Skip to content

Commit

Permalink
Added Multi Domain Certificate support to 2024.9
Browse files Browse the repository at this point in the history
  • Loading branch information
Donna-Marie Smith committed Sep 24, 2024
1 parent c970098 commit 7d8bc33
Show file tree
Hide file tree
Showing 14 changed files with 77 additions and 77 deletions.
7 changes: 2 additions & 5 deletions ...n-to-72/multiple-server-with-ha/install-web-application-server/prerequisites.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -31,11 +31,8 @@ In order to ensure that the correct certificate is used during the upgrade of {{
<br />
The Flow Debugger also requires an X.509 SSL certificate to be installed on the Web Application Server. This can use the same certificate as {{% ctx %}} Gateway, however it must have the following properties:

* Subject field must be in one of the following formats depending on whether a multi-domain or wildcard certificate is used:
* Multi-domain certificate - If using the [gobetween][] load balancer this should be specified as the FQDN of the load balancer server (e.g. `CN=load-balancer.domain.com`). If using a different load balancer this must be specified as the FQDN of one of the application servers (e.g. `CN=application-server.domain.com`)
* Wildcard certificate - wildcard format, pertaining to the domain of the Application Servers (e.g. `CN=*.domain.com`).
* Subject alternative names must include any additional host names that should be able to be used to access the API Gateway Service. Additionally if using a multi-domain certificate:
* The FQDN, NetBIOS Name and IP address of the web application server and all application servers must be added.
* Subject field must be in a wildcard format, pertaining to the domain of the Application Servers (e.g. `CN=*.domain.com`).
* Subject alternative names must include any additional host names that should be able to be used to access the API Gateway Service.
* Certificate file must be in a .PFX file format, with a known password.
* Certificate file must contain the full chain of certificates.
* Certificate file must include the private key.
Expand Down
22 changes: 8 additions & 14 deletions ...tarted/on-premise/add-innovation-to-72/multiple-server-with-ha/prerequisites.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -258,10 +258,10 @@ The `Cortex.Innovation.Test.PortUsage.ps1` script is provided during installatio
#### Application Servers
{{% alert title="Note" %}}
For production platforms it is recommended that X.509 SSL multi-domain or wildcard certificates are obtained from a Certificate Authority and used for installation. For non-production platforms, certificates can be omitted from installation and it will create and use self-signed certificates. This may prevent 3rd parties that require valid certificate verification to access the API Gateway Service.
For production platforms it is recommended that X.509 SSL wildcard certificates are obtained from a Certificate Authority and used for installation. For non-production platforms, certificates can be omitted from installation and it will create and use self-signed certificates. This may prevent 3rd parties that require valid certificate verification to access the API Gateway Service.
{{% / alert %}}
An X.509 SSL multi-domain or wildcard certificate should be used to:
An X.509 SSL wildcard certificate should be used to:
* Secure communication between the load balancer and the nodes on the Application Servers.
* Secure communication between the Application Services.
Expand All @@ -271,12 +271,8 @@ An X.509 SSL multi-domain or wildcard certificate should be used to:
The certificate can be obtained from a Certificate Authority, such as [Let’s Encrypt](<https://letsencrypt.org/>), and must meet the following requirements:
* Subject field must be in one of the following formats depending on whether a multi-domain or wildcard certificate is used:
* Multi-domain certificate - If using the [gobetween][] load balancer this should be specified as the FQDN of the load balancer server (e.g. `CN=load-balancer.domain.com`). If using a different load balancer this must be specified as the FQDN of one of the application servers (e.g. `CN=application-server.domain.com`)
* Wildcard certificate - wildcard format, pertaining to the domain of the Application Servers (e.g. `CN=*.domain.com`).
* Subject alternative names must include any additional host names that should be able to be used to access the API Gateway Service. Additionally if using a multi-domain certificate:
* The FQDN, NetBIOS Name and IP address of all application servers must be added.
* Optionally, the FQDN, NetBIOS Name and IP address of the web application server must be added if the same certificate will be used for the [web application server][].
* Subject field must be in a wildcard format, pertaining to the domain of the Application Servers (e.g. `CN=*.domain.com`).
* Subject alternative names must include any additional host names that should be able to be used to access the API Gateway Service.
* Certificate file must be in a .PFX file format, with a known password.
* Certificate file must contain the full chain of certificates.
* Certificate file must include the private key.
Expand All @@ -285,21 +281,20 @@ The certificate can be obtained from a Certificate Authority, such as [Let’s E
This file should be placed in a known location on the Application Server where the installation scripts will be run. This location will be required when running the installation script.
If required, a separate X.509 SSL certificate can be obtained to be used by the load balancer to communicate with the Application Services. It must meet all of the other requirements laid out above, except the subject field can also be the FQDN of the load balancer (e.g. `CN=load-balancer.domain.com`).
If required, a separate X.509 SSL certificate can be obtained to be used by the load balancer to communicate with the Application Services. It must meet all of the other requirements laid out above, except the subject field can also be the FQDN of the load balancer (e.g. `CN=machine-name.domain.com`).
#### Web Application Server
{{% ctx %}} Gateway requires an X.509 SSL certificate to be installed on the Web Application Server. This can be the same certificate as used for the application servers or a different certificate.
The certificate must have the following properties:
{{% ctx %}} Gateway requires an X.509 SSL certificate to be installed on the Web Application Server. The certificate must have the following properties:
* Enhanced Key Usage: `Server Authentication` and `Client Authentication`
* Subject Alternative Names (SAN): At minimum the FQDN of the Server. It can also include NetBIOS Name, IP address, localhost, 127.0.0.1
If the user tries to navigate to an address not in the SAN list, then they will receive a certificate error.
{{% alert title="Important" color="warning" %}}
Multi-domain certificates, wildcard certificates, auto-generated self-signed certificates and {{< ahref path="Cortex.GettingStarted.OnPremise.InstallInnovationOnly.Advanced.CreateSelfSignedCertificates" title="manually created self-signed certificates" >}} can be used. However, self-signed certificates are not recommended for production instances.
Certificates, wildcard certificates, auto-generated self-signed certificates and manually created self-signed certificates can be used. However, self-signed certificates are not recommended for production instances.
Details on how to create a self-signed certificate can be found at {{< ahref path="Cortex.GettingStarted.OnPremise.InstallInnovationOnly.Advanced.CreateSelfSignedCertificates" title="Create Self-Signed Certificates" >}}.
{{% /alert %}}
More information about importing the certificate is given during installation.
Expand Down Expand Up @@ -350,5 +345,4 @@ Innovation has a [gobetween][] load balancer included that isn't highly availabl
[Recommended Architecture]: {{< url path="Cortex.GettingStarted.OnPremise.AddInnovationTo72.MultipleServerWithHA.RecommendedArchitecture" >}}
[SSL Best Practices]: {{< url path="Cortex.GettingStarted.OnPremise.InstallInnovationOnly.Advanced.SSLBestPractices" >}}
[Upgrading Gateway]: {{< url path="Cortex.GettingStarted.OnPremise.AddInnovationTo72.MultipleServerWithHA.ConfigureCortexGatewayInstallationScriptNew" >}}
[web application server]: {{< ref "#web-application-server" >}}
[Web Deploy]: {{< url path="MSDownload.WebDeploy" >}}
10 changes: 3 additions & 7 deletions ...ng-started/on-premise/install-innovation-only/advanced/rollover-certificates.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -26,12 +26,8 @@ A new, valid X.509 certificate needs to be obtained to update the certificates.

The certificate can be obtained from a Certificate Authority, such as [Let’s Encrypt](<https://letsencrypt.org/>), and must meet the following requirements:

* Subject field must be in one of the following formats depending on whether a multi-domain or wildcard certificate is used:
* Multi-domain certificate - If using the [gobetween][] load balancer this should be specified as the FQDN of the load balancer server (e.g. `CN=load-balancer.domain.com`). If using a different load balancer this must be specified as the FQDN of one of the application servers (e.g. `CN=application-server.domain.com`)
* Wildcard certificate - wildcard format, pertaining to the domain of the Application Servers (e.g. `CN=*.domain.com`).
* Subject alternative names must include any additional host names that should be able to be used to access the API Gateway Service. Additionally if using a multi-domain certificate:
* The FQDN, NetBIOS Name and IP address of all application servers must be added.
* Optionally, the FQDN, NetBIOS Name and IP address of the web application server must be added if the same certificate is used for the web application server.
* Subject parameter must be in a wildcard format, pertaining to the domain of the Application Servers (e.g. `CN=*.domain.com`).
* Subject alternative names must include any additional host names that should be able to be used to access the API Gateway Service.
* Certificate file must be in a .PFX file format, with a known password.
* Certificate file must contain the full chain of certificates.
* Certificate file must include the private key.
Expand All @@ -40,7 +36,7 @@ The certificate can be obtained from a Certificate Authority, such as [Let’s E

This file should be placed in a known location on the Application Server where the certificate update script will be run. This location will be required when running the update script.

If required, a separate X.509 SSL certificate can be obtained to be used by the load balancer to communicate with the Application Services. It must meet all of the other requirements laid out above, except the subject parameter can also be the FQDN of the load balancer (e.g. `CN=load-balancer.domain.com`).
If required, a separate X.509 SSL certificate can be obtained to be used by the load balancer to communicate with the Application Services. It must meet all of the other requirements laid out above, except the subject parameter can also be the FQDN of the load balancer (e.g. `CN=machine-name.domain.com`).

### Configure Update Certificates Script

Expand Down
10 changes: 4 additions & 6 deletions ...on-only/multiple-server-with-ha/install-web-application-server/prerequisites.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -44,19 +44,17 @@ If the user tries to navigate to an address not in the SAN list, then they will
<br/>
For the Flow Debugger, the certificate must have the following properties:

* Subject field must be in one of the following formats depending on whether a multi-domain or wildcard certificate is used:
* Multi-domain certificate - If using the [gobetween][] load balancer this should be specified as the FQDN of the load balancer server (e.g. `CN=load-balancer.domain.com`). If using a different load balancer this must be specified as the FQDN of one of the application servers (e.g. `CN=application-server.domain.com`)
* Wildcard certificate - wildcard format, pertaining to the domain of the Application Servers (e.g. `CN=*.domain.com`).
* Subject alternative names must include any additional host names that should be able to be used to access the API Gateway Service. Additionally if using a multi-domain certificate:
* The FQDN, NetBIOS Name and IP address of the web application server and all application servers must be added.
* Subject field must be in a wildcard format, pertaining to the domain of the Application Servers (e.g. `CN=*.domain.com`).
* Subject alternative names must include any additional host names that should be able to be used to access the API Gateway Service.
* Certificate file must be in a .PFX file format, with a known password.
* Certificate file must contain the full chain of certificates.
* Certificate file must include the private key.
* Key Usage extension must have a value of `Digital Signature, Key Encipherment (a0)`.
* Enhanced Key Usage must include `Server Authentication` and `Client Authentication`.

{{% alert title="Important" color="warning" %}}
Multi-domain certificates, wildcard certificates, auto-generated self-signed certificates and {{< ahref path="Cortex.GettingStarted.OnPremise.InstallInnovationOnly.Advanced.CreateSelfSignedCertificates" title="manually created self-signed certificates" >}} can be used. However, self-signed certificates are not recommended for production instances.
Certificates, wildcard certificates, auto-generated self-signed certificates and manually created self-signed certificates can be used. However, self-signed certificates are not recommended for production instances.
Details on how to create a self-signed certificate can be found at {{< ahref path="Cortex.GettingStarted.OnPremise.InstallInnovationOnly.Advanced.CreateSelfSignedCertificates" title="Create Self-Signed Certificates" >}}.
<br />
It is possible to reuse the Flow Debugger certificate for {{% ctx %}} Gateway; If doing so, you must {{< ahref path="Cortex.GettingStarted.OnPremise.InstallInnovationOnly.MultipleServerWithHA.AssignCertificateFriendlyNameNew" title="Assign a Certificate Friendly Name" >}} after the debugger has been installed and set the `ImportCertificate` parameter to `$false` in {{< ahref path="Cortex.GettingStarted.OnPremise.InstallInnovationOnly.MultipleServerWithHA.ConfigureCortexGatewayInstallationScriptNew" title="Configure CORTEX Gateway Installation Script" >}} to ensure use of the correct certificate and to prevent it from being overwritten.
{{% /alert %}}
Expand Down
22 changes: 8 additions & 14 deletions ...ted/on-premise/install-innovation-only/multiple-server-with-ha/prerequisites.md
View file
Original file line number Diff line number Diff line change
Expand Up @@ -206,10 +206,10 @@ The `Cortex.Innovation.Test.PortUsage.ps1` script is provided during installatio
#### Application Servers
{{% alert title="Note" %}}
For production systems it is recommended that X.509 SSL multi-domain or wildcard certificates are obtained from a Certificate Authority and used for installation. For non-production systems, certificates can be omitted from installation and it will create and use self-signed certificates. This may prevent 3rd parties that require valid certificate verification to access the API Gateway Service.
For production systems it is recommended that X.509 SSL wildcard certificates are obtained from a Certificate Authority and used for installation. For non-production systems, certificates can be omitted from installation and it will create and use self-signed certificates. This may prevent 3rd parties that require valid certificate verification to access the API Gateway Service.
{{% / alert %}}
An X.509 SSL multi-domain or wildcard certificate should be used to:
An X.509 SSL wildcard certificate should be used to:
* Secure communication between the load balancer and the nodes on the Application Servers.
* Secure communication between the Application Services.
Expand All @@ -219,12 +219,8 @@ An X.509 SSL multi-domain or wildcard certificate should be used to:
The certificate can be obtained from a Certificate Authority, such as [Let’s Encrypt](<https://letsencrypt.org/>), and must meet the following requirements:
* Subject field must be in one of the following formats depending on whether a multi-domain or wildcard certificate is used:
* Multi-domain certificate - If using the [gobetween][] load balancer this should be specified as the FQDN of the load balancer server (e.g. `CN=load-balancer.domain.com`). If using a different load balancer this must be specified as the FQDN of one of the application servers (e.g. `CN=application-server.domain.com`)
* Wildcard certificate - wildcard format, pertaining to the domain of the Application Servers (e.g. `CN=*.domain.com`).
* Subject alternative names must include any additional host names that should be able to be used to access the API Gateway Service. Additionally if using a multi-domain certificate:
* The FQDN, NetBIOS Name and IP address of all application servers must be added.
* Optionally, the FQDN, NetBIOS Name and IP address of the web application server must be added if the same certificate will be used for the [web application server][].
* Subject field must be in a wildcard format, pertaining to the domain of the Application Servers (e.g. `CN=*.domain.com`).
* Subject alternative names must include any additional host names that should be able to be used to access the API Gateway Service.
* Certificate file must be in a .PFX file format, with a known password.
* Certificate file must contain the full chain of certificates.
* Certificate file must include the private key.
Expand All @@ -233,21 +229,20 @@ The certificate can be obtained from a Certificate Authority, such as [Let’s E
This file should be placed in a known location on the Application Server where the installation scripts will be run. This location will be required when running the installation script.
If required, a separate X.509 SSL certificate can be obtained to be used by the load balancer to communicate with the Application Services. It must meet all of the other requirements laid out above, except the subject field can also be the FQDN of the load balancer (e.g. `CN=load-balancer.domain.com`).
If required, a separate X.509 SSL certificate can be obtained to be used by the load balancer to communicate with the Application Services. It must meet all of the other requirements laid out above, except the subject field can also be the FQDN of the load balancer (e.g. `CN=machine-name.domain.com`).
#### Web Application Server
{{% ctx %}} Gateway requires an X.509 SSL certificate to be installed on the Web Application Server. This can be the same certificate as used for the application servers or a different certificate.
The certificate must have the following properties:
{{% ctx %}} Gateway requires an X.509 SSL certificate to be installed on the Web Application Server. The certificate must have the following properties:
* Enhanced Key Usage: `Server Authentication` and `Client Authentication`
* Subject Alternative Names (SAN): At minimum the FQDN of the Server. It can also include NetBIOS Name, IP address, localhost, 127.0.0.1
If the user tries to navigate to an address not in the SAN list, then they will receive a certificate error.
{{% alert title="Important" color="warning" %}}
Multi-domain certificates, wildcard certificates, auto-generated self-signed certificates and {{< ahref path="Cortex.GettingStarted.OnPremise.InstallInnovationOnly.Advanced.CreateSelfSignedCertificates" title="manually created self-signed certificates" >}} can be used. However, self-signed certificates are not recommended for production instances.
Certificates, wildcard certificates, auto-generated self-signed certificates and manually created self-signed certificates can be used. However, self-signed certificates are not recommended for production instances.
Details on how to create a self-signed certificate can be found at {{< ahref path="Cortex.GettingStarted.OnPremise.InstallInnovationOnly.Advanced.CreateSelfSignedCertificates" title="Create Self-Signed Certificates" >}}.
{{% /alert %}}
More information about importing the certificate is given during installation.
Expand Down Expand Up @@ -300,5 +295,4 @@ Innovation has a [gobetween][] load balancer included that isn't highly availabl
[Port Requirements]: {{< url path="Cortex.GettingStarted.OnPremise.InstallInnovationOnly.Advanced.PortRequirements" >}}
[SSL Best Practices]: {{< url path="Cortex.GettingStarted.OnPremise.InstallInnovationOnly.Advanced.SSLBestPractices" >}}
[TriggersService]: {{< url path="Cortex.Guides.CortexInnovation.CoreApplication.Services.TriggersService.MainDoc" >}}
[web application server]: {{< ref "#web-application-server" >}}
[Web Deploy]: {{< url path="MSDownload.WebDeploy" >}}
Loading

0 comments on commit 7d8bc33

Please sign in to comment.