New installations of the Dispatcher Paragon solution have the secured connection (HTTPS) to the web interface enabled by default. Unique certificates are generated during the installation process and they are used to establish this HTTPS communication.

Updating the existing Dispatcher Paragon solution does not enforce the automatic redirection to HTTPS. Also, HTTPS communication is not enabled by default either (for updates). Any certificates issued by the customer are preserved. In order to ensure both encrypted and authenticated connection in such cases, you need to use a certificate trusted in your environment.

This guide will help you with the configuration of HTTPS connection to the Dispatcher Paragon Management Service, using a CA-signed certificate.

CA-signed certificate requirements

• The certificate must be signed by a certification authority trusted in your environment.
• Certificate (fields Common Name and Subject Alternative Name) must contain all network names (i.e. all hostnames, fully qualified domain names, and IP addresses) used for connection to the respective Management Server.
• For importing the key/certificate you need it in an appropriate format depending on SSL/TLS implementation used:
  • For JSSEImplementation (default) - a single PKCS12 (.p12 or .pfx) or JKS file containing the private key and the whole certificate chain
  • For OpenSSLImplementation - two separate PEM files, one containing the private key (usually with .key extension) and one with the whole certificate chain (usually with .crt or .cer extension).
• The certificate file needs to contain all certificates in the chain in a specified order. The first certificate is the Management's one. Each following certificate belongs to the authority which signed the previous certificate directly. The last one belongs to the Root CA.

Configuring Management Service to use HTTPS

In case the Management Server cluster is used, the following steps have to be performed on every node of the Management Server cluster.

1. Choose SSL/TLS implementation based on the certificate format that you are going to use:

   1. Java standard implementation - JSSEImplementation (PKCS12 or JKS)

      <Connector SSLEnabled="true" URIEncoding="UTF-8" acceptCount="100" disableUploadTimeout="true" enableLookups="false" maxHttpHeaderSize="8192" maxThreads="200" minSpareThreads="25" port="443" protocol="org.apache.coyote.http11.Http11Nio2Protocol" scheme="https" secure="true" sslImplementationName="org.apache.tomcat.util.net.jsse.JSSEImplementation">

   2. OpenSSL implementation - openssl.OpenSSLImplementation (PEM)

      <Connector SSLEnabled="true" URIEncoding="UTF-8" acceptCount="100" disableUploadTimeout="true" enableLookups="false" maxHttpHeaderSize="8192" maxThreads="200" minSpareThreads="25" port="443" protocol="org.apache.coyote.http11.Http11Nio2Protocol" scheme="https" secure="true" sslImplementationName="org.apache.tomcat.util.net.openssl.OpenSSLImplementation">
2. Stop Dispatcher Paragon Management Service service on the server.
3. Copy the certificate files to the server installed by the Management Server. (e.g. to <install_dir>\Management\tomcat\conf\ folder)

4. Set following attributes in <install_dir>\Management\tomcat\conf\server.xml file based on used SSL implementation:

   PKCS12

   <Certificate certificateKeystoreFile="absolute/path/to/keystore.p12"certificateKeystorePassword="keystore password" />
   JKS

   <Certificate certificateKeyAlias="safeqtomcat" certificateKeyPassword="39nrqoge332fgomeer3405" certificateKeystoreFile="../conf/ssl-keystore" certificateKeystorePassword="39nrqoge332fgomeer3405" certificateKeystoreType="JKS" />
   PEM

   <Certificate certificateFile="absolute/path/to/your/dispatcherparagoncertificate.crt" certificateKeyFile="absolute/path/to/your/dispatcherparagoncertificate.key" certificateKeyPassword="key protecting password" />

   1. If your certificate private key is protected with an additional password use certificateKeyPassword the configuration property

   2. If you have a CA certificate use the following attribute certificateChainFile = "absolute/path/to/your/ca.crt"

5. To enable automatic redirection from HTTP (port 80) to HTTPS (port 443), edit <install_dir>\Management\tomcat\conf\web.xml and uncomment the <security-constraint> configuration by removing the first and last line in the example below (<!-- Uncomment this to enable https only -->):

   <!-- Uncomment this to enable https only

   <security-constraint>

   <web-resource-collection>

   <web-resource-name>Secured</web-resource-name>

   <url-pattern>/*</url-pattern>

   </web-resource-collection>

   <user-data-constraint>

   <transport-guarantee>CONFIDENTIAL</transport-guarantee>

   </user-data-constraint>

   </security-constraint>

   -->
6. Start the Dispatcher Paragon Management Service service on the server.
7. Verify that the management interface is functional and uses your own certificate (open https://<dispatcher_paragon_server_IP> in the browser, click on the lock and View certificate button). In case you enabled the automatic redirection to HTTPS, opening the http://<dispatcher_paragon_server_IP> address will be automatically redirected to HTTPS protocol.

Example of HTTPS configurations for Tomcat

The configuration is stored in <install_dir>\Management\tomcat\conf\server.xml.

Configuration for JSSEImplementation

Configuration for OpenSSLImplementation

Default key and certificate

The default, pre-installed security certificate is stored in <install_dir>\Management\tomcat\conf\ssl-keystore file

Closed ports

AJP port for integration with existing Tomcat, some is disabled by