CA-signed certificate requirements

• The certificate must be signed by a certification authority trusted in your environment.

• Certificate (fields Common Name and Subject Alternative Name) must contain all network names (i.e. all hostnames, fully qualified domain names, and IP addresses) used for connection to the respective Management Server.

• For importing the key/certificate you need it in an appropriate format depending on SSL/TLS implementation used:

  • For JSSEImplementation (default) - a single PKCS12 (.p12 or .pfx) or JKS file containing the private key and the whole certificate chain

  • For OpenSSLImplementation - two separate PEM files, one containing the private key (usually with .key extension) and one with the whole certificate chain (usually with .crt or .cer extension).

• The certificate file needs to contain all certificates in the chain in a specified order. The first certificate is the Management's one. Each following certificate belongs to the authority which signed the previous certificate directly. The last one belongs to the Root CA.

Configuring Management Service to use HTTPS

In case the Management Server cluster is used, the following steps have to be performed on every node of the Management Server cluster.

1. Choose SSL/TLS implementation based on the certificate format that you are going to use:

   1. Java standard implementation - JSSEImplementation (PKCS12 or JKS)

      <Connector SSLEnabled="true" URIEncoding="UTF-8" acceptCount="100" disableUploadTimeout="true" enableLookups="false" maxHttpHeaderSize="8192" maxThreads="200" minSpareThreads="25" port="443" protocol="org.apache.coyote.http11.Http11Nio2Protocol" scheme="https" secure="true" sslImplementationName="org.apache.tomcat.util.net.jsse.JSSEImplementation">

   2. OpenSSL implementation - openssl.OpenSSLImplementation (PEM)

      <Connector SSLEnabled="true" URIEncoding="UTF-8" acceptCount="100" disableUploadTimeout="true" enableLookups="false" maxHttpHeaderSize="8192" maxThreads="200" minSpareThreads="25" port="443" protocol="org.apache.coyote.http11.Http11Nio2Protocol" scheme="https" secure="true" sslImplementationName="org.apache.tomcat.util.net.openssl.OpenSSLImplementation">

2. Stop Dispatcher Paragon Management Service service on the server.

3. Copy the certificate files to the server installed by the Management Server. (e.g. to <install_dir>\Management\tomcat\conf\ folder)

4. Set following attributes in <install_dir>\Management\tomcat\conf\server.xml file based on used SSL implementation:

   PKCS12

   <Certificate certificateKeystoreFile="absolute/path/to/keystore.p12"certificateKeystorePassword="keystore password" />
   JKS

   <Certificate certificateKeyAlias="safeqtomcat" certificateKeyPassword="39nrqoge332fgomeer3405" certificateKeystoreFile="../conf/ssl-keystore" certificateKeystorePassword="39nrqoge332fgomeer3405" certificateKeystoreType="JKS" />
   PEM

   <Certificate certificateFile="absolute/path/to/your/dispatcherparagoncertificate.crt" certificateKeyFile="absolute/path/to/your/dispatcherparagoncertificate.key" certificateKeyPassword="key protecting password" />

   1. If your certificate private key is protected with an additional password use certificateKeyPassword the configuration property

   2. If you have a CA certificate use the following attribute certificateChainFile = "absolute/path/to/your/ca.crt"

5. To enable automatic redirection from HTTP (port 80) to HTTPS (port 443), edit <install_dir>\Management\tomcat\conf\web.xml and uncomment the <security-constraint> configuration by removing the first and last line in the example below (<!-- Uncomment this to enable https only -->):

   <!-- Uncomment this to enable https only

   <security-constraint>

   <web-resource-collection>

   <web-resource-name>Secured</web-resource-name>

   <url-pattern>/*</url-pattern>

   </web-resource-collection>

   <user-data-constraint>

   <transport-guarantee>CONFIDENTIAL</transport-guarantee>

   </user-data-constraint>

   </security-constraint>

   -->

6. Start the Dispatcher Paragon Management Service service on the server.

7. Verify that the management interface is functional and uses your own certificate (open https://<dispatcher_paragon_server_IP> in the browser, click on the lock and View certificate button). In case you enabled the automatic redirection to HTTPS, opening the http://<dispatcher_paragon_server_IP> address will be automatically redirected to HTTPS protocol.

Example of HTTPS configurations for Tomcat

The configuration is stored in <install_dir>\Management\tomcat\conf\server.xml.

Closed ports

AJP port for integration with existing Tomcat, some is disabled by