Update from non-SSL to SSL

WorkFusion platform uses several x509 certificates to secure communications between the services. This documentation explains how you can move non-SSL installation under SSL.

Predefined common variables:

/opt/workfusion
/opt/workfusion/wf_installerAvailable
apm: APM
serverapp: APP server
db: DB server
ocr: OCR
servervds-master: master ML
servervds-slave: slave ML server

Linux Servers

Solution 1. Public trusted certificates

This solution cannot be implemented for the intermediate certificate(-s). In this case, you should use the solution 2 and place the entire certificate chain to certificate/CA.cert. This approach is intended to use Public Certificate signed by a trusted Certificate Authority. You need to obtain as many valid certificates as required, each of certificates should match to each of DNS names specified in config.yml.

Stop all services on all Linux servers (as wfuser):
```
wfmnager stop all
```
Copy x509 Server-certs and x509 Client-certs files in PEM format to the certificates directory and edit the secrets.yml.
In the config.yml file, set https_enabled: true on all Linux servers.
Run the install command on all Linux servers (as wfuser):
```
cd <PACKAGE_DIR>
./install.sh install <SERVER_ROLE>
```

Solution 2. Entity trusted certificates

Ensure that you have imported the intermediate certificate to each component/workplace, which interacts with the WorkFusion platform.This solution is similar to Solution 1, the only difference is that you should place the entire certificate chain in PEM format to the certificate/CA.cert file. This approach is intended to use the Entity Trusted Certificates signed by a local intermediate Certificate Authority.

Stop all services on all Linux servers (as wfuser):
```
wfmnager stop all
```
Copy x509 Server-certs and x509 Client-certs files in PEM format to the certificates directory and edit the secrets.yml.
In config.yml, set https_enabled: true on all Linux servers.
Run the install command on all Linux servers (as wfuser):
```
cd <PACKAGE_DIR>
./install.sh install <SERVER_ROLE>
```

Solution 3. Self-signed certificates

Certificates should be generated by generate-certificates.sh in the previous installation.

Stop all services on all Linux servers (as wfuser):
```
wfmnager stop all
```
In config.yml, set https_enabled: true on all Linux servers.
Run the install command on all Linux servers (as wfuser):
```
cd <PACKAGE_DIR>
./install.sh install <SERVER_ROLE>
```

RPA Manager in SSL mode

This section provides a brief description of how to set up the two way authentication between RPA Manager and RPA Hub. There are two possibilities to configure TLS client authentication:

Using self-signed certificates
Using existing certificates.

Solution 1. Сonfigure TLS client authentication with self-signed certificates

Generate keys and self-signed certificates

Obtain the shell access to APP Server where RPA Manager is installed.
Go to the /rpa_manager directory.

Generate the certificate pair.

Run this script to generate the certificates pair, put them to the /rpa_manager/ssl directory and add them to client.jks and server.jks.

cd <INSTALL_DIR>/rpa-manager/
mkdir ssl
./rpa.sh -g <RPAHUB_SERVER_DNS>

Repeat these steps for each RPA Hub installed.

It's possible to generate SSL certificates using wildcards. In Example 2 below, the asterisk character (*) allows using the certificates for any subdomain of example.com on a few RPA Hub servers. Alternatively, you should run rpa.sh for each RPA Hub installed.

Possible usage:

cd <INSTALL_DIR>/rpa-manager/
mkdir ssl
## Example 1
./rpa.sh -g rpahub01.example.com
 ## Example 2
./rpa.sh -g *.example.com

Example 1 output

ls -1 <INSTALL_DIR>/rpa-manager/ssl

./client-public-rpa1.example.com.cer   
./client-rpa1.example.com.p12      ## P12 cert: may be imported to web-browser
./client-rpa1.example.com.pem      ## Client certificate
./server-public-rpa1.example.com.cer
./server-rpa1.example.com.key      ## Server key file
./server-rpa1.example.com.p12
./server-rpa1.example.com.pem      ## Server certificate

Configure application.properties:

Ensure that use.ssl is set to true in the RPA Manager configuration file on APP server: <INSTALL_DIR>/rpa_manager/grid-router/application.properties.
```
use.ssl=true
```
Ensure, that use.ssl.client.authorization is set to true in the RPA Manager configuration file on APP server: <INSTALL_DIR>/rpa_manager/grid-router/application.properties
```
use.ssl.client.authorization=true
```

Configure RPA Hub quota

Modify the user.xml file on APP server: /rpa_manager/grid-router/quota/user.xml Put the correct values for hostname, port and count properties in "<host name="[rpa-hub.example.com](http://rpa-hub.example.com/)" port="443" count="2"/>".

Example:

<qa:browsers xmlns:qa="urn:config.gridrouter.qatools.ru">
    <browser name="chrome" defaultVersion="1.0">
        <version number="1.0">
            <region name="hub1">
                <host name="rpa-hub.example.com" port="443" count="2"/>
            </region>
        </version>
    </browser>
    <browser name="internet explorer" defaultVersion="11">
        <version number="11">
            <region name="hub1">
                <host name="rpa-hub.example.com" port="443" count="2"/>
            </region>
        </version>
    </browser>
    <browser name="desktop" defaultVersion="1.0">
        <version number="1.0">
            <region name="hub1">
                <host name="rpa-hub.example.com" port="443" count="2"/>
            </region>
        </version>
    </browser>
    <browser name="universal" defaultVersion="1.0">
        <version number="1.0">
            <region name="hub1">
                <host name="rpa-hub.example.com" port="443" count="2"/>
            </region>
        </version>
    </browser>
</qa:browsers>

Restart the RPA manager service on APP Server.
```
wfmanager restart rpa-manager
```

Transfer the following certificates to RPA Hub (Windows Server) and proceed with configuring Nginx with SSL on RPA Hub.

Example 1 output

<INSTALL_DIR>/rpa-manager/ssl/client-rpa1.example.com.pem      ## Client certificate
<INSTALL_DIR>/rpa-manager/ssl/server-rpa1.example.com.key      ## Server key file
<INSTALL_DIR>/rpa-manager/ssl/server-rpa1.example.com.pem      ## Server certificate

Rename certificates.

Example 1 output

client.pem      ## Client certificate
server.key      ## Server key file
server.pem      ## Server certificate

Put the certificates and the key with the following names to Hub servers into the nginx/ssl folder (by default C:/RPA/nginx/ssl).
Check the Nginx configuration file (by default C:/RPA/nginx/conf/nginx.conf) on a Windows machine with RPA Hub and make sure that the certificate names and paths match to the currently used:
```
ssl_certificate ..\ssl\server.pem;
ssl_certificate_key ..\ssl\server.key;
ssl_client_certificate ..\ssl\client.pem;
ssl_verify_client on;
```

Solution 2. Сonfigure TLS client authentication with existing certificates

Update or generate client.jks and server.jks.

Gain shell access to WF server where RPA manager has installed.
Go to the <INSTALL_DIR>/rpa_manager directory.

Store the existing certificates in client.jks and server.jks.

cd <INSTALL_DIR>/rpa-manager/
./rpa.sh -a <RPAHUB_SERVER_DNS> <arbitrary_certificate_alias>
  
## Example
./rpa.sh -a rpa1.example.com rpa1
./rpa.sh -a rpa2.example.com rpa2

Configure application.properties.

Ensure that use.ssl is set to true in the RPA Manager configuration file on APP server: <INSTALL_DIR>/rpa_manager/grid-router/application.properties
```
use.ssl=true
```
Ensure that use.ssl.client.authorization is set to true in the RPA Manager configuration file on APP server: <INSTALL_DIR>/rpa_manager/grid-router/application.properties
```
use.ssl.client.authorization=true
```
Modify the PORT variable properly defined (see the RPA Hub configuration) for each RPA Hub in the user.xml configuration file on APP server:
```
#link: manager_quota

<INSTALL_DIR>/rpa_manager/grid-router/quota/user.xml. 
#By default it should be 443 port.
```
Restart the RPA Manager service on APP Server:
```
wfmanager restart rpa-manager
```
Put the certificates and the key with the following names to Hub servers into the nginx/ssl folder (by default C:/RPA/nginx/ssl).
Check the Nginx configuration file (by default C:/RPA/nginx/conf/nginx.conf) on a Windows machine with RPA Hub and make sure that the certificates names and paths match to the currently used:
```
ssl_certificate ..\ssl\server.pem;
ssl_certificate_key ..\ssl\server.key;
ssl_client_certificate ..\ssl\client.pem;
ssl_verify_client on;
```

WorkFusion Analytics Server

Add <INSTALL_DIR>/WorkFusion Analytics Server/conf/tabsvc.yml to Tableau config on BI Server.

ssl.enabled: true
ssl.cert.file: <path to the certificate>
ssl.key.file: <path to the key>

Example:

Restart WorkFusion Analytics Server.

WorkFusion Documentation

9.4

General services

APP

DB

OCR

VDS

OOTB configuration

Infrastructure scaling

Run preinstall manually

Using TLS certificates

Elastic Monitoring

Linux Servers

Solution 1. Public trusted certificates

Solution 2. Entity trusted certificates

Solution 3. Self-signed certificates

RPA Manager in SSL mode

Solution 1. Сonfigure TLS client authentication with self-signed certificates

Generate keys and self-signed certificates

Configure RPA Hub quota

Solution 2. Сonfigure TLS client authentication with existing certificates

WorkFusion Analytics Server