Choosing SSL/TLS implementation

YSoft SafeQ Management Service can use two different SSL/TLS implementations:

1. Java standard implementation (org.apache.tomcat.util.net.jsse.JSSEImplementation) - enabled by default

2. OpenSSL implementation (org.apache.tomcat.util.net.openssl.OpenSSLImplementation)

CA-signed certificate requirements

• The certificate must be signed by a certification authority trusted in your environment.

• Certificate (fields Common Name and Subject Alternative Name) must contain all network names (i.e. all hostnames, fully qualified domain names, and IP addresses) used for connection to the respective Management Server.

• For importing the key/certificate you need it in an appropriate format depending on SSL/TLS implementation used:

  • For JSSEImplementation (default) - a single PKCS12 or JKS file containing the private key and the whole certificate chain

  • For OpenSSLImplementation - two separate PEM files, one containing the private key (usually with .key extension) and one with the whole certificate chain (usually with .crt extension).

• The certificate file needs to contain all certificates in the chain in a specified order. The first certificate is the Management's one. Each following certificate belongs to the authority which signed the previous certificate directly. The last one belongs to the Root CA.

Configuring Management Service to use a secure communication channel

In case the Management Server cluster is used, the following steps have to be performed on every node of the Management Server cluster.

1. Stop YSoft SafeQ Management Service service on the server.

2. Copy your key and certificate files to the server where the Management Server is installed.

3. Set following attributes in <install_dir>\Management\tomcat\conf\server.xml file based on used SSL implementation:

   Configuration for JSSEImplementation

   certificateKeystoreFile="absolute/path/to/keystore.p12"

   certificateKeystorePassword="keystore password"
   Configuration for OpenSSL implementation

   certificateFile = "absolute/path/to/your/safeqcertificate.crt"

   certificateChainFile = "absolute/path/to/your/safeqcertificate.crt"

   certificateKeyFile = "absolute/path/to/your/safeqcertificate.key"

   certificateKeyPassword = "key protecting password"

4. If you protect your certificate private key with additional password encryption (using certificateKeyPassword configuration property), make sure it has the same value as certificateKeystorePassword.

5. If you wish to enable automatic redirection from unsecured connection (HTTP port 80) to the secured connection (HTTPS port 443), edit <install_dir>\Management\tomcat\conf\web.xml and uncomment these lines before the </web-app> tag:

   <!-- Uncomment this to enable https only

   <security-constraint>

   <web-resource-collection>

   <web-resource-name>Secured</web-resource-name>

   <url-pattern>/*</url-pattern>

   </web-resource-collection>

   <user-data-constraint>

   <transport-guarantee>CONFIDENTIAL</transport-guarantee>

   </user-data-constraint>

   </security-constraint>

   -->

6. Start the YSoft SafeQ Management Service service on the server.

7. Verify that the management interface is functional and uses your own certificate (open https://<safeq_server_IP> in the browser, click on the lock and View certificate button). In case you enabled the automatic redirection to HTTPS, opening the http://<safeq_server_IP> address will be automatically redirected to https protocol.

Closed ports

AJP port for integration with existing tomcat is disabled by

Example of Tomcat HTTPS configurations

The configuration is stored in <install_dir>\Management\tomcat\conf\server.xml.