set to true in the RPA Manager configuration file on APP server: <INSTALL_DIR>/rpa_manager/grid-router/application.properties
```
use.ssl=true
```
Ensure, that use.ssl.client.authorization is set to true in the RPA Manager configuration file on APP server: <INSTALL_DIR>/rpa_manager/grid-router/application.properties
```
use.ssl.client.authorization=true
```

Configure RPA Hub quota

Modify the user.xml file on APP server: /rpa_manager/grid-router/quota/user.xml Put the correct values for hostname, port, and count properties in <host name="rpa-hub.example.com" port="443" count="2"/>.

Example:

<qa:browsers xmlns:qa="urn:config.gridrouter.qatools.ru">
    <browser name="chrome" defaultVersion="1.0">
        <version number="1.0">
            <region name="hub1">
                <host name="rpa-hub.example.com" port="443" count="2"/>
            </region>
        </version>
    </browser>
    <browser name="internet explorer" defaultVersion="11">
        <version number="11">
            <region name="hub1">
                <host name="rpa-hub.example.com" port="443" count="2"/>
            </region>
        </version>
    </browser>
    <browser name="desktop" defaultVersion="1.0">
        <version number="1.0">
            <region name="hub1">
                <host name="rpa-hub.example.com" port="443" count="2"/>
            </region>
        </version>
    </browser>
    <browser name="universal" defaultVersion="1.0">
        <version number="1.0">
            <region name="hub1">
                <host name="rpa-hub.example.com" port="443" count="2"/>
            </region>
        </version>
    </browser>
</qa:browsers>

Restart the RPA manager service on APP Server:
```
wfmanager restart rpa-manager
```

Transfer the following certificates to RPA Hub (Windows Server) and proceed with configuring Nginx with SSL on RPA Hub.

Example 1 output:

<INSTALL_DIR>/rpa-manager/ssl/client-rpa1.example.com.pem      ## Client certificate
<INSTALL_DIR>/rpa-manager/ssl/server-rpa1.example.com.key      ## Server key file
<INSTALL_DIR>/rpa-manager/ssl/server-rpa1.example.com.pem      ## Server certificate

Rename certificates.

Example 1 output:

client.pem      ## Client certificate
server.key      ## Server key file
server.pem      ## Server certificate

Put the certificates and the key with the following names to Hub servers into the nginx/ssl folder (by default C:\RPA\nginx\ssl).
Check the Nginx configuration file (by default C:\RPA\nginx\conf\nginx.conf) on a Windows machine with RPA Hub. Make sure that the certificate names and paths match to the currently used ones:
```
ssl_certificate ..\ssl\server.pem;
ssl_certificate_key ..\ssl\server.key;
ssl_client_certificate ..\ssl\client.pem;
ssl_verify_client on;
```

Solution 2. Сonfigure TLS client authentication with existing certificates

Update or generate client.jks and server.jks

Gain shell access to WF server where RPA manager has installed.
Go to the <INSTALL_DIR>/rpa_manager directory.

Store the existing certificates in client.jks and server.jks.

cd <INSTALL_DIR>/rpa-manager/
./rpa.sh -a <RPAHUB_SERVER_DNS> <arbitrary_certificate_alias>
  
## Example
./rpa.sh -a rpa1.example.com rpa1
./rpa.sh -a rpa2.example.com rpa2

Configure application.properties

Ensure that use.ssl is set to true in the RPA Manager configuration file on APP server: <INSTALL_DIR>/rpa_manager/grid-router/application.properties
```
use.ssl=true
```
Ensure that use.ssl.client.authorization is set to true in the RPA Manager configuration file on APP server: <INSTALL_DIR>/rpa_manager/grid-router/application.properties
```
use.ssl.client.authorization=true
```
Modify the PORT variable properly defined (see the RPA Hub configuration) for each RPA Hub in the user.xml configuration file on APP server:
```
#link: manager_quota

<INSTALL_DIR>/rpa_manager/grid-router/quota/user.xml. 
#By default it should be 443 port.
```
Restart the RPA Manager service on APP Server:
```
wfmanager restart rpa-manager
```
Put the certificates and the key with the following names to Hub servers into the nginx/ssl folder (by default C:\RPA\nginx\ssl).
Check the Nginx configuration file (by default C:\RPA\nginx\conf\nginx.conf) on a Windows machine with RPA Hub. Make sure that the certificate names and paths match to the currently used:
```
ssl_certificate ..\ssl\server.pem;
ssl_certificate_key ..\ssl\server.key;
ssl_client_certificate ..\ssl\client.pem;
ssl_verify_client on;
```

WorkFusion Analytics Server

Add to Tableau config <INSTALL_DIR>\WorkFusion Analytics Server\conf\tabsvc.yml on BI Server.
```
ssl.enabled: true
ssl.cert.file: <path to the certificate>
ssl.key.file: <path to the key>
```
Example:
Restart WorkFusion Analytics Server.

WorkFusion Documentation

9.3

General services

APP

DB

OCR

VDS

OOTB configuration

Infrastructure scaling

Run preinstall manually

Using TLS certificates

Elastic Monitoring

Linux servers

Solution 1. Public Trusted Certificates

Solution 2. Entity Trusted Certificates

Solution 3. Self-Signed Certificates

RPA Manager in SSL mode

Solution 1. Сonfigure TLS client authentication with self-signed certificates

Generate keys and self-signed certificates

Configure application.properties

Configure RPA Hub quota

Solution 2. Сonfigure TLS client authentication with existing certificates

Update or generate client.jks and server.jks

Configure application.properties

WorkFusion Analytics Server